> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/extension-advisor.md).
# Extension Advisor
**Extension Advisor** checks an IDE extension's security score before anyone installs it. Enter the exact extension ID and the marketplace it comes from.
The [IDE Extensions page](/developer-machines/ide-and-ai-agents/ide-extensions.md) tells you about the extensions already running across your fleet. Extension Advisor answers the question that comes earlier: a developer wants to install something, or has just been sent a link to something, and you want a view on it before it lands on a machine. The lookup works for any extension, including ones nobody in your organization has installed yet.
### Checking an extension
* Enter the **Extension ID**. This is the exact published identifier, not the display name shown in the marketplace.
* Choose the **Marketplace** the extension is published to. Four are supported: **VS Code Marketplace**, **Open VSX**, **JetBrains Marketplace**, and **Visual Studio Marketplace**.
* Select **Check score**.
The marketplace has to match where the extension is actually published. An id that is correct for one marketplace will not resolve against another.
#### Extension ID formats
| Marketplace family | Format | Example |
| -------------------------------- | -------------------------- | -------------------- |
| VS Code, Open VSX, Visual Studio | `publisher.extension-name` | `ms-python.python` |
| JetBrains | Reverse domain style | `com.example.plugin` |
The identifier has to be exact. Two extensions can carry near-identical display names while differing only in publisher, which is precisely the situation a typosquat creates, so a lookup by display name would defeat the purpose of the check.
The quickest way to get an exact id is the marketplace listing itself: it appears in the listing's URL and in the installation command the marketplace offers.
If the id cannot be found in the selected marketplace, Extension Advisor reports **Extension not found**. Check the id character for character, then check the marketplace selection, since a valid id looked up against the wrong marketplace produces the same result.
### Understanding the result
The result opens with the extension's identity, so you can confirm you looked up what you meant to: its display name and description, the id, the marketplace, the publisher with a badge where the publisher is verified, the install count, and a **Marketplace** link out to the listing.
Beneath that, **Check whether this extension is already installed** takes you to IDE Extensions filtered to this id, so you can see whether it is running in your fleet already and on how many devices. An extension you are evaluating for one team is often already installed by another.
#### Security Score
The **Security Score** is given out of 10 and rendered as a colour-coded bar. It summarises the supply chain signals below it, and it is the same score shown against installed extensions on the IDE Extensions page.
#### The signal breakdown
The **IDE extension security score** table shows each signal that contributed, with a marker for whether it passed, warrants attention, or failed:
| Signal | What it reports |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Install Count** | How many users the extension has. A large install base is not proof of safety, but a near-empty one on an extension presented as popular is a warning. |
| **Latest Release Date** | When it was last updated. Long gaps suggest an abandoned extension, which is both unpatched and an attractive target for a takeover. |
| **Verified Publisher** | Whether the marketplace has verified the publisher. |
| **License** | Whether a license file was detected. |
| **Vulnerabilities** | Known vulnerabilities detected in the extension. |
| **Branch Protection** | Whether the source repository protects its development and release branches. Weak branch protection is how a compromised maintainer account turns into a compromised release. |
| **Security Policy** | Whether the repository publishes a security policy, which is the route for reporting a vulnerability responsibly. |
Read the breakdown rather than the number alone. A widely used extension from a verified publisher can still carry open vulnerabilities, and the table is what tells you which part of the score is weak. The score is a summary of evidence, not a verdict on whether to install.
### When to use it
* **A developer asks to install an extension.** Check it before approving, rather than discovering it on the IDE Extensions page afterwards.
* **An extension has been recommended in a chat, an issue, or a blog post.** These are the installs that skip review entirely.
* **You are choosing a replacement.** After an extension is compromised or abandoned, the alternatives are usually a shortlist of similar extensions, and this scores them without installing any.
* **A name looks almost right.** If an id differs from the one you expected by a character or a publisher, check both.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/extension-advisor.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
