IDE plugin performs quick, local scans of direct dependencies only, while the Highlight portal/CLI does the full, authoritative analysis including transitive dependencies and artifacts.
The IDE plugin is for fast developer feedback, not full accuracy. For full local results, developers should run the CAST Highlight CLI and upload results to the portal.
Details
The IDE plugins are lightweight, developer-focused tools for quick checks.
Full and accurate results are available only when using the CAST Highlight portal.
Both serve different purposes and operate at different levels of depth.
IDE Plugin (IntelliJ / VSCode)
The IDE plugin provides a fast, local analysis for developers:
- Scans only explicit dependencies declared in files like pom.xml, build.gradle, package.json.
- Does not resolve transitive dependencies.
- Does not analyze built artifacts (JAR, WAR, Docker images).
- Works without requiring full build or network access.
- It is designed for quick feedback during development, not for exhaustive analysis.
CAST Highlight CLI / Portal
The CLI (used by the portal) performs a complete analysis:
- Resolves the full dependency graph, including transitive dependencies.
- Can analyze final artifacts (JAR/WAR, etc.).
- Supports larger scopes (multi-modules, full repositories).
- Provides the reference results for governance and reporting
The IDE plugin and the CLI are complementary, not equivalent:
IDE plugin = fast, partial, developer-focused
Highlight CLI or Code Reader (based on CLI but with UI) = complete, authoritative analysis
If developers need full results locally without using the portal, the correct approach is to run the CAST Highlight CLI locally. Plugins are not live CVE tool.
Additional Resources
CAST Highlight Troubleshooting Guides
CAST Highlight Product Documentation
Ticket
56891
Comments