Neovim talks to the same fallow-lsp language server that powers the VS Code extension, through Neovim's built-in LSP client. The setup is intentionally thin: it launches the existing binary instead of re-implementing any analysis in the editor, so results match the CLI and CI exactly.
Requires Neovim 0.11+ for the vim.lsp.config / vim.lsp.enable API shown below. Older versions can still attach fallow-lsp through nvim-lspconfig or a manual vim.lsp.start.
security-sink or security-client-server-leak rule to warn or error in your fallow config. Candidates surface as advisory information squiggles (unverified, verify before acting); the hover leads with the confidence signals and points to fallow security --file for the full trace, and a quick-fix dismisses the candidate. Default off, so squiggles appear only after you raise the rule.npm install -g fallowOr add it as a project devDependency (npm install -D fallow) and point cmd at node_modules/.bin/fallow-lsp.
fallow-lsp --versionAdd the configuration below to your Neovim config, then open a TypeScript or JavaScript project.
vim.lsp.config("fallow", {
cmd = { "fallow-lsp" },
filetypes = { "javascript", "typescript", "javascriptreact", "typescriptreact" },
root_markers = { ".fallowrc.json", "package.json", ".git" },
init_options = {
-- Every issue type is enabled by default. List only the ones you
-- want to turn off; any key you omit stays enabled.
issueTypes = {
["circular-dependencies"] = false,
},
},
})
vim.lsp.enable("fallow")
init_options is optional; cmd, filetypes, and root_markers alone are enough to attach.
Fallow reads per-issue toggles from LSP initialization options. Set an issue type to false to hide it in editor diagnostics without touching your project config. The keys are Fallow's issue types in kebab-case (unused-exports, unresolved-imports, circular-dependencies, and so on); a client can fetch the live catalog through the custom fallow/issueTypes request to stay in sync.
Pass a git ref as changedSince to scope diagnostics to files changed since that ref, mirroring fallow dead-code --changed-since. This is the Neovim equivalent of the VS Code fallow.changedSince setting, useful for adopting fallow on a legacy codebase without surfacing every pre-existing finding:
init_options = {
changedSince = "fallow-baseline",
},
When diagnostics appear. Fallow delivers diagnostics through the LSP 3.17 pull model and refreshes them on save. The first analysis runs when the server attaches, so a freshly opened buffer shows findings once the initial pass completes (or after the next save), not necessarily the instant the file opens. Cross-file findings anchored to files you have not opened (for example package.json for unlisted dependencies) are pushed so they still surface.
Neovim runs cmd exactly as configured. If fallow-lsp is not on Neovim's PATH, point cmd at an absolute path:
vim.lsp.config("fallow", {
cmd = { "/absolute/path/to/fallow-lsp" },
filetypes = { "javascript", "typescript", "javascriptreact", "typescriptreact" },
root_markers = { ".fallowrc.json", "package.json", ".git" },
})
Open a TypeScript or JavaScript project.
Run :checkhealth vim.lsp.
Confirm fallow is attached:
:lua vim.print(vim.lsp.get_clients({ name = "fallow" }))