VS Code, Cursor, and Windsurf extension

The Vulkro for Salesforce VS Code extension (vulkro.vulkro-sf) shows vulkro-sf findings inline as you work. It runs the local vulkro-sf lsp language server and does no detection of its own. The same .vsix installs in Cursor and Windsurf.

vulkro-sf install-extension

To install by hand: code --install-extension vulkro-sf-<version>.vsix. It needs VS Code 1.101 or later and an active trial or Pro; without a licence the status bar says so rather than showing empty results.

If it cannot find vulkro-sf, it offers to install it. Install the Salesforce Extension Pack too, for Apex language support.

In a Salesforce DX workspace, the Vulkro Core extension also starts vulkro-sf lsp next to its own server; findings are never shown twice.

What it scans

Apex (*.cls, *.trigger), Visualforce (*.page, *.component), Aura (aura/**/*.cmp and its JavaScript), LWC (lwc/**/*.js, lwc/**/*.html) and metadata (*.flow-meta.xml, *.permissionset-meta.xml, *.profile-meta.xml).

When it scans

• On open: a fast first pass on the file, then a full project scan.
• On save: the saved file is re-analysed against the cached project result (saveScope: project rescans everything).
• While typing: diagnostics are refreshed from the cached scan; typing never starts a scan.
• Watch mode (watch, off by default): rescans the project as files change on disk, including files you never opened.

Findings

Critical and High show as errors, Medium as warnings, Low as information. Each has a stable rule code and a documentation link; traced flows show source, steps and sink. The hover says whether a finding is proven or unproven, and why.

Commands under Vulkro for Salesforce:

• Explain finding by rule ID: the rule's explanation in the output channel.
• Suppress finding on this line: inserts // vulkro:disable next-line <rule>.
• Audit configured target org: a permission set audit of vulkro-sf.targetOrg through your own sf login. The full org audits are the vulkro-sf org commands.
• Export report: runs the same scan CI runs and saves SARIF or JSON.

Settings

All settings start with vulkro-sf..

Setting	Default	What it does
path	vulkro-sf	Path to the binary
severityThreshold	low	Lowest severity shown (display only)
minConfidence	medium	Lowest confidence shown, like --min-confidence
scanOnSave / saveScope	true / file	What a save re-analyses
watch	false	Rescan the project as files change
targetOrg	empty	Org alias for the org audit (or VULKRO_SF_LSP_TARGET_ORG)
codeLens	true	Sharing mode, API version and granting profiles above Apex classes
showAdvancedViews	false	Show the extra sidebar panels
ai.transport	local	local (a local model) or editor (your editor's AI model, opt in)

AI

AI is advisory and never changes a finding, severity or exit code. Fix issue with AI proposes a patch, re-scans the patched file, and shows it for review; it is applied only if you accept and only if the finding is gone. The editor transport sends prompt content (which can include source) to your editor's model provider, so it asks first and is refused under VULKRO_OFFLINE=1.

AI coding agents in the editor can also call the scanner: the extension adds the tools vulkro_sf_scan_file and vulkro_sf_explain_finding, and registers vulkro-sf mcp serve with VULKRO_OFFLINE=1. See vulkro-sf mcp.

See also: Vulkro Core VS Code extension, The sf CLI handoff