Get started with Deva

Install

Use the CLI, the editor extension, or both. Each includes the signed Deva Core engine, which starts on its own.

• CLI: download it for macOS (Apple Silicon), Windows x64 or Linux x64. Open the macOS package or the Windows setup and follow the prompts; on Linux, extract the archive and add its deva-cli directory to your PATH. Reopen your shell, then run deva version.
• Extension: install Deva Security from the VS Code Marketplace, or from Open VSX for Cursor, Windsurf and other VS Code-compatible editors. It runs on macOS (Apple Silicon), Linux x64 (glibc 2.28 or later) and Windows x64.

Run your first scan

In a repository, or in your editor's integrated terminal:

deva doctor                                  # check the install and the engine
deva scan .                                  # summary and the 10 highest-priority findings
deva scan . --details                        # every finding
deva scan . --format json --output scan.json # complete results as JSON
deva rules list                              # the rule catalog
deva rules explain <rule-id>                 # what a rule looks for, using an ID from your scan

To see a finding on purpose, save this as demo.py in an empty directory and run deva scan . --fail-on medium --no-cache there:

import subprocess

def run_report(user_command):
    return subprocess.run(user_command, shell=True)

Deva reports the shell=True call as CWE-77 command injection (rule deva.cwe-77.python-shell-true); the CWE-78 guide covers the OS command injection it enables. Replace it with a validated argument list and shell=False, then scan again. A finding that disappears is not proof the fix is safe, so test the behavior as well.

Scan in your editor

1. Open a folder, then the Command Palette, and run Deva: Scan Workspace (or Scan Current File).
2. Findings appear in the Problems panel and the Deva sidebar, grouped by file or severity, with Details on each row, plus Fix with Pro.
3. Live checks mark issues in unsaved edits as you type, labelled Deva LIVE. Watch is on by default and re-checks files changed outside the editor, including by git, terminals and coding agents.

Watch saved files from the terminal

On macOS and Linux, watch mode re-checks files as you save them, from any editor or coding agent, and after the first full scan reports what is new:

deva scan . --watch           # human output
deva scan . --watch --events  # deva-watch/v1 JSON lines for tools
deva tui . --watch            # terminal UI

Use Deva in CI

CI needs no login for standard scans. Install the Linux x64 CLI on the runner, verify it against the published SHA-256 checksums, then capture the scan's exit status before any other command runs. This works with set -e:

scan_status=0
deva scan . --fail-on high --format json > scan.json 2> scan-progress.log || scan_status=$?
exit "$scan_status"

Keep scan.json as a build artifact. Exclude paths with quoted patterns, such as --ignore 'vendor/**'. A missing report is not a clean scan.

SARIF for GitHub code scanning and other review tools, JUnit and compliance exports are in Pro: deva scan . --format sarif --output scan.sarif.

Upgrade to Pro

Pro adds AI-assisted validation and fixes with local or bring-your-own-key models, compliance mapping, SARIF and compliance exports, signed evidence and SBOM export, for $9.99 per user per month. Eligible accounts can try it for 14 days without a card.

deva login              # Google; --github or --email EMAIL
deva billing trial      # start the 14-day trial
deva billing checkout   # subscribe through Stripe
deva scan . --compliance soc2

In the extension, run Deva: Sign In, then Deva: Start Trial or Deva: Subscribe to Pro. One account covers both. See pricing for the full list.