lockzero-lsp

lockzero-lsp

LockZero language server. One server, every editor that speaks LSP gets red squiggles + quick fixes for hardcoded secrets.

Editor	Status
Neovim	via nvim-lspconfig
Vim 8/9	via coc.nvim or vim-lsp
Emacs	via lsp-mode or eglot
Helix	native LSP support
Lapce	native LSP support
Zed	native LSP support
Sublime Text	via LSP package

For VS Code / Cursor / Windsurf, install the dedicated LockZero VS Code extension instead — it's richer (vault integration, hover blast radius, auto-config proxy).

Install

npm install -g lockzero-lsp

Now lockzero-lsp is on your path.

Configure

Neovim (nvim-lspconfig)

local configs = require("lspconfig.configs")
local lspconfig = require("lspconfig")

if not configs.lockzero then
  configs.lockzero = {
    default_config = {
      cmd = { "lockzero-lsp", "--stdio" },
      filetypes = {
        "python", "javascript", "typescript", "javascriptreact", "typescriptreact",
        "go", "rust", "ruby", "php", "java", "kotlin", "swift",
        "yaml", "json", "toml", "sh", "bash", "markdown",
      },
      root_dir = lspconfig.util.find_git_ancestor,
      single_file_support = true,
    },
  }
end
lspconfig.lockzero.setup({})

Helix (~/.config/helix/languages.toml)

[[language]]
name = "python"
language-servers = ["pyright", "lockzero"]

[language-server.lockzero]
command = "lockzero-lsp"
args = ["--stdio"]

(Add lockzero to every language's language-servers list.)

Zed (settings.json)

{
  "languages": {
    "Python": {
      "language_servers": ["pyright", "lockzero"]
    }
  },
  "lsp": {
    "lockzero": {
      "binary": { "path": "lockzero-lsp", "arguments": ["--stdio"] }
    }
  }
}

Emacs (eglot)

(with-eval-after-load 'eglot
  (add-to-list 'eglot-server-programs
               '((python-mode typescript-mode javascript-mode go-mode rust-mode)
                 . ("lockzero-lsp" "--stdio"))))

What it does

• Detects OpenAI / Anthropic / Stripe / GitHub / AWS keys hardcoded in your code
• Surfaces each as an LSP Diagnostic (red squiggle in your editor)
• Offers a code action: replace with process.env.<NAME> (or the language-appropriate equivalent — os.environ["X"] for Python, ENV["X"] for Ruby, etc.)
• Stateless: no API calls, no auth, no telemetry

For the full LockZero experience (vault integration, blast radius, auto-config proxy), use the VS Code extension.

License

MIT