vulkro lsp

Runs Vulkro as a Language Server Protocol server, so any editor with an LSP client shows findings inline.

vulkro lsp

The command is the server: it speaks JSON-RPC 2.0 over stdin and stdout with standard Content-Length framing. There are no flags beyond --offline.

When it scans

• didOpen: the first open in a workspace runs a full project scan. Later opens reuse the cached result.
• didSave: re-analyses only the saved file, or the whole project when the file takes part in a cross-file finding.
• didChange: accepted, but does not scan (Vulkro reads from disk).

Each diagnostic has the finding's line, severity (Critical and High are errors, Medium is a warning), the finding id as code, and vulkro as source. Code actions: Suppress (inserts a vulkro:disable-next-line comment) and Explain. The server never edits your code on its own.

Without a licence the server starts but does not scan: it shows a visible "no licence" notice and never publishes empty diagnostics as if a file were clean.

Editor setup

Neovim (nvim-lspconfig):

local lspconfig = require('lspconfig')
local configs = require('lspconfig.configs')
if not configs.vulkro then
  configs.vulkro = { default_config = {
    cmd = { 'vulkro', 'lsp' },
    filetypes = { 'python', 'javascript', 'typescript', 'go' },
    root_dir = lspconfig.util.root_pattern('.git', 'package.json', 'pyproject.toml', 'go.mod'),
  } }
end
lspconfig.vulkro.setup({})

Helix (languages.toml):

[language-server.vulkro]
command = "vulkro"
args = ["lsp"]

[[language]]
name = "python"
language-servers = ["pyright", "vulkro"]

Emacs eglot, Zed and Sublime LSP: register the command vulkro lsp. Run it next to your normal language server. For VS Code, Cursor and Windsurf use the VS Code extension.

Options

initializationOptions: minConfidence (high, medium default, low), saveScope (file default, project), watch.

Variable	Effect
VULKRO_LSP_LOG=1	Trace lines on stderr.
VULKRO_LSP_DEBOUNCE_MS=<N>	didChange debounce (default 300, range 50 to 5000).
VULKRO_LSP_INCREMENTAL=0	Rescan the whole project on every save.

Other VULKRO_* scan variables apply too.

Exit codes

0 clean shutdown. 2 IO failure, malformed framing or a bad argument.