A repository can list recommended extensions in .vscode/extensions.json, and VS Code prompts you to install them the first time you open the workspace. The file does not install anything by itself. It is a useful team convention and also a nudge you should read before accepting.
How it works
Per the VS Code documentation, running Extensions: Configure Recommended Extensions (Workspace Folder) creates .vscode/extensions.json in a single folder workspace. You add IDs in publisher.extension form to the recommendations array. In a multi-root workspace, recommendations go in the .code-workspace file under extensions.recommendations, and you can add per folder ones.
VS Code then prompts users to install the recommended extensions the first time they open the workspace.
The upside for teams
- New developers get the right linter, formatter and language support in one click.
- The file lives in version control, so changes go through review.
- It reduces the pull to install random alternatives.
The risk for readers
Anyone who can commit to a repository can add a recommendation. If you clone an unfamiliar project and accept every prompt, you install whatever the file lists. The installed extensions then run with your permissions, as explained in what an extension can do.
Workspace Trust does not make this safe. It governs what a folder can trigger. The Workspace Trust page states it cannot stop a malicious extension from running code, so the decision to install is still yours.
For team owners: keep the list tight
- Recommend only extensions you have vetted. The vetting checklist applies.
- Prefer a short list of widely used extensions from verified publishers.
- Require review for any change to
.vscode/extensions.json, for example with a code owners rule. - Pair it with an allowlist where you control machines. See extensions.allowed.
For readers: a habit
When the recommendation prompt appears in code you did not write, open extensions.json, look up each ID, and decline the prompt if any of them is unfamiliar. You can install the ones you need later by hand.
What about unwanted recommendations
You can disable an extension globally or for the current workspace from the gear button in the Extensions view, and re-enable it later.
Reviewing a change to the file
When a pull request edits .vscode/extensions.json, ask three questions. Is the new extension needed by everyone, or only by the author? Has someone vetted it? Is the publisher recognisable and verified? Small changes like this slip through because they look like configuration, not code. A code owners rule that routes .vscode changes to a security minded reviewer is a light way to add attention.
Unwanted recommendations
Some repositories recommend long lists. You are not obliged to install any of them, and declining the prompt does not stop you from working. Install the language support you need, and add the rest one at a time as the task requires.
Quick check
Does extensions.json install extensions automatically?
No. VS Code prompts you the first time you open the workspace. You choose.
Who can change the recommendations?
Anyone who can change the file in the repository. Treat edits like code changes and review them.
Sources
Last reviewed: 19 October 2026.
