Docs

VS Code with Copilot Chat

Copilot's agent mode in VS Code. Fully covered through its built-in check, plus a company policy that decides what VS Code may install.

What ZYBE can do

Block and Ask, on every rule, for everything Copilot's agent does in VS Code: terminal commands, file reads and writes, fetches, MCP calls.

On top of that, ZYBE writes a VS Code policy for you: which extensions may be installed, whether Copilot may use MCP servers, whether agent mode runs at all. See Control what VS Code can install.

What you do

Install the sensor. Restart VS Code if it was open. Then, for the part a developer can't undo, push the VS Code policy or switch on Apply with the sensor under Rules, Advanced, VS Code policy.

Check it's working

1. In VS Code, open Copilot Chat in agent mode and ask it to run a command.
2. In the console, open the laptop from Inventory, Endpoints, click Sensor. VS Code shows Blocking, and says whether the managed policy is in effect.

For IT

The check is ~/.copilot/hooks/zybe.json, shared with Copilot CLI. The policy is a configuration profile on Mac, a registry script on Windows, or policy.json on Linux, downloaded from the Rules page or written by the sensor.