PT Application Inspector

Overview

The PT Application Inspector plugin finds vulnerabilities and undocumented features in application source code. In addition to code analysis, built-in modules detect errors in configuration files and vulnerabilities in third-party components and libraries used in application development. The plugin supports the following languages: C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Scala, SQL, Solidity, TypeScript, C/C++, Objective-C, and Swift.

Note. The scanning of projects in C/C++ and Objective-C is not supported in macOS.

How it works

Enabling and disabling the plugin

You can enable or disable the plugin in an open project by clicking the icon in the bottom right toolbar. If it is not the first time you are opening the project, the plugin is enabled automatically (scan and action history is saved). You can also set up the plugin to be automatically enabled when a new project is opened.

When the plugin is enabled, the .ai folder is created in the project. This folder contains a database, log files, and a configuration file. For Git to ignore the .ai folder, create an empty file .gitignore in the project folder.

Installing the code analyzer

For the plugin to operate correctly, the PT Application Inspector code analyzer is required. You can install it automatically by clicking Download Analyzer in the pop-up notification in the IntelliJ IDEA interface or manually by downloading it from the link in the instructions below.

To manually install the code analyzer:

1. Download the archive with the analyzer using one of the links:

   • For Windows: download

   • For Linux: download

   • For macOS: download

2. In macOS, run the following command to remove the com.apple.quarantine attribute:

   xattr -d com.apple.quarantine <analyzer_file_path.pkg>

   Then run the installation file and follow the instructions.

3. In Windows and Linux, unpack the archive to one of the following locations:

   • In Windows: %LOCALAPPDATA%\Application Inspector Analyzer

   • In Linux: ~/application-inspector-analyzer

Stopping a scan

To stop a project scan, click Stop scan in the PT Application Inspector panel or close the progress bar in the bottom toolbar.

Some vulnerabilities have additional exploitation conditions displayed in the Additional Conditions tab.

When you scroll through the sections of the diagram, the vulnerability information is automatically pinned until you move on to another vulnerability. If you want to view the information about a certain vulnerability while working on the code, you can pin this vulnerability manually.

Several vulnerabilities can have the same exit point. If these vulnerabilities belong to the same type, they are grouped together and displayed as one problem with different exploitation options. You can view detailed information about such vulnerabilities in the [PT AI] Vulnerability Details panel.

Note. If you confirm one vulnerability from the group, the whole problem will be confirmed automatically. To discard an entire problem, you must discard all the vulnerabilities in the group.

Managing detected vulnerabilities

The PT Application Inspector plugin contains a set of tools for managing detected vulnerabilities. With these tools, you can do the following:

• Filter vulnerabilities by severity, status, and suppression from scan results by clicking the eye button.
• Confirm and discard vulnerabilities by clicking Confirm or Discard on the [PT AI] Vulnerability Details panel.
• Confirm, discard, and suppress vulnerabilities in their context menu in the code editor. There you can also perform group actions on all vulnerabilities in the file. For example, click Confirm vulnerability → Fix all code vulnerabilities in the file.
• Manage the statuses of several vulnerabilities by selecting them in the Detected Vulnerabilities tab and changing the status using the corresponding button.

The assistant shows AI-driven recommendations on how to fix detected vulnerabilities.

Comparing scan results

You can compare results of two scans within a project. To do this, in the Scan History tab, in the context menu of the first scan, select Compare with, and then select the second scan.

When you switch branches in Git, the plugin automatically switches to a corresponding local branch. If the new local branch is not yet mapped to a PT AI Enterprise Server branch, a notification with the Select Branch button is displayed. Before uploading code, syncing artifacts, or running a remote scan, you must select the required branch in PT AI Enterprise Server.

When the names of a local and remote branch differ, the plugin displays a warning before uploading source code or scan artifacts. You can continue the operation if the mapping was intentional, or you can cancel the action and select a different server branch.

If the Git repository is not initialized, the option to select a remote branch is still available. If the mapped branch was deleted in PT AI Enterprise Server, select a different branch when you receive the corresponding notification.

Plugin settings

To configure the plugin system configuration, select Tools → Options → Service → PT Application Inspector.

The plugin configuration page contains the following sections of settings.

General settings section:

• Analyzer log level. Set the starting severity level from which the code analyzer events are logged. The default value is error.
• Trigger scan. Start scan condition: manually on clicking a start button or automatically when a project file is changed. Default: manually.
• Automatically enable for any project. Automatically activate the plugin when opening a project. By default, this setting is disabled.
• Use an additional tool window to view information. Display the Data Flow, Exploit, and Additional Conditions tabs in a separate [PT AI] Vulnerability Details panel. By default, this setting is enabled.
• Allow telemetry collection. Collect general scan information to be sent to PT AI Enterprise Edition. By default, this setting is enabled. Here you will find an example of the data that we collect. For more information, see the Privacy statement section.
• Use all available resources. Use all available RAM and CPU resources to increase the scanning speed. By default, this setting is disabled.
• Number of scan history results to store. The maximum number of scan results saved in the history. Unlimited by default. If the limit is exceeded, each new scan result deletes the oldest result.
• Number of days to store log files for. The log file storage period. The default value is 30.
• Maximum number of stored log files. The number of log files stored. The default value is 100.

Server settings section:

• Server URL. The address of the connected PT AI Enterprise Server.
• Notify about new scan results from the PT AI server. Toggle the display of notifications about receiving new scan results from PT AI Enterprise Server if synchronization with the project is configured. By default, this setting is enabled.
• Automatically update scan results from the PT AI server. Update scan results from PT AI Enterprise Server if synchronization with the project is configured. This setting is available if notification of new scan results is enabled.

Assistant section:

• Run the assistant. Activate the assistant automatically after the first scan or manually by clicking Assistant. The default value is "Automatically after the first scan."
• Show recommendations on the Quick Fix menu. Displays tips from the assistant. By default, this setting is enabled.
• The number of vulnerabilities to be confirmed or discarded starting from which a notification from the assistant will be displayed. The default value is 5.
• The number of similar vulnerabilities starting from which a notification from the assistant will be displayed. The default value is 5.
• Suggest vulnerability fixes. Show the How to Fix tab with vulnerability fix recommendations. The section contains settings for the YandexGPT network:
  • Model name
  • OAuth token for Yandex Cloud
  • ID of the Yandex Cloud directory for which your account has the ai.languageModels.user role
  • Temperature: a value from 0 to 1, which defines the model response variability (the higher the value, the more unpredictable the query output)
  • Maximum number of tokens in one recommendation (the number of tokens in the same text may vary between models)

Requirements

For the correct operation of the PT Application Inspector plugin, the following technical requirements must be met:

• JetBrains IDE (PhpStorm, IntelliJ IDEA, WebStorm) 2025.1 or later
• 8 GB RAM
• 5 GB of free hard drive space

Supported 64-bit OS:

• Debian 11 Bullseye or later
• Fedora Workstation 38 or later
• OpenSUSE Leap 15.5 or later
• Ubuntu 22.04 LTS or later
• Ubuntu 23.04 or later
• Windows 11
• ALT Linux OS in the test mode

Supported macOS:

• Big Sur 11.5 or later
• Monterey 12.0.0 or later

Support and feedback

If you have any questions about the plugin, follow the links in the Help & Feedback section on the plugin configuration page to get the necessary information, join our community, or report an issue.

Privacy statement

By default, the PT Application Inspector plugin collects anonymous telemetry. This allows our specialists to improve the stability and performance of the product. They can optimize resource consumption and speed up scanning, find and fix errors across different IDE versions more quickly, and understand which features are used most often to improve the user experience.

Only technical metrics (interaction events, environment settings, and the main scanning settings) for the plugin and IDE are sent. Source code, credentials, tokens, and project contents are completely excluded. All data is transmitted over a secure HTTPS channel, processed anonymously, and not shared with third parties. It does not contain any confidential information.

If you do not want to participate in telemetry collection, disable the Allow telemetry collection setting. Changes take effect immediately, without restarting the IDE.