diff --git a/gopls/doc/settings.md b/gopls/doc/settings.md
index 9bf6e07..890a0a3 100644
--- a/gopls/doc/settings.md
+++ b/gopls/doc/settings.md
@@ -503,6 +503,11 @@
 Identifier: `regenerate_cgo`
 
 Regenerates cgo definitions.
+### **Run vulncheck (experimental)**
+
+Identifier: `run_vulncheck_exp`
+
+Run vulnerability check (`govulncheck`).
 ### **Run test(s) (legacy)**
 
 Identifier: `test`
diff --git a/gopls/internal/regtest/misc/testdata/vulndb/stdlib.json b/gopls/internal/regtest/misc/testdata/vulndb/stdlib.json
index 240ee49..7cbfafc 100644
--- a/gopls/internal/regtest/misc/testdata/vulndb/stdlib.json
+++ b/gopls/internal/regtest/misc/testdata/vulndb/stdlib.json
@@ -1 +1 @@
-[{"id":"STD","affected":[{"package":{"name":"archive/zip"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.18.0"}]}],"ecosystem_specific":{"symbols":["OpenReader"]}}]}]
+[{"id":"GO-0000-001","affected":[{"package":{"name":"archive/zip"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.18.0"}]}],"ecosystem_specific":{"symbols":["OpenReader"]}}]}]
diff --git a/gopls/internal/regtest/misc/vuln_test.go b/gopls/internal/regtest/misc/vuln_test.go
index 9de68b6..78c193e 100644
--- a/gopls/internal/regtest/misc/vuln_test.go
+++ b/gopls/internal/regtest/misc/vuln_test.go
@@ -61,7 +61,7 @@
 )
 
 func main() {
-        _, err := zip.OpenReader("file.zip")  // vulnerable.
+        _, err := zip.OpenReader("file.zip")  // vulnerability GO-0000-001
         fmt.Println(err)
 }
 `
@@ -79,22 +79,39 @@
 			"GOVERSION":                       "go1.18",
 			"_GOPLS_TEST_BINARY_RUN_AS_GOPLS": "true",
 		},
+		Settings{
+			"codelenses": map[string]bool{
+				"run_vulncheck_exp": true,
+			},
+		},
 	).Run(t, files, func(t *testing.T, env *Env) {
-		cmd, err := command.NewRunVulncheckExpCommand("Run Vulncheck Exp", command.VulncheckArgs{
-			URI:     protocol.URIFromPath(env.Sandbox.Workdir.AbsPath("go.mod")),
-			Pattern: "./...",
-		})
-		if err != nil {
-			t.Fatal(err)
-		}
+		env.OpenFile("go.mod")
 
+		// Test CodeLens is present.
+		lenses := env.CodeLens("go.mod")
+
+		const wantCommand = "gopls." + string(command.RunVulncheckExp)
+		var gotCodelens = false
+		var lens protocol.CodeLens
+		for _, l := range lenses {
+			if l.Command.Command == wantCommand {
+				gotCodelens = true
+				lens = l
+				break
+			}
+		}
+		if !gotCodelens {
+			t.Fatal("got no vulncheck codelens")
+		}
+		// Run Command included in the codelens.
 		env.ExecuteCommand(&protocol.ExecuteCommandParams{
-			Command:   command.RunVulncheckExp.ID(),
-			Arguments: cmd.Arguments,
+			Command:   lens.Command.Command,
+			Arguments: lens.Command.Arguments,
 		}, nil)
 		env.Await(
 			CompletedWork("Checking vulnerability", 1, true),
 			// TODO(hyangah): once the diagnostics are published, wait for diagnostics.
+			ShownMessage("Found GO-0000-001"),
 		)
 	})
 }
diff --git a/internal/lsp/command.go b/internal/lsp/command.go
index 7348c17..6df909b 100644
--- a/internal/lsp/command.go
+++ b/internal/lsp/command.go
@@ -823,8 +823,6 @@
 		}
 
 		cmd := exec.Command(os.Args[0], "vulncheck", "-config", args.Pattern)
-		// TODO(hyangah): if args.URI is not go.mod file, we need to
-		// adjust the directory accordingly.
 		cmd.Dir = filepath.Dir(args.URI.SpanURI().Filename())
 
 		var viewEnv []string
@@ -860,8 +858,32 @@
 			return fmt.Errorf("failed to parse govulncheck output: %v", err)
 		}
 
-		// TODO(hyangah): convert the results to diagnostics & code actions.
-		return nil
+		// TODO(jamalc,suzmue): convert the results to diagnostics & code actions.
+		// Or should we just write to a file (*.vulncheck.json) or text format
+		// and send "Show Document" request? If *.vulncheck.json is open,
+		// VSCode Go extension will open its custom editor.
+		set := make(map[string]bool)
+		for _, v := range vulns.Vuln {
+			if len(v.CallStackSummaries) > 0 {
+				set[v.ID] = true
+			}
+		}
+		if len(set) == 0 {
+			return c.s.client.ShowMessage(ctx, &protocol.ShowMessageParams{
+				Type:    protocol.Info,
+				Message: "No vulnerabilities found",
+			})
+		}
+
+		list := make([]string, 0, len(set))
+		for k := range set {
+			list = append(list, k)
+		}
+		sort.Strings(list)
+		return c.s.client.ShowMessage(ctx, &protocol.ShowMessageParams{
+			Type:    protocol.Warning,
+			Message: fmt.Sprintf("Found %v", strings.Join(list, ", ")),
+		})
 	})
 	return err
 }
diff --git a/internal/lsp/mod/code_lens.go b/internal/lsp/mod/code_lens.go
index b26bae7..1de25c2 100644
--- a/internal/lsp/mod/code_lens.go
+++ b/internal/lsp/mod/code_lens.go
@@ -22,6 +22,7 @@
 		command.UpgradeDependency: upgradeLenses,
 		command.Tidy:              tidyLens,
 		command.Vendor:            vendorLens,
+		command.RunVulncheckExp:   vulncheckLenses,
 	}
 }
 
@@ -151,3 +152,29 @@
 	}
 	return source.LineToRange(pm.Mapper, fh.URI(), start, end)
 }
+
+func vulncheckLenses(ctx context.Context, snapshot source.Snapshot, fh source.FileHandle) ([]protocol.CodeLens, error) {
+	pm, err := snapshot.ParseMod(ctx, fh)
+	if err != nil || pm.File == nil {
+		return nil, err
+	}
+	// Place the codelenses near the module statement.
+	// A module may not have the require block,
+	// but vulnerabilities can exist in standard libraries.
+	uri := protocol.URIFromSpanURI(fh.URI())
+	rng, err := moduleStmtRange(fh, pm)
+	if err != nil {
+		return nil, err
+	}
+
+	vulncheck, err := command.NewRunVulncheckExpCommand("Run govulncheck", command.VulncheckArgs{
+		URI:     uri,
+		Pattern: "./...",
+	})
+	if err != nil {
+		return nil, err
+	}
+	return []protocol.CodeLens{
+		{Range: rng, Command: vulncheck},
+	}, nil
+}
diff --git a/internal/lsp/source/api_json.go b/internal/lsp/source/api_json.go
index cf75792..0b3b3d1 100755
--- a/internal/lsp/source/api_json.go
+++ b/internal/lsp/source/api_json.go
@@ -583,6 +583,11 @@
 							Default: "true",
 						},
 						{
+							Name:    "\"run_vulncheck_exp\"",
+							Doc:     "Run vulnerability check (`govulncheck`).",
+							Default: "false",
+						},
+						{
 							Name:    "\"test\"",
 							Doc:     "Runs `go test` for a specific set of test or benchmark functions.",
 							Default: "false",
@@ -808,6 +813,11 @@
 			Doc:   "Regenerates cgo definitions.",
 		},
 		{
+			Lens:  "run_vulncheck_exp",
+			Title: "Run vulncheck (experimental)",
+			Doc:   "Run vulnerability check (`govulncheck`).",
+		},
+		{
 			Lens:  "test",
 			Title: "Run test(s) (legacy)",
 			Doc:   "Runs `go test` for a specific set of test or benchmark functions.",
diff --git a/internal/lsp/source/options.go b/internal/lsp/source/options.go
index 126752b..2f40b59 100644
--- a/internal/lsp/source/options.go
+++ b/internal/lsp/source/options.go
@@ -155,6 +155,7 @@
 						string(command.GCDetails):         false,
 						string(command.UpgradeDependency): true,
 						string(command.Vendor):            true,
+						// TODO(hyangah): enable command.RunVulncheckExp.
 					},
 				},
 			},