VSCode MCP — security audit

Risk flags

• Can modify files

  Restrict the working directory to a sandboxed path. Avoid pointing it at your home directory or repo with secrets.

• Community-authored

  Maintained by Community. Confirm the repo and signing before installing.

• No public repository linked

  Without a public repo we cannot independently audit the code. Caution warranted.

Capability surface

• Filesystem write

  High risk

  Can create, modify, or delete files on disk. High-impact if scope is broad.

  Evidence: editor

Trust signals

Total trust score is the sum of these contributions. Each signal carries a fixed weight.

• Verified by Loadout

  +20 / 20

  Manually verified.

• Official author

  +0 / 15

  Maintained by community contributors.

• Community traction

  +17 / 20

  2,600 GitHub stars.

• Public source

  +0 / 15

  No linked public repository.

• Stability

  +0 / 15

  Stability not yet assessed.

• Capability surface

  +10 / 15

  1 high-risk capability detected.