Both run code on a developer machine with the user's privileges, so both need the same supply chain review. The difference is who triggers the action. An IDE extension runs its own logic. A local MCP server's tools can be invoked by an AI model acting on text it has read, which adds prompt injection to the risk list.
Definition
An IDE extension is a package loaded into the editor's extension host. VS Code's documentation says the host has the same permissions as the editor, so an extension can read and write files, make network requests and run processes.
An MCP server exposes tools, resources and prompts to an AI client over the Model Context Protocol. A local MCP server is, in the protocol's own security guidance, a binary downloaded and executed on the same machine as the client, with potentially direct access to the user's system.
Side by side
| Question | IDE extension | Local MCP server |
|---|---|---|
| Runs with which privileges? | The editor's, via the extension host | The client's, as a local process |
| How does it get installed? | Marketplace, VSIX or policy | Config entry, often a command like npx or a binary |
| Who decides when it acts? | Its own code and editor events | The model, choosing tools from a list |
| Install-time gate | Publisher trust dialog in recent VS Code | Client consent for one-click setup, if implemented |
| What can steer it? | User actions and its own logic | Anything the model reads, including files and web pages |
| Enterprise control | Allowed extensions policy | Client settings and your own review |
The protocol's guidance describes the install risk in concrete terms: an attacker can place a malicious startup command in a client configuration, ship a malicious payload inside the server, or reach an insecure server left running on localhost. The listed risks include arbitrary code execution with client privileges, no visibility into what commands run, and data loss.
What is the same
The supply chain questions do not change. Who publishes it? Where does the code come from? What does it depend on? Does an update change behavior? A malicious or compromised package is equally bad as an extension or as an MCP server.
What is different
The trigger. An extension that reads a file does so because its code says to. An MCP tool can be called because a model read a sentence in a README, an issue or a web page. VS Code's Workspace Trust documentation makes the same point for agents: any file can be pulled into context and could theoretically result in a prompt injection, so unreviewed projects belong in Restricted Mode, which disables agents.
So for an MCP server you also ask: which tools does it expose, which of them write or send data, does the client ask before calling them, and what is in scope when the model chooses?
Controls that map across
- Inventory both. A list of installed extensions and configured MCP servers per developer is the starting point.
- Approve by name and version. Use the extension allowlist for editors, and a reviewed config for MCP servers.
- Prefer transports and settings that limit access. The protocol guidance says local servers should use the stdio transport to limit access to the client, and require authorization tokens or restricted IPC if they use HTTP.
- Sandbox where possible. The same guidance recommends running server commands in a sandbox with minimal privileges.
- Read tool lists. Remove tools that can write or send data unless a workflow needs them.
- Keep human approval on for state changing calls.
Try it yourself
Click through it at your own pace, or open it full screen. Look at the exact command and the tools the server exposes before you connect it.
Where Safeguard fits
Safeguard's MCP Guardrail and agent identity capabilities address how agents call tools, and SBOM and dependency scanning covers the packages behind a server. The free scan is at gold.safeguard.sh/scan.
Quick check
Is an MCP server riskier than an extension?
Not inherently. They share install risks. The added risk is that a model can be steered into calling the server's tools by content it reads.
Does Workspace Trust help with agents?
Yes. Restricted Mode disables agents in an untrusted workspace, which limits prompt injection from unreviewed project files.
Sources
- Security best practices, Model Context Protocol
- Extension runtime security, Visual Studio Code documentation
- Workspace Trust, Visual Studio Code documentation
Last reviewed: 19 October 2026.
