VS Code AI app security checklist for MCP builds

VS Code with GitHub Copilot Chat and MCP can edit across your workspace and call external tools quickly, so you must harden .vscode/mcp.json with servers and inputs, scope Copilot permissions and capture SARIF before release. This checklist covers secure inputs for tokens, least privilege agent settings and repeatable release evidence. Pair it with LyraShield as release assurance for AI built apps. Baseline controls are in our vibe coding security guide plus VS Code specific steps below.

How VS Code AI expands risk

Copilot Chat agent mode can read, edit and run commands across your workspace while MCP servers expose additional tools. A single prompt can search files, add dependencies and call an external API. Without guardrails, broad edits can miss auth checks, leave secrets in workspace settings and add vulnerable packages.

Common review misses include debug endpoints that bypass auth, error handlers that log secrets and package additions with install scripts that run code. Explicit policy and verifiable evidence reduce that risk.

Frame findings with standard references. OWASP Top Ten at OWASP Top Ten covers injection and misconfiguration seen in AI generated back ends. Hardcoded credential weakness maps to CWE 798 for hard coded credentials and traversal to CWE 22 for path traversal. MCP transport and auth are defined at MCP spec and MCP authorization. VS Code specifics are documented in the official MCP servers guide and variable handling at VS Code inputs. For consistent language across builders, see our Lovable app security checklist.

Harden MCP in .vscode/mcp.json with inputs

VS Code uses .vscode/mcp.json with top level servers key for workspace servers. Secrets should be referenced via inputs array with password true, not hardcoded in env.

Follow the current vscode integration guide and manually merge the server entry, preserving existing settings. Authenticate local stdio separately with npx -y lyrashield@0.2.14 login --oauth and use @lyrashield/mcp@0.2.12. Use pinned CLI commands for documented config or skill installs; marketplace plugins remain separately gated. Restart the client, confirm discovery, then call lyrashield_list_workspaces for authenticated read-only access. CLI doctor does not establish client authentication or scan completion.

Secure example with no raw secrets committed:

{
  "servers": {
    "lyrashield-local": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@lyrashield/mcp@0.2.12"],
      "env": {
        "LYRASHIELD_API_KEY": "${input:lyrashieldKey}"
      }
    },
    "lyrashield-remote": {
      "type": "http",
      "url": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:lyrashieldKey}"
      }
    }
  },
  "inputs": [
    {
      "id": "lyrashieldKey",
      "type": "promptString",
      "description": "LyraShield API key from env",
      "password": true
    }
  ]
}

Hardening for review:

• Use inputs with password true for tokens and fill from env or secret manager at runtime. Never commit raw keys in workspace file or user settings.
• Keep workspace file minimal. Global servers with personal paths belong in user settings, not in git.
• For remote MCP use https and Bearer from input. Validate that interpolation does not echo into logs. See auth expectations at MCP auth.
• Validate in CI that mcp dot json files contain no raw sk or lsk literals and that input ids match expected env. Run secret scanning on every pull request.
• Require pull request review for any server addition. Treat new MCP servers like new production dependencies with owner and review date.

Discovery of servers from mcp dot json is covered in the VS Code MCP servers guide.

Scope agent and Copilot Chat permissions

Copilot Chat agent mode can read and edit files and run terminal commands when approved. Define scope explicitly.

Configure chat to require approval for terminal commands, package installs and edits outside src, tests and docs. Deny edits to .env, secrets and production configs and infra manifests unless security owner approves. Document allowed commands in your guide, for example npm run lint, npm run test and npm run build are allowed, while curl with secrets, git push to main from agent context and unscoped docker commands are denied.

Use .github/copilot-instructions.md to state auth and validation expectations:

All routes handling user data or file access must include auth middleware and input validation with zod or similar and include tests for failure paths.

No direct shell exec with untrusted input. If exec is needed for image handling, list allowed binaries and sanitize args with allow list.

Dependency addition needs lockfile review and audit before merge, not auto acceptance.

Auth, payment or file upload change needs tests and reviewer and must be flagged in pull request description.

Version prompt files as code and review them like source. Docs on prompt files at GitHub prompt files and custom instructions at Copilot instructions describe file locations and precedence. Capture chat summary and list of edited files in pull request for context.

Gate dependencies and secrets with SARIF

AI assisted stacks accumulate packages quickly. Gate that with supply chain checks.

Use OSV at OSV database and npm audit to block high severity issues on every pull request. Review lockfile diffs for packages with sudden maintainer change or low weekly downloads and flag for manual review. Document exceptions with owner and expiry so they do not become permanent.

For secrets, run scanning that outputs SARIF and upload to GitHub code scanning. See GitHub secret scanning and SARIF support at GitHub SARIF support. Validate that .vscode/mcp.json inputs resolve without emitting secrets to logs. Check .env.example for placeholders only and keep production secrets in your manager.

Enforce local pre commit hooks and CI scans. Local feedback is early, CI is the gate. Require second reviewer for env handling or MCP secret input changes.

Build repeatable release evidence

Make evidence routine so every release has same artifacts.

Per release steps:

1. Run lint, type check, secret scan and dependency audit locally and in CI.
2. Convert outputs to SARIF where supported.
3. Upload SARIF to GitHub code scanning.
4. Write docs slash security evidence entry with date, commit hash, active MCP servers, tools run and reviewers.
5. Attach logs and SARIF to release tag.

SARIF upload pattern is at SARIF artifact upload and overview at GitHub code scanning. Web header review guidance at Next.js security and MDN security helps frame app checks while your reported scan findings stay in SARIF.

Keep a short changelog for MCP additions and dependency exceptions to speed future reviews and show when temporary risks closed.

Check	VS Code location	Good signal
MCP servers	.vscode/mcp.json servers plus inputs with password true	No raw keys in git, inputs used, https only, reviewed in pull request
Agent scope	Copilot custom instructions and approval settings	Edits limited to src and tests, shell needs confirm, protected paths enforced
Dependencies	CI with OSV and audit	High severity blocks merge, lockfile diff reviewed, exceptions tracked
Secrets	Secret scan SARIF upload	No tokens in repo or logs, env via manager, example files placeholder only
Evidence	GitHub code scanning plus evidence file	SARIF on PR and main, MCP list per release, tag linked

Why pair VS Code AI with LyraShield

LyraShield AI at https://lyrashieldai.com is release assurance for AI built apps. The loop is target, review, evidence, fix, retest, report: detection stays separate from proof, recorded scans contribute to an assurance record and fix proposals are approval gated so PR execution is blocked until a server generated patch is bound to the exact approval.

MCP fits VS Code design. Local stdio via npx -y @lyrashield/mcp@0.2.12 with inputs avoids raw keys, remote https://app.lyrashieldai.com/api/mcp accepts Bearer lsk key via inputs. GitHub Action diff aware scan and SARIF output target pull request review.

Build transparency: LyraShield is live in open beta with open registration. The scan pipeline, findings and evidence, approval-gated fix proposals, retests, reports, billing and Local/Desktop flows are implemented. VS Code uses the supported config-file integration and the runner-local Action provides an advisory SARIF gate. Production availability remains bounded by release gates; automatic server-generated Fix PR execution is not enabled; self-serve checkout is live.

Final gates before release

Confirm before shipping:

• .vscode/mcp.json uses servers and inputs with no raw secrets in repo.
• Copilot instructions require auth and validation for sensitive routes.
• Agent approval is on for terminal and package installs with protected paths.
• Dependency and secret scans passed and SARIF uploaded on pull request and main.
• Docs slash security evidence updated per tag.

Reuse the loop with our AI app security checklist tool and create an account at https://lyrashieldai.com to start building assurance records today. For alignment across builders see V0 app security checklist and Base44 app security checklist.