VS Code extension · Getting started
The same audit that reviews your pull requests, run on your staged changes from inside VS Code. Findings land at the exact line, verified fixes are one click away, and nothing is posted to GitHub.
Free to install. Each check is billed to your organisation’s credits, like a pull-request audit.
A failed charge is caught and discarded, so the retry job reports success and nobody is told the customer was never billed.
The pull-request audit catches the problem either way. The only question is whether it catches it in front of your team, or in your editor.
In the pull request
You push, open the pull request and wait. The check fails, a comment lands on the line, and the fix is another commit and another round of review.
In your editor
You check before you commit. The same finding appears at its line with a patch PRGuard has already tried on your file, and the pull request opens with it fixed.
Your organisation’s standards, the same engine, the same verdict as the pull request will get.
No comment, review, status or check run. The check is kept in your audit log, and your files are deleted when it ends.
A patch is offered with Apply fix only once PRGuard has applied it to your file and it fitted.
The tour
One short video, seven chapters. Jump to any step, or read the same steps in full below.
Step 1 of 7
Open the Extensions view in VS Code, search for PRGuard, and click Install. A shield icon appears in the activity bar. Or install straight from the Marketplace listing.
Needs VS Code 1.90 or later and git on your PATH. The extension has no runtime dependencies.
Step 2 of 7
In PRGuard, open Account settings → API & CLI and create a key. It starts with prg_ and is shown once — copy it. The same key works for the prguard command-line tool.
One key per account. Creating a new one replaces the old one everywhere; revoke it from the same page if it ever leaks.
Your API key
Shown once. Store it somewhere safe — the extension keeps it in VS Code’s secure storage.
Step 3 of 7
Click Sign in in the PRGuard view, or run PRGuard: Sign in with API key from the command palette, and paste the key. The extension verifies it, then lists the organisations you belong to. With one, it’s chosen for you.
The organisation is remembered per workspace, so a repo that belongs to one org and another that belongs to a second each keep their own choice. Switch any time from the Context files header.
Paste the API key from Account settings → API & CLI. VS Code stores it securely, never in your settings.
Step 4 of 7
The rules PRGuard reviews against — your organisation’s context files — are pulled into a context/ folder in your repo, under the org’s name, and kept current. Read them, or point your coding assistant at them. The folder ignores itself in git.
Sync re-checks every 15 minutes and costs one request when nothing changed. A file the injection scan quarantines is withdrawn from disk. The audit itself always reads the server copy.
Step 5 of 7
Stage your changes. The Next check section shows exactly which files would be sent. Click Run pre-commit check — in the view, the status bar, or the Source Control title bar — and confirm. The check runs on PRGuard’s servers; you see its phase and elapsed time in the panel, and results come back in a few minutes while you keep working.
Three scopes: staged changes (default), all uncommitted changes, or the whole branch against your default branch. Untracked files count as added outside the staged scope. Running the same diff twice reuses the earlier result at no charge.
Step 6 of 7
The PRGuard panel, next to Problems, shows the verdict and every finding with its evidence and suggested fix. Each one is also underlined at its line, and hovering it shows the finding. Where PRGuard wrote a patch and verified it applies to your file, Apply fix makes the change and highlights it, and Undo fix takes it back out. Apply all fixes does the whole check in one step.
Fix with AI hands any finding, with its full explanation, to Claude Code, Gemini Code Assist or GitHub Copilot Chat. Findings tick themselves off as their fixes land. A patch that no longer fits the file, because the lines around it changed, is marked outdated rather than applied in the wrong place.
A failed charge is caught and discarded, so the retry job reports success and nobody is told the customer was never billed.
Fix Log the failure and re-raise it so the job is retried.
Step 7 of 7
Every check you run in a workspace is kept in the History section with its findings. Click one to load it back into the panel; the link icon opens its report. Ticking off or dismissing a finding carries across runs of the same finding. Your latest run comes back on its own when the window reloads.
History lives on your machine. The audits themselves are in your organisation’s dashboard audit log, marked Local, and never leave a comment on GitHub.
Settings
| Setting | Default | What it does |
|---|---|---|
| prguard.serverUrl | https://prguard.dev | Your PRGuard instance. Set before signing in on a self-hosted server. |
| prguard.contextDirectory | context | Where context files sync, relative to the workspace root. |
| prguard.autoSyncIntervalMinutes | 15 | How often to re-check the bundle. 0 turns the timer off. |
| prguard.check.scope | staged | staged · working-tree · branch. Also on the Next check header. |
| prguard.check.includeFileContents | true | Send each changed file’s full contents for the static scan and patch verification. The model reads only the diff. |
| prguard.check.maxFileKilobytes | 512 | Larger files are sent diff-only. |
| prguard.check.confirmBeforeRun | true | Ask before each billed check. User settings only, so a repository can’t turn it off. |
| prguard.fixWithAi.assistant | ask | Where Fix with AI sends a finding: claude-code, gemini, copilot or clipboard. Your first Fix with AI asks and remembers the answer. |
| prguard.fixWithAi.sendAutomatically | false | Send the prompt to Copilot Chat straight away, instead of filling it in for you to review and send. |
Questions
No. A pre-commit check never leaves a comment, review, status or check run. It is recorded in your organisation’s dashboard audit log as a Local check, which teammates can open like any audit. The report keeps the findings, including the few lines each one quotes as evidence, but not your files: the upload is deleted as soon as the check ends, whether it succeeds or fails.
The same as a pull-request audit of the same change: the gatekeeper screen, the static scan, the detect-and-elaborate passes and the patch verification all run. Typically a few tens of cents for a small change. Running an identical diff again reuses the earlier result for free. The confirmation dialog reminds you before every run.
The diff for the chosen scope, split per file, and — by default — each changed file’s current contents, which the deterministic static scan reads and the patch verification applies fixes to. The model itself reads only the diff. Nothing outside the changed files is uploaded.
In VS Code’s secure storage, never in a settings file. VS Code protects it with your operating system’s credential store: the Keychain on macOS, your Windows login on Windows, and the desktop keyring on Linux. It is kept per server — a key for a staging instance is never sent to prguard.dev. Signing out removes it.
Claude Code, Gemini Code Assist and GitHub Copilot Chat, or the clipboard for anything else. You choose once and it is remembered. The finding goes in with its full explanation, framed as a bug to fix rather than instructions to follow, and nothing is sent until you press Enter unless you turn that on. Gemini Code Assist doesn’t accept prompts from other extensions, so for Gemini a new chat opens and you paste.
One thing: the pull-request audit also skeletonises files your change references, fetched from GitHub at a trusted commit. Uncommitted code has no trusted commit, so a local check skips that step. Everything else is the same engine and the same standards. The pull-request audit still runs when you open the PR.
AI usage is part of your subscription, not a bill on the side. Every plan includes a set monthly AI credit allowance, and each audit draws from it — no separate API key to bring, no separate token invoice. And if a busy month needs more, top-up credits are available anytime and roll over.
Install, sign in, stage a change, check it. Under five minutes.