How to open an unfamiliar repository in VS Code safely

Open the folder in Restricted Mode, read the files under .vscode and any dev container config before you trust anything, then grant trust only if nothing there runs commands you do not understand. That order costs a few minutes and removes most of the risk from cloned code.

Step 1: Say no to trust first

When VS Code asks whether you trust the authors, choose the option that keeps the folder restricted. Per the VS Code documentation, this blocks tasks, debugging, the terminal, and settings that can point to executables, and it disables AI agents in the workspace. You can still read every file.

Step 2: Read the files that can run things

Look at these before you trust the folder:

• .vscode/tasks.json. Tasks can run commands. A task with runOptions set to runOn: folderOpen is meant to start when the folder opens.
• .vscode/settings.json. Look for settings that name executables, shells or paths.
• .vscode/launch.json. Debug configurations can start programs.
• .vscode/extensions.json. This lists extensions the repository recommends. Recommendations are prompts, not installs, but they shape what you add to your editor.
• .vscode/mcp.json and .mcp.json. These can define MCP servers. VS Code warns that local MCP servers can run arbitrary code on your machine.
• .devcontainer/devcontainer.json. It can name images, extensions to install and post-create commands.

Step 3: Check automatic tasks

The VS Code tasks documentation states that automatic tasks never run in an untrusted workspace. It also notes that the task.allowAutomaticTasks setting is off by default, which means you are prompted once. If you have set it to on, trusted workspaces run automatic tasks without asking. For unfamiliar code, keep it off.

Step 4: Decide, and scope the trust

If the files look ordinary, trust the project folder itself, not its parent. Trusting a parent folder trusts all subfolders, including repositories you clone there later.

If anything looks odd, do not trust the folder. Read the code in Restricted Mode, or open it in a disposable environment such as a throwaway virtual machine. Remember that a container is not automatically a security boundary, and the Dev Containers documentation does not describe it as one for untrusted code.

Step 5: Keep your editor tidy

Review which extensions you have installed and whether any run in untrusted workspaces. See what an extension can do inside VS Code for why that matters.

A worked example

Say a recruiter sends a coding exercise as a zip file. Open it in Restricted Mode. Skim .vscode/tasks.json and find a task that runs a shell command with a downloaded script. That alone is enough to stop. You can read the exercise in the editor, run the code in a disposable virtual machine if you must, and tell the sender what you found. Most repositories are harmless, but the check is cheap and the downside of skipping it is a compromised laptop that holds your keys and tokens.

For maintainers

If you publish repositories, make this easy for readers. Keep .vscode small, document any automatic task in the README, and avoid committing MCP server definitions that fetch code at start. Readers who find a clean .vscode folder trust the project faster.

Quick check

Sources

• Workspace Trust
• Tasks in VS Code
• Using MCP servers in VS Code
• Dev Containers in VS Code
• Extension Marketplace

Last reviewed: 19 October 2026.