.vscode — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .vscode (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Swap your Claude Code setup like equipment.
A VSCode extension that lets you switch agent, skill, and command configurations as if they were loadouts in a game. Save profiles, swap between them with one click, sync items across projects through a global catalog, and configure Claude Code behavior — all from a single panel.
ufuzzy; narrow results with inline tokens (type:agent, active:true, tok>500)settings.json surface: permissions (allow/deny/ask), session env vars, hooks, sandbox toggle, and MCP servers.md files show active / stored / update-available status at a glanceApply — <profile-name>)~/.claude/ (or a custom path)| Tab | Purpose |
|---|---|
| Workspace | Toggle agents, skills, and commands on/off. Items in .claude/agents/, .claude/skills/, and .claude/commands/ are active; toggling moves them to a managed store path inside context.storageUri. |
| Profiles | Snapshot the current active set as a named loadout. Apply any profile with one click. Profile cards show a ... overflow menu with Edit, Rename, Duplicate, Export, and Delete. Hover a card to reveal created-date and apply-count. |
| Catalog | Bridge between projects. Items in ~/.claude/ (or loadout.globalCatalogPath) are visible across all workspaces. Adopt to a project, promote local items to the catalog, or pull updates when the catalog version changes. |
| Config | Claude Code configuration surface: permissions allow/deny/ask rules, session environment variables, hooks toggle, sandbox toggle, and MCP servers list (with per-server enable/disable). |
| Settings | Density (Compact/Comfortable), theme (Dark/Light/Auto), default tab, registry URL, keyboard shortcuts reference, and About. |
This repo is not yet on the VSCode Marketplace. To install locally:
git clone <repo-url> loadout
cd loadout
# Pre-built webview is committed — no build step needed for basic use
ln -s "$(pwd)" "$HOME/.vscode/extensions/loadout"Reload VSCode. The Loadout activity bar icon appears in the sidebar.
Loadout: Open PanelCmd+Shift+Alt+C (mac) / Ctrl+Shift+Alt+C (win/linux)| Keys | Action |
|---|---|
1 2 3 4 | Switch tabs (Workspace · Profiles · Catalog · Config) |
/ | Focus search |
Cmd+K / Ctrl+K | Open command palette |
a | Toggle "Active only" filter in Workspace |
s | Save current state as new profile |
Esc | Close palette / dismiss bottom sheet / cancel inline edits |
Type any token directly in the search box to narrow results:
| Token | Example | Meaning |
|---|---|---|
type: | type:agent | Filter by item type (agent, skill, command) |
active: | active:true | Show only active or only inactive items |
tok> / tok< | tok>500 | Filter by token count threshold |
Tokens combine with free-text fuzzy search. Matched characters are highlighted without using innerHTML.
loadout/
├── extension.js # VSCode entry: webview hosting + message routing
├── data.js # Filesystem layer: agents, skills, commands, profiles, catalog, hashes
├── update-claude.mjs # Registry sync orchestrator (npx claude-code-templates)
├── deploy.js # Local install helper
├── package.json # Extension manifest
├── icon-activity.svg # Activity bar icon
├── webview/ # Angular 21 standalone app (the entire UI)
│ ├── angular.json
│ ├── package.json
│ └── src/app/
│ ├── core/ # bridge, theme, shortcuts, search, toast, state services (signals)
│ ├── layout/ # ShellComponent (header + tabs + status strip)
│ ├── features/ # workspace, profiles, catalog, config, settings
│ └── shared/ # primitives (cm-card, cm-toggle, cm-token-bar, etc.) + overlays
└── webview-dist/ # Compiled Angular bundle (committed for zero-build install)Extension.js posts an initialData message when the webview fires ready. The Angular app subscribes via VsCodeBridgeService and routes data into four signal-based state services (workspace.state.ts, profiles.state.ts, catalog.state.ts, settings.state.ts). User actions send typed messages back; extension.js executes filesystem mutations and replies with dataUpdate. The full message contract lives in webview/src/app/core/messages.ts.
signal(), computed(), input(), output()) — no Subjects for local stateOnPush and inject state services or a feature BLoC; they never inject VsCodeBridgeService directlySelectionModel from @angular/cdk/collections manages multi-select; checkbox affordance appears on hoverContextMenuService + ContextMenuComponent (CDK Overlay) power right-click menus on every rowUiStateService persists arbitrary UI flags to ui-state.json in context.storageUriToastService.showWithAction() drives undo toasts with a countdown timerThemeService resolves the active theme from the user's setting (Dark/Light/Auto). When set to Auto it follows vscode.window.activeColorTheme.kind via onDidChangeActiveColorTheme. Switching is smooth (300 ms CSS transition).
Per-workspace state lives in context.storageUri (managed by VSCode, never committed). A one-time migration on first activation moves any legacy .claude-store/ content from before v2 into the managed location. The global catalog defaults to ~/.claude/ and is overridable via the loadout.globalCatalogPath setting.
cd webview
npm install
npm run build # Production build → ../webview-dist/
npm run watch # Rebuild on file change (development mode)
npm run lint # Format check (Prettier)
npm test # Run vitest unit testsAfter npm run watch, reload the VSCode window to pick up changes, or run the Loadout: Refresh command (Cmd+Shift+P → Loadout: Refresh).
webview/src/app/features/<name>/<name>.bloc.ts — handles all bridge.send() calls and inbound message subscriptions for the feature.webview/src/app/features/<name>/<name>.component.ts — injects state service(s) and the BLoC; never injects VsCodeBridgeService directly.core/state/ if the feature owns persisted domain data.webview/src/app/core/messages.ts (single source of truth for the message protocol).extension.js handleMessage().ShellComponent and add a @case in the tab switch; add a keyboard shortcut number to the tab list.MIT © 2026 Joaquin Ondarza Ortega
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.