Meterian Launches HEIDI Security Plugin for IDEs and AI Coding Assistants
Meterian has released HEIDI, a free IDE plugin that integrates real-time open-source vulnerability intelligence into development environments and AI coding assistants.
Meterian has launched HEIDI, a free security plugin for Visual Studio Code and JetBrains IDEs designed to identify vulnerable open-source dependencies directly within the development environment. By shifting vulnerability scanning to the earliest stages of the software development lifecycle, the tool aims to reduce security debt before code is even committed to a repository Help Net Security.
The plugin supports a wide range of programming languages, including Java, .NET, Node.js, Python, PHP, Ruby, Rust, and Go. It functions by scanning manifest files locally on the developer's machine, ensuring that source code remains on the local system. Once a vulnerability is detected, the plugin provides developers with one-click upgrade options to remediate the issue immediately Help Net Security.
A core feature of HEIDI is its built-in Model Context Protocol (MCP) server, which allows AI coding assistants to query live vulnerability data in real-time. This integration is designed to address the limitations of AI models that rely on static training data, which often lack information on the latest security threats. Supported AI clients include GitHub Copilot, Cursor, Windsurf, Claude Code, Gemini CLI, and Codex CLI Help Net Security.
According to Meterian CTO Bruno Bossola, the platform's effectiveness relies on the speed of its data pipeline. Meterian monitors upstream advisories and official project announcements, often updating its database within hours of a disclosure. This process can flag vulnerabilities days before they appear in standard sources like the National Vulnerability Database (NVD) or the GitHub Advisory Database Help Net Security.
The plugin’s automatic registration with AI clients has drawn some scrutiny, as it configures itself to be recognized by these tools without requiring separate prompts for each client. Bossola stated that this is a technical necessity for the plugin to function within those environments and emphasized that the registration process does not grant the plugin control over the AI clients or enable code exfiltration Help Net Security.
Regarding the common industry challenge of false positives, Meterian maintains a strict policy. The company argues that any known vulnerable package should be replaced if a patched version is available, regardless of whether the vulnerable code is currently reachable in the application. For rare instances where a finding must be ignored, the plugin offers a one-click "snooze" feature Help Net Security.
As developers increasingly rely on AI-assisted coding, tools like HEIDI represent a shift toward integrating security intelligence directly into the developer workflow. By closing the gap between vulnerability disclosure and remediation, these plugins aim to prevent the accumulation of security debt in modern software supply chains Help Net Security.