Implant
Give coding agents (Copilot Chat, Claude Code, Cursor, anything that speaks MCP —
or anything that can shell out) live access to everything that lives inside VS Code
and third-party extensions.
Explore the code with the tools the editor already has: Find References,
Go-to-Definition, hover types, workspace diagnostics, git blame, symbol outlines,
and any command a third-party extension registers.
Modify the code through the same language server that powers the editor:
structural rename, quick-fixes and refactors, organize imports, safe file
create/rename/delete via
WorkspaceEdit, formatter output, source actions. Edits
go through the language server — safer than
sed/
awk on files because they
respect scope, imports, and semantics.
Implant exposes a single MCP tool,
run_vscode_script, that executes a JavaScript
snippet inside the running VS Code extension host with full access to the
vscode.* API. Nothing runs without the user approving the exact snippet.
Quick start
- Install the extension.
- Open your project. Implant will offer to install itself into the workspace —
this drops portable rule files that teach agents when to reach for Implant.
- Your agent picks up the tool automatically — MCP-native clients (Copilot Chat
and others on VS Code ≥ 1.101) discover it via the registry, and CLI agents
pick it up from the workspace instructions installed in step 2.
- When an agent invokes the tool, a webview opens beside the editor showing the
script with syntax highlighting. Click Run, Run + trust session, or
Deny.
Palette commands
Settings
The approval webview has a Run + trust session button that skips future
prompts until the window is reloaded.
Safety notes
- Snippets run in the VS Code extension host with the same privileges as the
extension itself. There is no sandbox — that is the entire point.
- The approval webview exists so you can eyeball each snippet before it runs.
Turn confirmation off only when the agent is already in a tight review loop.
- The HTTP server only binds to
127.0.0.1 and requires a per-session bearer
token — the token lives in
.vscode/implant/session.yml (mode
0600, gitignored,
regenerated on every activation). Requests without a valid token get
401 and
raise a warning notification so you notice anything poking at the port.
- Even with the token gate, don't run this on a shared machine: any process
running as your user can read the session file.
- The confirmation prompt is the last line of defense. Only turn
implant.requireConfirmation off when the agent is already in a tight review
loop that you trust.