Skip to content
Phylax
Tools & interfaces

VS Code Extension

View package diagnostics, attestations, and policy feedback directly in your editor.

  1. Install from the Marketplace

    Phylax Verified

    View package trust, attestations, and policy feedback in VS Code.

     Phylax Labs · ★ 5.0 · 643 installs
    Install

    Or from the Command Palette: Extensions: Install Extensions, then search Phylax.

  2. Authenticate

    Sign in to your Phylax account from the Command Palette, or run:

    Terminal window
    phylax auth login

  3. What the extension shows

    Inline diagnostics See trust verdicts directly in your code for packages in package.json and manifests.
    Hover insights Hover a package to view attestations, provenance, and risk details.
    Problems panel findings All policy violations and issues are surfaced in the Problems panel for quick action.
  4. .vscode/settings.json
    {
      "phylax.enable": true,
      "phylax.scanOnOpen": true,
      "phylax.policyLevel": "moderate",
      "phylax.showInlineResults": true,
      "phylax.autoUpdate": true
    }

    Commit this file to share one configuration with the whole team. policyLevel accepts lenient, moderate and strict; it controls which verdicts become Problems panel entries, not what Phylax checks.

  5. Quick example

    Open a manifest and the extension annotates each dependency in place.

    package.json
    {
      "name": "demo-app",
      "version": "1.0.0",
      "dependencies": {
        "express": "^4.18.2",
        "left-pad": "^1.3.0"
      }
    }
    express@4.18.2:
    trusted
    integrity:
    verified
    license:
    MIT
    risk:
    low
    left-pad@1.3.0:
    policy violation
    status:
    deprecated package
    maintenance:
    no recent activity
    What WARN means

For the same verdicts while browsing, see the Chrome Extension. To enforce them on every build, see CI/CD Pipelines.

The extension is open source at praxi-labs/phylax-vscode.

Did this page help you?