VS Code Extension Release Plan

VS Code Extension Release Plan

Goal

Release all features from mcp-server-full/ as a comprehensive VS Code extension.

Feature Gap Analysis

Currently Implemented in VS Code Extension

Missing Features (from mcp-server-full)

Implementation Plan

Phase 1: Core Infrastructure (Week 1)

1.1 Update Package Dependencies

// package.json additions
{
  "dependencies": {
    "js-yaml": "^4.1.0",
    "bloom-filters": "^3.0.0"
  }
}

1.2 Bundle Package Data

Create packages/ directory in extension with:

• npm-bloom.json (7.9 MB) - Optional, for "full" version
• pypi-bloom.json (1.3 MB)
• rubygems-bloom.json (0.4 MB)
• crates.txt, dart.txt, perl.txt, raku.txt

1.3 Create Package Loader Module

New file: src/packageLoader.ts

// Responsibilities:
// - Load Bloom filters for npm/pypi/rubygems
// - Load text files for smaller ecosystems
// - Provide O(1) lookup for package existence
// - Export: checkPackage(name, ecosystem) => boolean

Phase 2: Package Hallucination Detection (Week 2)

2.1 Create Hallucination Provider

New file: src/hallucinationProvider.ts

// Features:
// - Scan imports in JS/TS/Python/Ruby/Rust files
// - Extract package names from import statements
// - Check against Bloom filters / package lists
// - Return list of potentially hallucinated packages

2.2 Add Hallucination Diagnostics

Update extension.ts:

// - Add new diagnostic collection for hallucinations
// - Show warning squiggles on suspicious imports
// - Add "Check Package" command
// - Add "Scan File for Hallucinations" command

2.3 Update Sidebar

Update securityProvider.ts:

// - Add "Hallucinated Packages" section
// - Show file -> package hierarchy
// - Add click-to-search action (open npmjs.com, pypi.org, etc.)

2.4 Add Commands

// package.json commands
{
  "command": "agentSecurity.checkPackage",
  "title": "Security: Check Package Legitimacy"
},
{
  "command": "agentSecurity.scanPackages",
  "title": "Security: Scan File for Hallucinated Packages"
},
{
  "command": "agentSecurity.showPackageStats",
  "title": "Security: Show Package Database Stats"
}

Phase 3: Agent Prompt Security (Week 3)

3.1 Create Prompt Scanner Module

New file: src/promptScanner.ts

// Responsibilities:
// - Load agent-attacks.security.yaml rules
// - Load prompt-injection.security.yaml rules
// - Scan text/markdown/prompt files
// - Calculate risk score (0-100)
// - Return action: BLOCK / WARN / LOG / ALLOW

3.2 Add Prompt Security Provider

New file: src/promptSecurityProvider.ts

// Features:
// - Scan .txt, .md, .prompt, .jinja files
// - Show risk level in sidebar
// - Provide CodeActions for detected injections
// - Support inline suppression comments

3.3 Add Status Bar Integration

// Show prompt risk level in status bar when editing:
// - .prompt files
// - .jinja / .jinja2 files
// - Files containing LLM API calls

3.4 Add Commands

{
  "command": "agentSecurity.scanPrompt",
  "title": "Security: Scan Text for Prompt Injection"
},
{
  "command": "agentSecurity.analyzeRisk",
  "title": "Security: Analyze Prompt Risk Level"
}

Phase 4: Enhanced Security Scanning (Week 4)

4.1 Add Missing Rule Files

Ensure all 12 YAML rule files are bundled:

• agent-attacks.security.yaml (35.8 KB)
• prompt-injection.security.yaml (28.9 KB)
• terraform.security.yaml (19.5 KB)
• c.security.yaml (16.6 KB)
• php.security.yaml (18.0 KB)
• ruby.security.yaml (15.0 KB)
• Plus existing 6 files

4.2 Add Language Support

Update activationEvents in package.json:

"activationEvents": [
  "onLanguage:terraform",
  "onLanguage:hcl",
  "onLanguage:dockerfile",
  "onLanguage:yaml",
  "onLanguage:c",
  "onLanguage:cpp",
  "onLanguage:markdown",
  "onLanguage:plaintext"
]

4.3 Add Configuration Options

"agentSecurity.enableHallucinationDetection": {
  "type": "boolean",
  "default": true,
  "description": "Enable package hallucination detection"
},
"agentSecurity.enablePromptScanning": {
  "type": "boolean",
  "default": true,
  "description": "Enable prompt injection scanning"
},
"agentSecurity.promptSensitivity": {
  "type": "string",
  "enum": ["high", "medium", "low"],
  "default": "medium",
  "description": "Sensitivity level for prompt injection detection"
}

Phase 5: UI/UX Enhancements (Week 5)

5.1 Enhanced Sidebar

Agent Security
├── Security Issues (43)
│   ├── app.js (5 issues)
│   │   ├── [ERROR] SQL Injection (line 23)
│   │   └── [WARN] XSS via innerHTML (line 45)
│   └── auth.py (3 issues)
├── Hallucinated Packages (2)
│   ├── index.js
│   │   └── [WARN] "ai-helper-utils" not found in npm
│   └── main.py
│       └── [WARN] "fastapi-extensions" not found in PyPI
└── Prompt Security
    ├── system-prompt.txt [RISK: HIGH]
    └── user-template.jinja [RISK: LOW]

5.2 Webview Dashboard

New file: src/dashboardPanel.ts

• Summary statistics
• Risk distribution chart
• Quick actions panel
• Historical trend (if data saved)

5.3 Quick Fix Actions

Add CodeActions for:

• "Replace with verified package alternative"
• "Add to allowlist (suppress warning)"
• "Search package on registry"
• "Report false positive"

Phase 6: Testing & Quality (Week 6)

6.1 Unit Tests

New files in src/test/:

• packageLoader.test.ts
• hallucinationProvider.test.ts
• promptScanner.test.ts

6.2 Integration Tests

• Test with benchmark corpus
• Verify 94.9% precision maintained
• Test all 7 package ecosystems

6.3 Performance Testing

• Measure startup time with Bloom filters
• Ensure <100ms scan latency
• Memory footprint analysis

Phase 7: Release Preparation (Week 7)

7.1 Documentation

• Update README.md with new features
• Add CHANGELOG.md
• Create GIF demos for marketplace

7.2 Marketplace Assets

• Icon (128x128 PNG)
• Banner (1280x640 PNG)
• Screenshots (1366x768)

7.3 Publishing

# Install vsce
npm install -g @vscode/vsce

# Package extension
vsce package

# Publish to marketplace
vsce publish

7.4 Two Package Versions

File Structure After Implementation

src/
├── extension.ts              # Main entry point (updated)
├── analyzer.py               # Python security scanner
├── securityProvider.ts       # Sidebar tree view (updated)
├── securityFixProvider.ts    # CodeAction provider (updated)
├── fixTemplates.ts           # Fix templates (existing)
├── packageLoader.ts          # NEW: Bloom filter loader
├── hallucinationProvider.ts  # NEW: Package hallucination
├── promptScanner.ts          # NEW: Prompt injection scanner
├── promptSecurityProvider.ts # NEW: Prompt security UI
├── dashboardPanel.ts         # NEW: Webview dashboard
├── rules/                    # 12 YAML rule files
├── packages/                 # Package lists & Bloom filters
└── test/
    ├── packageLoader.test.ts
    ├── hallucinationProvider.test.ts
    └── promptScanner.test.ts

Timeline Summary

Total: 7 weeks to feature parity with mcp-server-full

Success Metrics