Guardrails CLI

Scan extensions installed in VS Code, Cursor, Windsurf, VSCodium, and VS Code Insiders without executing extension code. The CLI and scanner runtime are distributed together as one package.

Install

pipx install guardlens

The installed command is guardrails.

For Deep Scan providers:

pipx install "guardlens[analysis]"

Use

Open the interactive local scanner:

guardrails

Common commands:

guardrails scan --ide cursor --all --yes
guardrails scan --extension publisher.extension
guardrails scan --file extension.vsix
guardrails report verify report.zip
guardrails help

Guardrails reports the decision, risk score, malware evidence score, analysis coverage, provider status, and detailed findings. Reports can be exported as HTML, ZIP, JSON, or Markdown.

Analysis profiles

• standard: required local static and JavaScript analysis.
• offline: local analysis without network checks.
• deep: the website Deep Scan boundary when all required providers are available.

Missing required analysis produces INCOMPLETE, never ALLOW.

Engine integrity

The scanner runtime remains bundled inside Guardrails. Its exact source revision and file hashes are recorded in the package, and CI rejects unrecorded engine drift:

python scripts/sync_vendored_engine.py --check

Privacy

Installed extensions are analyzed from private temporary snapshots. Extension code is not executed or uploaded. Files remain local unless a report is explicitly exported.

Website: ide-scanner.vercel.app

License

Proprietary. Copyright © 2026 Preetham AK. All rights reserved.