Fitting in
In your editor
The same review this server runs nightly, on the file you are editing, before the commit exists.
Four editors, one language server
Visual Studio Code and Cursor install the same package, because Cursor is a fork of it and takes the same file. The JetBrains IDEs and Eclipse run the language server underneath, through LSP4IJ and LSP4E. Neovim, Helix and Sublime Text run the same one. There is not a plugin per IDE to keep in step, which is how this kind of thing usually dies: four codebases, and a fix that lands in one of them.
It comes from your server, not a marketplace
The download is a page in the product. That is deliberate: this server is the one that holds your rules and your exclusions, and a fair number of these installations sit on a network with no way out at all. The package carries the version of the server that served it, and building the same release twice gives the same bytes, so the checksum on the page is one you can actually compare.
Your file goes to your server
Open or save and the text of that one file is sent to your own installation, read by the same engines a scan uses, graded by the same triage, and deleted. Nothing is stored: a review creates no finding, no exception and no scan. Every other tool in this market sends that file to a vendor.
Only the lines you touched
A plugin that opens showing two thousand findings is uninstalled that afternoon, and none of those two thousand are yours. By default only lines that differ from HEAD carry a finding, and the status bar says how many older ones are in the file without drawing them.
The triage travels with it
Every finding arrives with the sentence saying why it survived the filter, and anything the triage set aside is shown struck through rather than hidden. A credential is red whatever its severity says, with the value masked, because a live key in a file you are about to commit is the one thing here that cannot wait.
Nothing to install but the package
No dependencies, in either package. A security product whose editor plugin pulls three hundred packages off a registry is arguing against its own report.
What it does not do
The plugin is not on any marketplace, so an editor will not update it for you: a new release means downloading it again from the page. JetBrains and Eclipse need a generic language server client first, LSP4IJ or LSP4E, and those do come from their marketplaces. Neither package is signed, because a marketplace signs what it distributes and this server is not one. And the analysis is on the server, so with no route to it there is nothing in the editor.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.