microsoft/DevSkim

Health v2 · maintenance only

Adoption not part of the score

1004 stars · 131 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DevSkim is a Microsoft security linting framework consisting of IDE extensions, a .NET CLI, and a rule engine that flags security issues inline as developers write code. It supports many languages via regex, JSONPath, XPath, and YAMLPath rules, with plugins for Visual Studio and VS Code built on the Language Server Protocol.

Use cases

• find security vulnerabilities in code as I type
• security linting for my repository in CI
• scan source code for hardcoded secrets and weak crypto
• write custom security analysis rules
• add secure development lifecycle checks to Visual Studio or VS Code

When to choose

• you want inline security feedback inside Visual Studio or VS Code
• you need a cross-platform CLI security scanner covering many languages
• you want customizable rules including JSONPath/XPath/YAMLPath patterns
• you want developer education with guidance on flagged issues

When to avoid

• you need deep taint-analysis or full SAST like CodeQL or Semgrep
• you need dynamic or dependency vulnerability scanning rather than source pattern analysis
• you use an IDE without a DevSkim plugin

Facets

plugin · maturity active

linter security vulnerability-scanning code-review developer-tools security developer-tools testing cross-platform cli editor-plugin windows security-linting sdl static-analysis vscode-extension visual-studio-extension language-server-protocol custom-rules linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="microsoft/DevSkim")