Implant

Give coding agents (Copilot Chat, Claude Code, Cursor, anything that speaks MCP —
or anything that can shell out) live access to everything that lives inside VS Code
and third-party extensions.

Explore the code with the tools the editor already has: Find References,
Go-to-Definition, hover types, workspace diagnostics, git blame, symbol outlines,
and any command a third-party extension registers.

Modify the code through the same language server that powers the editor:
structural rename, quick-fixes and refactors, organize imports, safe file
create/rename/delete via WorkspaceEdit, formatter output, source actions. Edits
go through the language server — safer than sed/awk on files because they
respect scope, imports, and semantics.

Implant exposes a single MCP tool, run_vscode_script, that executes a JavaScript
snippet inside the running VS Code extension host with full access to the
vscode.* API. Nothing runs without the user approving the exact snippet.

Quick start

  • Install the extension.
  • Open your project. Implant will offer to install itself into the workspace —
    this drops portable rule files that teach agents when to reach for Implant.
  • Your agent picks up the tool automatically — MCP-native clients (Copilot Chat
    and others on VS Code ≥ 1.101) discover it via the registry, and CLI agents
    pick it up from the workspace instructions installed in step 2.
  • When an agent invokes the tool, a webview opens beside the editor showing the
    script with syntax highlighting. Click Run,Run + trust session, orDeny.

Palette commands

| Command | Purpose |
| Implant: Install into Workspace | Writes five portable, safe-to-commit files: .vscode/implant/call.js(stdio↔HTTP MCP proxy),.mcp.json(Claude Code / generic MCP config),.cursor/mcp.json(Cursor MCP config),.claude/skills/implant/SKILL.md(Claude Code skill),.cursor/rules/implant.mdc(Cursor rules). Also upserts an<!-- BEGIN Implant --> … <!-- END Implant -->section into.github/copilot-instructions.md. Prompts before overwriting; asks which folder in multi-root workspaces. |
| Implant: Copy Agent Instructions | Copies the same instructions to the clipboard — paste into AGENTS.md, an agent's system prompt, or wherever your setup expects. |

Settings

| key | default | meaning |
| implant.requireConfirmation | true | Show the approval webview before each script runs. |
| implant.timeoutMs | 0 | Hard execution timeout in ms. 0disables it — long-running async scripts are cancelled by the user via a notification that appears after 10 seconds. Set to a positive value to enforce an automatic upper bound. |
| implant.port | 0 | Port for the HTTP MCP server. 0picks an ephemeral one; the actual port is written to.vscode/implant/session.yml. |

The approval webview has a Run + trust session button that skips future
prompts until the window is reloaded.

Safety notes

  • Snippets run in the VS Code extension host with the same privileges as the
    extension itself. There is no sandbox — that is the entire point.
  • The approval webview exists so you can eyeball each snippet before it runs.
    Turn confirmation off only when the agent is already in a tight review loop.
  • The HTTP server only binds to 127.0.0.1and requires a per-session bearer
    token — the token lives in.vscode/implant/session.yml(mode0600, gitignored,
    regenerated on every activation). Requests without a valid token get401and
    raise a warning notification so you notice anything poking at the port.
  • Even with the token gate, don't run this on a shared machine: any process
    running as your user can read the session file.
  • The confirmation prompt is the last line of defense. Only turn
    implant.requireConfirmationoff when the agent is already in a tight review
    loop that you trust.