DevSkim CLI is a .NET tool designed to provide real-time security analysis within integrated development environments (IDEs) as developers write code. Its primary purpose is to identify and notify developers of potential security vulnerabilities at the point of introduction, enabling immediate fixes and fostering awareness of secure coding practices.
Key Features:
Inline Security Analysis: Provides instant feedback on potential security issues directly in the IDE.
Multi-Language Support: Analyzes code across multiple programming languages, including C#, Java, Python, JavaScript/TypeScript, Go, and more.
Customizable Rules: Offers a flexible rule model that allows developers to create or customize security checks to suit specific needs.
Cross-Platform CLI: Available as a .NET Global Tool, enabling file analysis across Windows, macOS, and Linux.
IDE Integration: Supports Visual Studio and Visual Studio Code via the Language Server Protocol (LSP), delivering error squiggles and guidance for identified issues.
Audience & Benefit:
Ideal for developers, security teams, and DevSecOps professionals looking to embed security into the development lifecycle. By identifying vulnerabilities early, DevSkim CLI helps improve code quality, reduce technical debt, and enhance overall software security posture. It can be installed via winget for seamless integration into development workflows.
README
DevSkim
DevSkim is a framework of IDE extensions and language analyzers that provide inline security analysis
in the dev environment as the developer writes code. It has a flexible rule model that supports multiple programming
languages. The goal is to notify the developer as they are introducing a security
vulnerability in order to fix the issue at the point of introduction, and to help build awareness
for the developer.
Features
Built-in rules, and support for writing custom rules
Cross-platform CLI built on .NET for file analysis
IDE plugins for Visual Studio and Visual Studio Code built on Language Server Protocol
IntelliSense error "squiggly lines" for identified security issues
Information and guidance provided for identified security issues
Optional suppression of unwanted findings
Support for JSONPath, XPATH and YmlPath based rules
Broad language support including: C, C++, C#, Cobol, Go, Java, Javascript/Typescript, Python, and more.
Repository Structure
This repository contains DevSkim and its official supported plugins. Issues and contributions are accepted here for:
DevSkim is also available as a GitHub Action to integrate with the GitHub Security Issues pane.
Platform specific binaries of the DevSkim CLI are also available on our GitHub releases page.
Installation
Visual Studio Extension
The DevSkim Visual Studio extension can be downloaded and installed from the Visual Studio Marketplace.
Alternatively, in Visual Studio, open the Extension Manager (Menu: Extensions -> Manage Extensions), search for "Microsoft DevSkim", select the entry, and click on the Download button.
This will add DevSkim to your PATH. You can then invoke devskim from a command line.
.NET Core App (Self Contained)
Download the platform specific binary archive for your system (Windows, Mac OS, Linux) from the releases page. Extract the archive, navigate to the DevSkim folder from a command line, and invoke devskim or devskim.exe.
.NET Core Runtime Dependent App
First download and install the Latest .NET runtime.
Then download the DevSkim netcoreapp archive from the releases page. Extract the archive, navigate to the DevSkim folder from a command line, and invoke dotnet devskim.dll.
Build from Source
For more information, see the wiki page about how to Build from Source.
Visual Studio Extension / Visual Studio Code Plugin
Once the DevSkim plugin is installed and enabled, simply write some code, and feedback will be provided inline if issues are detected.
Writing Rules
Please see Writing Rules for
instructions on how to author rules.
Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.
When you submit a pull request, a CLA bot will automatically determine whether you need to provide
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
provided by the bot. You will only need to do this once across all repos using our CLA.
