Connect Cyfendo to VS Code (Copilot)

Setup · about 2 minutes

Set it up

1. 1

   Click Add to VS Code and confirm. Or run MCP: Add Server from the Command Palette, choose HTTP and enter the server URL, or add the configuration below to .vscode/mcp.json in your project.

   Add to VS Code(opens VS Code (Copilot))

   .vscode/mcp.json Copy

   {
     "servers": {
       "cyfendo": {
         "type": "http",
         "url": "https://mcp.cyfendo.com/mcp"
       }
     }
   }

2. 2

   When VS Code asks to sign in to Cyfendo, allow it. Your browser opens Cyfendo: sign in and click Allow.

3. 3

   In Copilot Chat, switch to Agent mode.

4. 4

   The first time the agent wants to run a Cyfendo tool, open the Allow dropdown and trust all of Cyfendo's tools (for this workspace, or always), so checks don't stop for approval. Change it later with Chat: Manage Tool Approval.

5. 5

   Add the instruction below to .github/copilot-instructions.md at the root of your project (the clicks are listed with the instruction). On the first check, Cyfendo gives the project its own ID and the agent saves it in cyfendo.json: commit that file with your code.

   Get the instruction

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

Recommended

Teach your agent when to check

Paste this into .github/copilot-instructions.md so VS Code (Copilot) calls Cyfendo on its own after risky changes and tells you when results are ready.

## Security checks (Cyfendo)
Cyfendo identifies this project by the project_id in cyfendo.json at the project root. Pass it in every Cyfendo call. If the file doesn't exist, the first check or scan creates the project: save the project_id it returns to cyfendo.json and keep the file with the code.
- At the start of each of my requests, call cyfendo_status and tell me about any earlier_results before doing anything else.
- When you finish a task that changed login, sessions, permissions, database access, payments, file uploads, API routes or secrets, call cyfendo_check_changes once with all the files the task changed (list deleted files under deleted) and a short label. Don't wait for the result.
- For a confirmed issue that is still current, fix it as its fix_steps describe, or call cyfendo_generate_fix and then cyfendo_get_fix for Cyfendo's tested patch and show me the diff before applying it. Then call cyfendo_verify_fix.
- When I say I'm getting ready to release, call cyfendo_scan_project with this repository as a git source if it is pushed to GitHub, GitLab or Bitbucket; otherwise upload the source files in parts. Tell me when it has finished.

Check it works

Try it

Send one of these to VS Code (Copilot)'s agent.

• Check that it's connectedUse Cyfendo to show my security status.
  Copy
• Check a changeCheck the files you just changed with Cyfendo.
  Copy
• Collect finished resultsCollect any Cyfendo results that are ready.
  Copy
• Before you publishI'm getting ready to publish. Run a full Cyfendo security scan.
  Copy

Before you launch

Security questions

Good to know

• Commit cyfendo.json with your code: every clone of the repository, and every coding agent working on it, then shares the project's Cyfendo results. If you copy the code into a separate project, delete cyfendo.json in the copy so it gets its own ID.
• Full scans: when the project is pushed to GitHub, GitLab or Bitbucket, connect that repository in Cyfendo (Settings → Integrations → Git) and Cyfendo reads it directly, whatever its size. Public repositories need no setup. Otherwise the agent uploads the source files in parts of up to 50 files.
• To use an API key instead of signing in, add a headers entry with X-Cyfendo-Api-Key and keep the key in an input variable rather than in the file.
• VS Code also reads AGENTS.md at the root of your repository, if you'd rather keep the instruction there.

Troubleshooting