Is .vscode safe to install?

SaferSkills independently audited .vscode (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md1.4 KB · Markdown

svelte-llm

LLM presets and MCP for Svelte 5 and SvelteKit. Visit the site at svelte-llm.stanislav.garden.

MCP Endpoint

This service provides an MCP (Model Context Protocol) endpoint for use with AI assistants:

Streamable HTTP (Claude Desktop and most other clients): https://svelte-llm.stanislav.garden/mcp/mcp
SSE (Older clients that don't support Streamable): https://svelte-llm.stanislav.garden/mcp/sse

Setup

Create a .env file with the content:

  GITHUB_TOKEN=
  DB_URL=postgres://admin:admin@localhost:5432/db

Create a Classic GitHub token. It must have public_repo permissions.
Enter this in the .env file.
Run docker-compose up
Run:

nvm use
npm i
npm run dev

Run database migrations: visit http://localhost:5173/api/migrate in your browser after starting the dev server.

You can also visit http://localhost:5173/admin to see all the "hidden" endpoints (default password = "secret")

Debug MCP

NODE_TLS_REJECT_UNAUTHORIZED=0 NODE_OPTIONS="--insecure-http-parser" npx @modelcontextprotocol/inspector

http://127.0.0.1:6274

You can also use GitHub Copilot in Agent mode to try the agent locally, see .vscode/mcp.json for info on how that works.

Misc

OG image from https://dynamic-og-image-generator.vercel.app/

.vscode— mcp server

Is .vscode safe to install?

svelte-llm

MCP Endpoint

Setup

Debug MCP

Misc

Audit the pieces. Scan the whole. Decide.