Installation

What SecureSense needs, how to install each piece, and how to check it worked.

#The quick way

Once Python is installed, SecureSense can install everything else for you. Run SecureSense: Install Missing Tools (Command Palette, the panel's ... menu, or the Check your setup step of the Getting Started tour). It checks what's missing and shows a list — with sizes and sources — where you can untick anything before it starts:

Nothing is downloaded until you confirm, the download can be cancelled at any time, and a corrupted or tampered download is deleted rather than installed. SecureSense finds the installed tools automatically — no PATH changes. If you've pointed a setting (securesense.pythonPath, semgrepPath, codeqlPath) at your own copy, SecureSense leaves it alone and tells you what to fix instead.

Python itself isn't installed automatically; if it's missing you get the download link (on Windows, also a winget command to copy).

The rest of this page is the manual way.

#Other editors and the command line

• Cursor, Windsurf, VSCodium and other VS Code-based editors run the same extension. Search for SecureSense in their Extensions view: it's published on Open VSX, the marketplace those editors use. The downloaded .vsix also works (Extensions → ... → Install from VSIX…).
• No editor: pip install "securesense[semgrep]" gives the securesense command, which scans, merges and triages a project from a terminal or a CI job. See Command-line tools.

#Requirements

You only need one scanner to start; SecureSense uses whichever are available and tells you if one is missing.

#Python environment and the agent

From the repository root:

python -m venv .venv
.venv\Scripts\activate                  # macOS/Linux: source .venv/bin/activate
pip install -r agent/requirements.txt -r agent/requirements-dev.txt

The extension finds this .venv automatically. To use a different interpreter, set securesense.pythonPath.

#Semgrep

pip install semgrep
semgrep --version

If you installed Semgrep into the repository's .venv (as above, with the environment activated), SecureSense finds it there automatically — no PATH change or setting needed.

SecureSense runs Semgrep with the p/python rule pack, which downloads rules (never your code) from the Semgrep registry. To scan fully offline, clone semgrep-rules and point securesense.semgrepConfig at its python folder.

#CodeQL

1. Download the latest CodeQL bundle for your platform from the codeql-action releases (a codeql-bundle-*.tar.gz file).
2. Extract it somewhere permanent, e.g. C:\tools\codeql.
3. Either add that folder to your PATH, or set securesense.codeqlPath to the full path of codeql.exe.

codeql version

The first CodeQL scan of a project builds a database and takes a minute or two; SecureSense caches it, so later scans are faster.

#The extension

Download securesense.vsix, then in VS Code: Extensions view (Ctrl+Shift+X) → ··· → Install from VSIX… → pick the file. Or code --install-extension securesense.vsix. The Getting Started tour opens and can install the rest (see the quick way).

To run it from source instead (developers), install extension/'s dependencies with npm install, open the repository in VS Code and press F5 — see Getting started.

#Check everything

cd agent
python -m pytest                                  # agent tests
python -m securesense_agent.benchmark             # should end with "acceptance bar: PASS"
cd ..\extension
npm test                                          # extension tests

#Check from inside VS Code

Run SecureSense: Check Setup (Command Palette, or the panel's ... menu). It runs each tool the same way a scan does and reports, for example:

Python ✓ 3.14.7 · agent ✓ · Semgrep ✓ 1.178.0 · CodeQL ✗

with the exact fix for anything missing; details go to the SecureSense output channel. You're ready when Python, the agent and at least one scanner pass.

If something is missing, SecureSense: Install Missing Tools can fix it (see the quick way).

Something unclear or wrong? Edit these docs on GitHub.