Three commands. Any IDE. Every stage of development — from architecture sketches to CI/CD pipelines. Arcwall finds what scanners miss.
Install the extension, get an API key, open a project. That's it.
Install from the VS Code Marketplace. Works in VS Code, Cursor, and Windsurf.
Enter your work email at arcwall.io — your API key appears instantly on screen. Paste it into VS Code settings under arcwall.apiKey. Takes 60 seconds.
Open any project folder. Press Ctrl+Shift+P and run Arcwall: Build Threat Model (Code). Results appear in a panel beside your editor in under 30 seconds.
Design stage, code stage, or review — Arcwall covers the entire development lifecycle.
Scans your repository locally. Finds authentication patterns, trust boundaries, data flows, and external service calls. Returns a full STRIDE model with severity ratings.
No code needed. Describe your system through a structured intake — entry points, external services, sensitive data. Arcwall produces a threat model before a line is written.
Open any threat model file and score it against OWASP ASVS. Get a gap analysis with specific controls missing and remediation recommendations.
Arcwall finds the architectural decisions that make your system insecure — not the code defects that traditional scanners already catch.
Authentication assumptions that let attackers impersonate legitimate users or services across trust boundaries.
Missing validation at data flow boundaries that allows modification of data in transit or at rest.
Actions that can be performed without an immutable record — the gap that makes forensic investigation impossible.
Architectural paths where sensitive data flows through unclassified services or gets exposed to unauthorized parties.
Rate limiting gaps, unbounded resource consumption, and single points of failure that make services unavailable.
Trust boundary misconfigurations that allow users to gain capabilities or access beyond their intended scope.
Arcwall tells you exactly how confident it is in each finding. No false authority, no generic advice.
Finding is based on specific code patterns found in your repository. High confidence — something is demonstrably present or absent.
Finding is based on patterns that strongly suggest a risk, but not definitively proven from the code alone. Worth investigating.
Arcwall identified a potential risk but needs your input to confirm or rule it out. Respond directly in the VS Code panel.
// Start free today
Install the extension. Get your API key. Run your first threat model in 60 seconds.