MCP in VS Code: add a server, trust it, and audit its actions

To add an MCP server in Visual Studio Code, run MCP: Add Server, enter the publisher's endpoint or launch command, and choose a configuration destination. For VS Code's format, use .vscode/mcp.json with a servers object; portable Copilot configurations use mcpServers instead. Review trust and authentication, then verify an actual tool call using the official connection guide.

What it can do

MCP connects an agent to capabilities supplied by a server, such as retrieving documentation or querying an external service. Which capabilities you get depends on that server. Start with a specific need: finding a deployment instruction is a better trial than giving an unfamiliar connector permission to reorganize your project.

For example, ask a documentation server to retrieve the migration guidance for a dependency, then compare the returned source with the proposed code change. For an issue-tracking workflow, begin with reading an issue rather than updating its status. Define the expected evidence before granting write access.

For background, read what MCP is, compare remote and local servers, or browse AI agents explained.

Where the configuration belongs

As of 30 Oct 2026, the official configuration reference distinguishes these locations:

For illustration, this is the VS Code workspace format. The URL is a placeholder: replace it with the publisher's documented MCP endpoint before starting anything.

{
  "servers": {
    "docs": {
      "type": "http",
      "url": "https://your-server.example/mcp"
    }
  }
}

Keep existing entries when adding your server. Do not copy this wrapper into a portable file. Match the format to the selected agent harness, meaning the runtime that executes the agent's tools.

How to connect it safely

1. Choose a bounded trial. Use an account and project suitable for testing. Write down the permitted data and actions: retrieve a public instruction, summarize its requirements, and make no changes. Consult the MCP security checklist before using sensitive material.

2. Check the publisher's setup. Confirm the endpoint or executable, required runtime, and authentication method. With MCP: Add Server, choose HTTP for an endpoint or Command (stdio) for a launch command. Select the destination deliberately; the connection guide describes the available choices.

3. Review trust before startup. Workspace MCP files inherit Workspace Trust; a trusted workspace can start these servers without a separate MCP prompt, including after configuration changes. Non-workspace sources may prompt separately. MCP: Reset Trust resets separate MCP decisions, not Workspace Trust. Review the trust rules before accepting a repository.

4. Authorize the intended account. Follow the server publisher's sign-in instructions. Check the organization and requested access before approving. Keep credentials out of chat and committed configuration. A successful sign-in should not be your acceptance criterion for the whole connection.

5. Limit tool availability. For Copilot sessions, use Chat: Open Customizations and its Tools tab; Local sessions use Configure Tools in chat. Availability and approval are separate controls. The tools documentation explains their scope. Keep unrelated tools unavailable for the trial.

6. Request visible evidence. Ask the agent to use the named server for your bounded lookup and identify the retrieved source. Expand the call in the conversation, inspect its inputs and output, and compare the answer with that output. Repeat only after you understand any error.

Audit what the agent actually did

Keep a small acceptance record: the task, intended server, account, permitted actions, observed calls, returned evidence, and remaining uncertainty. Redact credentials before sharing it. Record the configuration revision too, so a later reader knows which connection was under review.

Suppose your task was to explain a migration and draft a patch. Check the retrieved instruction, inspect the patch, and run the relevant verification separately. An answer that mentions tests does not establish that tests ran. Save the observed command result and distinguish a passed check from an untested suggestion.

Review external text as data. VS Code's security guidance describes prompt injection through tool output and recommends reviewing edits. If retrieved content asks the agent to disclose credentials or broaden its task, stop and reassess the request. A useful audit explains both the permitted action and the evidence that it happened.

When this does not work

The configuration belongs to another harness. In particular, servers requiring ${input:...} or ${command:...} are not forwarded to the Copilot harness. Copying them into .mcp.json does not add input-prompt support. Follow the migration guidance and test supported authentication before replacing a working setup.

The process or connection fails. Check the runtime on the execution host, endpoint, network, and account. Run MCP: List Servers, select the server, and use Show Output. These are documented troubleshooting steps. Share redacted errors with the publisher rather than repeatedly approving an unchanged request.

The answer has no supporting action. Treat the result as unverified if you cannot identify the intended call and useful output. Narrow the task and ask for evidence. If a service needs a broader permission than your task allows, stop the trial instead of widening access merely to make it pass.

Where Tvijo fits

As of 30 Oct 2026, the DSHREM VS Code extension and TvijoCode are editor-side clients for Tvijo work. The extension guide describes selected-context questions, capped tasks, and usage receipts. TvijoCode is described as a Windows x64 test build with the extension embedded, unsigned and without automatic updates. Evaluate its distribution separately from installing the extension in Visual Studio Code.

Tvijo MCP makes Tvijo callable by an MCP client. The dated MCP release record separates published consultation from prepared supplied-diff review: at its 28 Oct observation, the review source was merged and tagged while package publication was pending. Editor integration and safe delegation remain planned phases in that record. An editor client being available does not establish that it can automatically register Tvijo MCP or execute another server's tools.

For a pilot, request a bounded explanation, inspect the response, and compare the task receipt with your own acceptance checks. A usage receipt records consumption; retain separate evidence for file changes and verification.

At the Tvijo workspace, as of 30 Oct 2026, Try costs $0 and ends at 5 tasks, 50,000 tokens, or $0.05 of sponsored usage, whichever comes first, drawing from a shared $1 daily pool funded by TVIJO. Service credit is shown as $10: prepaid credit is requested, usage is metered with an 8% service markup, payment collection is not activated, and an order is not a charge.

FAQ

Is .vscode/mcp.json the same as .mcp.json?

They use different formats and server-object names. Choose the destination for your harness and check the current configuration reference before moving entries.

Why was there no separate server trust prompt?

Workspace MCP configuration inherits Workspace Trust. Review repository configuration before trusting the workspace; absence of a separate prompt does not establish safety.

Does connecting Tvijo MCP delegate work into my editor?

The dated Tvijo release record treats consultation, supplied-diff review, and editor delegation separately. Check the current documentation for publication and client support before relying on delegation.

Visual Studio Code is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.