VSCSAFE
This project provides tools that expose Language Server Protocol (LSP) functionality as MCP (Model Context Protocol) tools
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This project provides tools that expose Language Server Protocol (LSP) functionality as MCP (Model Context Protocol) tools. It enables AI clients to programmatically analyze and edit code through standardized MCP tool calls.
It started as a simple project focused on coding only with TypeScript, then evolved to a full-featured MCP server that supports any language supported by VS Code.
Full details about latest changes and migration to headless VC Code can be found here
Docker Mode & VS Code LSP Integration
VSC-MCP can run in two modes:
- Standalone Mode: It spawn a local typescript-language-server to provide LSP support ONLY for TypeScript/JavaScript.
- Docker Mode: Leverages a headless VS Code port by Gitpod, namely OpenVSCode Server, running in Docker to provide richer LSP support, for any languages supported by VC Code like Rust, Go, C#, Python, etc.
Why Docker Mode?
- Unified LSP: Avoids the hassle of launching separate local language servers for each language.
- Rich Extension Ecosystem: Inherits VS Code's extension support and APIs for advanced language features.
- Live Editing: Open http://localhost:3000 to watch edits in real time as your AI agent interacts with MCP.
- Works without IDE: we can write and analyze code without opening any IDE.
How It Works
- OpenVSCode Server runs inside Docker, exposing port
3000(IDE UI) and5007(LSP bridge). - Required VS Code extensions are pre-installed (e.g., rust-analyzer, pyright, eslint, and the VSC-MCP extension).
- The VSC-MCP extension creates a WebSocket channel between MCP and the VS Code back-end.
- File I/O tools use direct access; LSP tools use VS Code's internal language servers.
Installation
Prerequisi
614bd3f5c019OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add vsc-mcp -- npx -y [email protected]
{
"mcpServers": {
"vsc-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (7)
5 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
edit_symbol | write | Edits a symbol (function, class, etc.) by name and type in a given file using LSP. |
find_references | read | Finds all references to a symbol (function, class, etc.) by name and type in a given file using LSP. |
get_errors | read | Fetches code errors and issues for a specific file using the LSP textDocument/diagnostic API. |
read_file | read | Reads the content of a file. |
read_symbol | read | Reads a symbol (function, class, etc.) by name and type in a given file using LSP. |
search_replace_file | read | Searches for content in a file and replaces it with new content, ignoring whitespace differences. |
write_file | write | Creates a new file or overwrites an existing file with the provided content. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
vsc-mcp-extension-0.1.0.vsix
.vscodeignore
vsce
vscode-languageserver-textdocument, @types/node, typescript
Gates applied: no_behavioural_pass.
614bd3f5c019full audit observations/trust-audit/mcp-server/thomasgazzoni__vsc.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 614bd3f5c019 | SAFE | B | 89 | first audit |
Questions
What is the VSC MCP server?
This project provides tools that expose Language Server Protocol (LSP) functionality as MCP (Model Context Protocol) tools
What tools does VSC expose?
7 in total: 5 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is VSC safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does VSC need?
No credential environment variables were found in its source, so it appears to need none.
How does VSC run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as vsc-mcp at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (614bd3f5c019), read on 2026-10-08. The repository is watched and re-audited when it changes.