VS Code

Why scan VS Code?

VS Code brokers MCP servers alongside its extension host, so an MCP entry sits next to extensions that already hold workspace trust — and the two are granted separately but run together.

Usage

CallLint can auto-discover and scan VS Code configurations:

calllint scan --agent vscode

How to start

Install nothing globally — run CallLint straight from npm:

npx calllint scan --auto

Then scan VS Code specifically:

calllint scan --agent vscode

How to verify it worked

Compare the servers CallLint found against the ones you expect. `.vscode/mcp.json` is workspace-scoped, so an unexpected entry arrived with the repository, not with your setup.

What CallLint does to VS Code

Offline by default. Deterministic. Never executes the server it judges. SAFE means no blockers observed, not a proof of runtime safety.

A No blockers observed verdict means exactly that — no blocker under the evidence CallLint could collect. It is not a guarantee, and Insufficient evidence never becomes it on its own. See Coverage Boundary for what this scan does not look at.

Configuration Paths

CallLint looks for VS Code configurations in:

• ~/.vscode/mcp.json
• <project>/.vscode/mcp.json

Authority Surfaces

VS Code can grant tools the following authority surfaces:

• extensions
• mcp

Distribution

CallLint is available for VS Code through:

• mcp-stdio (via officialMcpRegistry) — Listing not yet verified

Support Status

Auto-detects — CallLint finds this host’s config on its own.

The commands under Usage are the ones CallLint actually supports for VS Code today. Anything not listed there is not claimed.

Official Sources

• https://code.visualstudio.com/