Docs / Editor extension

Save a file. See what broke.

The extension checks your AI’s work again after each save and shows what’s wrong in the status bar, the Problems panel and a results page. Click any problem to jump to the line.

Malveon — landing-shop — Visual Studio Code
Malveon

Malveon/landing-shop·Checked 10:42 am·Checking…

3 things block a commit

Fix these, then run the check again.

  • Read from the code done
  • Your build and tests: not run
  • Your real app: not verified — malveon never runs it
  • plan items: 1 BROKEN, 0 NOT BUILT, 1 HALF BUILT
  • new bugs this session: 1 introduced (something that worked now broken, or a known bug pattern added)
  • agent's claims vs reality: 1 claim(s) contradicted by what was actually verified
Plan items

Every line of your plan, checked against the code. From PLAN.md.

BROKEN1Would fail for a real user: the screen calls something the server doesn't serve, or with the wrong method.

  • CancelButton cancels an order with DELETE /api/orders/[id]

    CancelButton exists (src\components\CancelButton.tsx) — but it calls DELETE /api/order/:param (src\components\CancelButton.tsx:5), and no server route handles that; the server route for /api/orders/:id exists (src\app\api\orders\[id]\route.ts:4), but no frontend call to it was found (if something outside the app calls it — a health check, webhook, cron job or public API — say so in the line)

NOT BUILT1Your plan names it. The code doesn't have it.

  • Export all orders as CSV from GET /api/reports/orders

    nothing in the code serves or calls /api/reports/orders

    (not ticked in your plan yet, so it doesn't block)

HALF BUILT1Part of it exists, but it isn't connected yet.

  • OrderNotes saves a note on an order with POST /api/notes

    POST /api/notes reaches its server route (src\app\api\notes\route.ts:4), but the route never changes any data: it only reads table notes (src\app\api\notes\route.ts:6) — and this line expects a change

    1. Screenpage /orders
    2. CallPOST /api/notes
    3. Serverroute POST /api/notes
    4. Changeschanges no data: only reads table notes
CONNECTED2Built, and the screen reaches its server or database.

  • Orders page at /orders lists orders from the orders table

    page /orders exists (src\app\orders\page.tsx) and talks to table orders; page /orders uses table orders (src\app\orders\page.tsx:16)

    1. Screenpage /orders
    2. Databasereads table orders

  • RefundButton sends a refund to POST /api/refunds, which saves it to refunds

    POST /api/refunds reaches its server route; RefundButton exists (src\components\RefundButton.tsx) and talks to POST /api/refunds; RefundButton calls route /api/refunds (src\components\RefundButton.tsx:5); route /api/refunds uses table refunds (src\app\api\refunds\route.ts:6)

    1. Screenpage /orders
    2. CallPOST /api/refunds
    3. Serverroute POST /api/refunds
    4. Changesinserts into table refunds
NOT CHECKED1Names nothing malveon can look up, so nothing was checked. Name the URL, file, or component it means, in backticks.

  • Make orders better

    names no URL, file or code name, and no code clearly matches its words

    Closest in the code: /orders (src\app\orders\page.tsx:1); DELETE /api/order/:param (src\components\CancelButton.tsx:5); DELETE /api/orders/:id (src\app\api\orders\[id]\route.ts:4). Name one in backticks if it's what this line means.

SKIPPED1Not code tasks: headings, design notes, manual steps and build steps.
Your prompts

What you asked your agent in chat, checked against the code.

Most of what you ask an agent never reaches a plan doc.

Malveon can check those requests too. It shows you exactly what it adds to your agent's settings and asks before writing anything.

Other checks

Problems that don't belong to a single plan line.

  • Frontend and backend agree on dataclean
  • Backend route conflictsclean
  • New bugs this session1
    • DELETE /api/order/:paramNEW CALL TO NOWHERE
  • Unplanned code2
    • POST /api/receiptsroute
    • POST /api/receiptscall
  • UI elements may overlapclean
  • Unfinished codeclean
  • Agent's claims vs reality1
    • OrderNotes saves a note on an order with POST /api/notesclaimed this works, but the plan-items check says HALF BUILT: POST /api/notes reaches its server route (src\app\api\notes\route.ts:4), but the route never changes any data: it only reads table notes (src\app\api\notes\route.ts:6) — and this line expects a change
  • Build, lint and tests actually rannot run — use the build and tests button
Malveon reads your code, never the agent's word. CONNECTED means built and connected in the code — not run, and not clicked through in your real app.
mainmalveon: blocked (3)
The extension's own results page and sidebar, run on a real report from the demo orders app. Open and close the groups; the buttons only work inside the editor.

Install

Open Extensions in VS Code or Cursor, search for “malveon” and install it. The extension carries its own copy of malveon, so there is nothing else to install.

Confirmed in VS Code and Cursor. Antigravity, and the Mac and Linux builds, are built but not tested yet.

What you see

  • Status bar. malveon: clean or malveon: blocked (N). Click it to open the results.
  • Problems panel. A squiggle on the plan line that isn’t built or is broken, and on the line of code behind it. Unplanned code and layout risks show as warnings, unfinished-code notes as information.
  • Sidebar. Your plan lines and your prompts, grouped by what malveon found. Click any item to open it.
  • Results page. The whole report in the editor, with the verdict at the top, a bar of plan results, and every file and line clickable. It updates in place after each check.
  • Output panel. The full text report, the same as malveon check prints in a terminal.

Your first five minutes

  1. 01Open your project and click Run check in the Malveon sidebar. If more than one file could be your plan, it asks which one, once, and remembers.
  2. 02Click Check your prompts too if you want what you type to your AI checked as well. It shows exactly what it will add and writes only after you say yes.
  3. 03Keep working. From now on it checks by itself.

The buttons

ButtonWhat it does
Run checkChecks now and opens the results page.
Run with build and testsAlso runs your project’s own build, lint, type check and tests. A separate button because it runs real commands and can take a few minutes. The first time, it asks you to approve them.
New run (+)For starting a new task. Starts a fresh baseline from now, so earlier prompts and changes stop counting, asks which plan files this run is about, then checks.
Check your prompts tooSets up prompt capture.
Pick plan files againChoose different plan files.
Copy setup for another agentGives you the connect line for an AI tool in a terminal or another editor.
Copy a message for your agentCopies a message to paste to your AI, asking it to run malveon and say what each of your prompts asked for.
Withdraw promptRight-click a prompt in the sidebar to stop checking one you cancelled. It asks you first.

When it checks by itself

  • About 3 seconds after you stop saving.
  • About 1 second after a new prompt of yours is captured.
  • Never with your build and tests. Those only run when you click the button.
  • Never before the first check you start yourself, so no dialog appears out of nowhere.

Change this with the malveon.autoCheck setting. When you open a project that already uses malveon, the extension also starts a session for you, so you never need to run malveon session start by hand.

It connects your editor’s AI too

The extension registers malveon with your editor’s own AI tool, so that AI can run the check itself. For an AI in a terminal or another editor, use Copy setup for another agent in the sidebar menu. More on this: Let your AI run the check itself.

Antigravity

Antigravity doesn’t give hooks the text of your prompts. So the extension reads your prompts from Antigravity’s own conversation log and hands each one to malveon, but only after you say yes to “Check your prompts too”. That log’s format isn’t documented and could change. If malveon can’t read it, the report says so instead of skipping the prompt.

You stay in charge

Anything that changes a setting, runs your project’s commands, or stops a prompt from being checked asks you in a dialog first. The AI can’t answer those for you.

Privacy

malveon runs on your computer. Your code, file names, plans and prompts never leave it.

Two things use the network: anonymous usage signals (which command ran, whether a check came back clean, your operating system and malveon’s version) and a once-a-day check for a newer version. The signals follow your editor’s telemetry setting: turn telemetry off in your editor and malveon sends none. DO_NOT_TRACK=1 and MALVEON_NO_UPDATE_CHECK=1 turn them off too. Details: privacy policy.

Settings

SettingWhat it does
malveon.autoCheckWhen malveon checks again by itself: onSaveAndPrompt (the default), onPrompt (only when a prompt arrives), or off.
malveon.pathUse your own installed malveon instead of the one in the extension. The full path to the program.

Limits

  • With several folders open in one window, it checks the first folder only.
  • A plan written as JSON gets a squiggle on the file, not on the exact item.
  • Prompt results show in the sidebar and the results page, not as squiggles.

See what your AI missed before you commit.

curl -fsSL https://get.malveon.com/install.sh | sh

Windows: irm https://get.malveon.com/install.ps1 | iex. Also on npm, Homebrew, Scoop, and the VS Code and Cursor extension. Free during the beta. No account. Your code stays on your computer.