Docs

Control what VS Code can install

Decide which extensions VS Code may install, whether Copilot may use MCP servers, and whether its agent may act at all. Pushed as policy, so a developer can't undo it.

Why

VS Code extensions run with full access to the machine, and new AI extensions appear weekly. VS Code honours a set of company policies that device management can push. ZYBE writes them for you from a few plain choices.

Steps

  1. Click the gear icon, then Rules, and open the Advanced card.
  2. Find the VS Code policy block.
  3. Choose:
    • Extensions: Any, or Approved only. Approved only means only extensions you've approved in the Inventory may be installed.
    • MCP servers: Any, Registry only or None.
    • Agent mode: on or off. Off means Copilot can chat but not act.
    • Auto approve tools: whether the AI may run tools without asking the developer.
    • Hooks: leave on. This is what lets ZYBE check Copilot's actions.
  4. Then either:
    • Switch on Apply with the sensor. Every laptop with a whole-machine install writes the policy itself. Or:
    • Click Download for macOS, Windows or Linux and push the file through your device management. It's a configuration profile on Mac, a registry script on Windows, a policy.json on Linux.

Approve an extension

  1. Click Inventory, then Extensions in the left rail.
  2. Click the extension, then Actions, then Approve.

With Approved only set, VS Code refuses to install anything else and tells the developer it's blocked by policy.

Check it's working

Open a laptop from Inventory, Endpoints, and click Sensor. The VS Code row says whether the managed policy is in effect.