PT Application Inspector

Overview

The PT Application Inspector plugin finds vulnerabilities and undocumented features in application source code. In addition to code analysis, built-in modules detect errors in configuration files and vulnerabilities in third-party components and libraries used in application development. The plugin supports the following languages: C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Scala, SQL, Solidity, TypeScript, C/C++, Objective-C, and Swift.

The plugin also partially supports 1C and Dart. You cannot start scans for 1C or Dart projects with the plugin, but you can use the plugin to create PT AI Enterprise Server projects in these languages or load scan results for 1C or Dart projects from PT AI Enterprise Server (the plugin will then display vulnerabilities detected in these projects).

The "Hardcoded secrets", "Vulnerable components and their use", and "Malicious code detection" modules are also partially supported. You can use the plugin to create PT AI Enterprise Server projects with these modules, or to load scan results from PT AI Enterprise Server (the plugin will then display vulnerabilities detected by these modules).

Note. The scanning of projects in C/C++, Objective-C, and Swift is not supported on macOS.

How it works

Enabling and disabling the plugin

You can enable or disable the plugin in an open project by clicking the icon in the bottom right toolbar. If it is not the first time you are opening the project, the plugin is enabled automatically (scan and action history is saved). You can also set up the plugin to be automatically enabled when a new project is opened.

When the plugin is enabled, the .ai folder is created in the project. This folder contains a database, log files, and a configuration file. For Git to ignore the .ai folder, create an empty file .gitignore in the project folder.

Installing the code analyzer

For the plugin to operate correctly, the PT Application Inspector code analyzer is required. You can install it automatically by clicking Download Analyzer in the pop-up notification in the IntelliJ IDEA interface or manually by downloading it from the link in the instructions below.

To manually install the code analyzer:

1. Download the archive with the analyzer using one of the links:

   • For Windows: download

   • For Linux: download

   • For macOS: download

2. On macOS, run the following command to remove the com.apple.quarantine attribute:

 xattr -d com.apple.quarantine <analyzer file path.pkg>

Then run the installation file and follow the instructions.

3. Extract the analyzer archive to one of the following locations:

   • On Windows: %LOCALAPPDATA%\Application Inspector Analyzer

   • On Linux: ~/application-inspector-analyzer

   • On macOS: /Library/Application-Inspector-Analyzer

Stopping a scan

To stop a project scan, click Stop scan in the PT Application Inspector panel or close the progress bar in the bottom toolbar.

Some vulnerabilities have additional exploitation conditions displayed in the Additional Conditions tab.

When you scroll through the sections of the diagram, the vulnerability information is automatically pinned until you move on to another vulnerability. If you want to view the information about a certain vulnerability while working on the code, you can pin this vulnerability manually.

Several vulnerabilities can have the same exit point. If these vulnerabilities belong to the same type, they are grouped together and displayed as one problem with different exploitation options. You can view detailed information about such vulnerabilities in the [PT AI] Vulnerability Details panel.

Note. If you confirm one vulnerability from the group, the whole problem will be confirmed automatically. To discard an entire problem, you must discard all the vulnerabilities in the group.

Managing detected vulnerabilities

The PT Application Inspector plugin contains a set of tools for managing detected vulnerabilities. With these tools, you can do the following:

• Filter vulnerabilities by severity, status, and suppression from scan results by clicking the eye button.
• Confirm and discard vulnerabilities by clicking Confirm or Discard on the [PT AI] Vulnerability Details panel.
• Confirm, discard, and suppress vulnerabilities in their context menu in the code editor. There you can also perform group actions on all vulnerabilities in the file. For example, click Confirm vulnerability → Fix all 'Vulnerable Code' problems in file.
• Manage the statuses of several vulnerabilities by selecting them in the Detected Vulnerabilities tab and changing the status using the corresponding button.

You can start the assistant from the pop-up notification that appears when the scan is completed or by clicking the Assistant button. You can choose to go through the whole scenario or only certain steps.

How to get a recommendation:

1. Select a vulnerability on the Detected Vulnerabilities tab or by clicking Suggest fix in the code editor context menu.

2. Select the How to Fix tab.

3. Click Create.

You can apply the suggested fix or generate an alternative option.

Note. Recommendations can be generated for all vulnerabilities except those excluded from scan results, discarded, or belonging to the SCA, Weakness, or MaliciousCode class.

Integration with AI agents

The PT Application Inspector plugin supports integration with external AI agents (such as Cursor, Claude Desktop, and Windsurf) via the Model Context Protocol (MCP). Integration allows agents installed on your computer to work directly with scan results: request a list of detected vulnerabilities, review vulnerability details (data-flow diagrams and additional exploitation conditions), confirm or discard vulnerabilities, or start scans. This saves you from having to manually copy vulnerability descriptions into the agent chat. You can ask the agent to find and fix vulnerabilities, and it will analyze the scan results and suggest code changes. All agent actions, such as starting a scan or changing a vulnerability status, are immediately reflected in the plugin interface. You see them directly in the IDE while communicating with the agent.

Don't Show Again button.

Standalone MCP installer

If you do not use an IDE, you can install an MCP server as a standalone npm package @posidev-community/ptai-mcp. This is helpful if you work with terminal AI agents (such as Claude Code or Codex CLI) outside an IDE or want to integrate scanning into headless environments.

This package requires Node.js 18 or later.

To install an MCP server in standalone mode,

1. Run the following command in the terminal:

   npx -y @posidev-community/ptai-mcp install

AI hooks (GenAI Code Gates)

AI hooks provide proactive protection. An AI agent must check the code it generates with a local analyzer before issuing a final response. A hook is triggered when the agent finishes generating a response. An incremental scan starts automatically, and the agent receives a summary of the results, including the number of detected vulnerabilities broken down by severity and a list of affected files. If any of the files were modified by the agent, it requests details and fixes the vulnerabilities following a cycle: generated → checked → fixed.

To save time and resources, the plugin takes a snapshot of the project files before running the agent. If no files have been changed by the time the response is complete, the scan is skipped.

You can manage hooks for each project individually.

To disable hooks for the current project,

1. In the IntelliJ IDEA main menu, click Tools → PT Application Inspector → Disable AI Hooks for This Project.

To enable hooks,

1. In the IntelliJ IDEA main menu, click Tools → PT Application Inspector → Enable AI Hooks for This Project.

Integration with PT AI Enterprise Edition

The PT Application Inspector plugin can be integrated with PT AI Enterprise Edition. The integration allows all team members to work with the source code from different environments, which makes the development process more secure.

To configure the integration:

1. In the IntelliJ IDEA main menu, click Tools → PT Application Inspector → Connect to PT AI Server.

2. Enter the PT AI Enterprise Server address and click Connect.

   

   • Send a local project for scanning to PT AI Enterprise Server with or without saving the results on the server.

   

For more information about the integration, see the PT AI Enterprise Edition User Guide.

Managing branches

If a project is a Git repository, the plugin uses a current branch as the local working branch. Local scan results, vulnerability statuses, and data on synchronization from PT AI Enterprise Server are associated with that branch.

When you set up synchronization between a local project and a PT AI Enterprise Server project, you must select the branch on the server that matches a current local branch. You can map a different branch later by selecting Tools → PT Application Inspector → Change PT AI Server Project Branch or by clicking a branch name in the scan results panel.

Branch mapping is needed for the following operations:

• Uploading source code to PT AI Enterprise Server

• Sending a local project to PT AI Enterprise Server for scanning

• Synchronization of vulnerability statuses and scan results