IDE Extensions

The IDE Extensions page provides an organization-wide view of all IDE extensions/plugins detected on developer machines.

A summary at the top of the page shows the total number of unique extensions detected across active devices (for example, Total 644 unique extensions across 19 active devices).

Below the summary, IDE filter chips let you scope the list to a single IDE. Each chip shows the number of unique extensions detected for that IDE.

From this page, you can see:

• A list of all IDE extensions and plugins in use across your fleet
• The IDE each item belongs to
• Whether the item is an Extension (VS Code-style) or a Plugin (JetBrains-style)
• Whether it was User installed or shipped as part of the IDE
• A security score for each extension, rendered as a color-coded bar
• Compromised and typosquatted extensions (typosquatted extensions are deceptive IDE extensions that mimic legitimate ones with slightly altered names to trick developers into installing them)

Filters

The page supports the following filters:

• Search by extension name: free-text search across all detected items
• Risk Type: filter to surface known-risky items. Available values are Compromised and Typosquat.
• All kinds: filter by item kind (Extension or Plugin)
• IDE chips: scope to a single IDE

Follow this interactive demo to see how it works:

Supported IDEs

Dev Machine Guard detects extensions installed in the following IDEs on Windows, macOS, and Linux:

• Visual Studio Code
• Cursor
• Windsurf
• Antigravity
• JetBrains IDEs (IntelliJ IDEA, PyCharm, GoLand, WebStorm, RubyMine, CLion, Rider, PhpStorm, DataGrip, RustRover, Aqua, DataSpell, AppCode)
• Android Studio
• Eclipse-based IDEs
• Xcode

You can filter the IDE Extensions page by IDE to focus on a specific development environment.

Extension Details

Selecting an IDE extension opens a detailed view with information about its usage and security posture.

Devices Using This Extension

This section shows:

• All devices where the extension is installed
• The version of the extension installed on each device

This helps you understand the spread of an extension across your organization and identify where remediation may be required.

Extension Security Score

Each IDE extension is assigned a security score based on multiple supply chain signals.

The security score provides visibility into factors such as:

• Install base and adoption
• Release recency
• Publisher verification status
• License availability
• Known vulnerabilities
• Repository security posture (for example, branch protection and security policy presence)

This information helps you understand why an extension has its assigned score and supports decisions about whether it should continue to be used within your organization.

Enforcing an approved extension set

Allow-lists and block-lists for VS Code extensions are available today through Device Policy. Create an IDE extensions policy, choose whether the listed extensions are the only ones permitted or the ones blocked, then add the policy to a profile and assign it to devices. Rules can be built directly from the extension inventory on this page.

Upcoming Capabilities

The following capability is currently under development:

• Cooldown periods for new extension versions, preventing newly released updates from being used until they have been evaluated

These controls will help reduce exposure to malicious or compromised extension updates while maintaining developer productivity.