Five checks you can do by hand before you press Install — and how RepoGates answers them for your AI agent.
The short answer. Nobody can tell you an extension is safe, and a tool that says so is overclaiming. What you can tell in five minutes is whether it is trustworthy enough to install: who published it, whether its popularity fits its age, whether its name imitates another, whether you can read its source, and what it declares it will do.
An extension runs inside your editor with your files, your terminal and your credentials in reach. Malicious extensions have been published under names one letter away from popular ones, and in 2025 one campaign hid its JavaScript inside an extension's node_modules/ folder, where a list of files cannot tell it from an ordinary dependency. The marketplace removes these after researchers report them; the question is what you can see before you press Install.
1. Is the publisher's domain verified? Every publisher on the Marketplace shows as verified, so that mark tells you little. A verified domain ties the publisher to an organisation you can look up. Of the 200 most-installed extensions, 79 do not have one, so its absence alone is not damning on an established listing. It matters more on a new one.
2. Do its installs fit its age? A listing a few days old with tens of thousands of installs is the shape of bought traction, the same shape a pair of AI-branded extensions used in January 2026.
3. Is its name one letter from a famous one? Compare the publisher and the name with the extension you meant. Cloned listings copy the icon and the description too.
4. Can you read its source, and is the owner the publisher? A linked repository lets you check what you are installing. Under a different owner is ordinary for an established extension and a signal on a new one. No link at all is common for closed-source tools from verified vendors, and a warning on anything else.
5. What does it declare it will do? The manifest says whether it executes code, which events wake it, which proposed APIs it opts into (terminal-data access is the sensitive one), and which other extensions it pulls in.
RepoGates scores a VS Code Marketplace extension on 17 published checks, the five above among them. It answers through the MCP server and the Claude Code plugin, not in the browser: your agent can ask check_repo with the VS Code platform before it suggests an extension, and the plugin's hook reads code --install-extension (and the same verb in Cursor, Windsurf and VSCodium) before Claude Code runs it. On the 100 most-installed extensions, 99 pass and one is flagged, named on the intelligence page with the reason.
The plugin's hook sees Bash tool calls in Claude Code and nothing else: it does not see a command you type in your own terminal or one another agent runs. An extension installed from the editor's own Extensions pane is not a shell line, so no hook sees it. Open VSX, the registry Cursor and VSCodium use, is not assessed yet, and the largest recent clone campaign was published there. The metadata checks read the listing and the package's file list, not its code; a deep scan reads the files, one credit a scan. A PASS means every check that could run, ran, and none fired — never a guarantee.
Can RepoGates check an extension I install from the Extensions pane? Not yet. That install is not a shell line, and the board on Marketplace pages is a later browser release. Today the check runs when your agent asks the MCP server, or when the Claude Code plugin sees code --install-extension on a command line.
Does a verified badge mean the extension is trustworthy? No. Every Marketplace publisher shows as verified. A verified domain is the stronger signal, and even that says who published it, not what the code does.
Is Open VSX covered? No. Open VSX is the registry Cursor, VSCodium and Windsurf install from, and RepoGates does not assess it yet. An Open VSX URL on a command line comes back as ask, never as a pass.
Set up the Claude Code plugin Plans
The checks run on the paid plans, through the MCP server and the Claude Code plugin. Numbers on this page: the 200 and 100 most-installed extensions, measured 18 September 2026 (docs/32).