· 6 min read
Developers fix what is in front of them. The DarkMoon JetBrains plugin puts autonomous pentest results inside the IDE, a native IntelliJ-platform tool window, so a finding is one click from the code that causes it. It is on the JetBrains Marketplace as plugin 34497.
The tool window
- Campaigns: target, status, overall risk and finding count.
- Vulnerabilities: a sortable, filterable, searchable table (severity, title and type, target and component, status, campaign) with a detail pane showing description, evidence and remediation.
- Reports: redaction-safe by default, with the full rehydrated report available only through an explicit, confirmed local action.
Plus Refresh and Launch campaign actions, so the whole loop lives in the editor.
It wraps the client, it does not reimplement it
The plugin ships a Kotlin contract port and a subprocess adapter that shells out to the darkmoon-ci binary, or to a bundled darkmoon-bridge.mjs that exposes the full read surface of the official client (list all campaigns, a single finding with evidence, streaming) which the CI binary alone does not carry. The bridge strips the internal raw object before printing. One engine, one contract, many front-ends.
Secrets and capability degradation
What it intentionally does not do
The infrastructure graph and any automatic pull request are deliberately out of scope for the IDE plugin. Remediation is a forwarded opt-in only, and the plugin never opens a PR on its own. The IDE is for reading findings and driving campaigns, not for taking write actions on your repositories.
Built with Gradle and Kotlin on the IntelliJ Platform (JDK 17). See the integrations catalog for the CI and SecOps integrations that surround it.
See the proof, not just the write-up: the Pro remediation benchmark (fixes retested against the exploit) · how Darkmoon compares to other AI pentest tools.
← All articles