VS Code / Copilot

VS Code supports MCP servers in Copilot agent mode. It also has the best secret handling of any client here: inputs prompts once and stores the value in the OS keychain, so a committed config never contains a key.

Add it

Workspace (with inputs)

Create .vscode/mcp.json:

{
  "inputs": [
    {
      "id": "vulnetix-key",
      "type": "promptString",
      "description": "Vulnetix API key as orgId:hex",
      "password": true
    }
  ],
  "servers": {
    "vulnetix": {
      "type": "http",
      "url": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey ${input:vulnetix-key}"
      }
    }
  }
}

VS Code prompts on first use and stores the answer securely. This file is safe to commit, because it contains a reference and not a secret, and every teammate is prompted for their own key.

User settings
Command palette → MCP: Open User Configuration, then add the same servers block. Applies to every workspace.
Note VS Code uses servers, not mcpServers, and requires "type": "http". Both differ from Cursor and Claude Desktop, and copying a config between them is the most common reason a server silently fails to appear.

Confirm it works

  1. Open Chat (⌃⌘I / Ctrl+Alt+I).
  2. Switch the mode dropdown to Agent.
  3. Click the tools icon. vulnetix should be listed with its tools.

Command palette → MCP: List Servers shows connection state and gives you Show Output for the server log.

Is CVE-2021-44228 in CISA KEV, and what was the remediation deadline?

Using the prompts

MCP prompts appear as slash commands in chat:

/mcp.vulnetix.vulnetix_vuln

Worth knowing

Agent mode only. Ask and Edit modes do not call MCP tools.

Tool limit. VS Code caps tools sent per request (128 at the time of writing). Vulnetix uses 31, so you have room, but with several servers you can hit it. Use the tools picker to disable ones you are not using.

Copilot subscription required for agent mode.

Reload after editing mcp.json. The command palette has MCP: Restart Server, which is faster than restarting the editor.

Troubleshooting

Server not listed. Check you used servers and not mcpServers, and that "type": "http" is present.

Prompted for the key every session. The input was not stored. Re-enter it, and check the workspace is trusted (untrusted workspaces do not persist inputs).

Tools present but never called. Confirm Agent mode, then check the tools picker has Vulnetix enabled.

401 in every result. The stored input needs both halves: orgId:hex. The ApiKey prefix is already in the config, so do not include it in the input.