Dependency Vulnerability Companion

Real evidence, not assumptions:

• Aikido Security (JetBrains Marketplace id 24993, 30,010 downloads, vendor Aikido Security) bundles SAST, secrets, and dependency scanning in one plugin -- but per Aikido's own official docs, "After installation, users are asked to add their personal access token through Aikido's JetBrains IDE Integration Screen" before it works at all. Xygeni and JFrog's Marketplace plugins follow the same pattern: real functionality, gated behind a cloud account.
• Snyk has a cloud-only architecture -- confirmed across multiple 2026 SAST-tooling comparisons -- which makes it a non-starter for any environment that can't send code to a third-party cloud.
• Semgrep changed its open-source terms in December 2024: its maintained rules moved to a new, more restrictive license and the OSS edition was renamed "Community Edition" (the engine itself stays LGPL 2.1, per Semgrep's own announcement), with some engine features kept for the commercial tier. A consortium of competing AppSec vendors (Aikido, Endor Labs, Orca Security and others) answered by forking the engine as Opengrep, with first releases in January 2025 -- the market itself confirms this is a real, felt gap, not a niche preference.
• Google's own OSV-Scanner proves an offline, account-free vulnerability database is technically real and current (its own docs state "will not download or update the local database, nor send any project or dependency information anywhere" in offline mode) -- but it's a CLI tool with no native IDE integration; nothing brings that same offline-database idea into an IntelliJ editor as inline warnings.
• CMMC 2.0 (the US defense-contractor cybersecurity certification) requires any cloud tool touching Controlled Unclassified Information to meet FedRAMP Moderate -- a bar essentially no commercial SCA/SAST cloud tool clears -- so an entire real, growing buyer segment structurally cannot use any of the plugins above no matter how good their detection is.