Install VS Code extension

Last updated: Mar 26, 2026

Enhance your development workflow with the Fluid Attacks extension for Visual Studio Code (VS Code). This powerful tool helps you identify and address vulnerabilities without leaving the IDE. These are the key features of this plugin:

• View the specific files and lines of code with reported vulnerabilities.
• Access detailed documentation on your code's vulnerabilities.
• Accept vulnerabilities temporarily.
• Leverage Claude Sonnet's AI model to generate custom guides for fixing vulnerabilities or fix vulnerabilities automatically.
• Request reattacks.

To learn about these features, read "Functions of the VS Code extension".

Download the extension

To download the extension, follow these steps:

1. Open VS Code.

2. Access the extensions view.

   

3. Type Fluid Attacks in the search bar.

4. Locate the extension and click on Install.

   

Connect VS Code with the Fluid Attacks platform

After downloading the extension, you need to configure it to connect the Fluid Attacks platform with VS Code. This can be done in two ways:

• Within the extension
• Using the terminal

Configure within the extension

1. Click the Fluid Attacks extension icon in the VS Code activity bar.

   

2. Click Add token.

   

3. Paste your API token and press Enter.

   

4. Click the Refresh button to apply the changes.

Configure using the terminal

1. Open the terminal in VS Code.
2. Use the following command to set the FLUID_API_TOKEN environment variable with your API token:

export FLUID_API_TOKEN="your_token"

Verify successful installation

Once you have the VS Code extension set up, verify that it functions correctly:

1. Open the base folder of your Git repository in VS Code.

2. Ensure the base folder's name matches the repository nickname or that the remote URL is set for the local repository.

3. You should see the Fluid Attacks extension icon in the IDE's activity bar and red dots on files with identified vulnerabilities. This confirms successful configuration.

   

Troubleshooting

If the Fluid Attacks VS Code extension does not function correctly, try the troubleshooting steps.

Telemetry

The Fluid Attacks extension collects error data, which Fluid Attacks analyzes to improve functionality and performance. This data collection respects your VS Code telemetry settings. To opt out, you can disable VS Code's telemetry.