AIGIS SHIELD

Use the AIGIS SHIELD chat from the VS Code sidebar.

• Ask the AI to read, search, and edit your local files, or to run commands. By default, file changes and commands are shown to you for approval before they run.
• Use the tools of the AI Governance Gateway (creating Office files, processing media, reading documents, search, and more). Local files are sent to the AI Governance Gateway work folder for these tools, and the files they produce can be saved back to your machine.

Getting started

1. Open AIGIS SHIELD from the Activity Bar.
2. Enter your client ID and click Sign in with browser. Sign in on the page that opens in your browser (the same account as the browser version); you are then returned to VS Code.
3. Type your request in the chat.

You stay signed in after you restart VS Code. To sign out, use Sign out in the ... menu of the chat view.

Running tools

Choose how the AI runs tools from the drop-down below the input box. The mode belongs to each conversation: a new chat starts in Plan, and changing it in one chat does not affect the others. A change made while the AI is responding takes effect from your next message.

Pressing Stop also stops a command the AI is running on your PC and closes any pending approval.

Guardrails

In Confirm and Semi-auto modes, the following always ask, even for registered commands. Auto mode lets them run.

• Sending data outside your PC: git push, and commands that talk to the network: curl, wget, Invoke-WebRequest / Invoke-RestMethod (and their aliases), ssh, scp, sftp, ftp, nc, telnet, Start-BitsTransfer, certutil with a URL, and publishing packages (npm publish, twine upload, dotnet publish, dotnet nuget push). git fetch / pull / clone, npm install, and builds are not covered. The approval shows the destination, and Allow <host> in this conversation stops asking for that destination until the conversation ends. Destinations listed in aigis-shield.allowedNetworkHosts (user settings) never ask.
• Places where secrets are often kept: a command whose arguments point to ~/.ssh, ~/.aws, ~/.azure, ~/.gnupg, ~/.docker, ~/.kube, %APPDATA%, %LOCALAPPDATA%, or a browser profile (Chrome, Edge, Firefox).
• Protected locations: writing, deleting, or moving inside .git, .vscode/settings.json, .vscode/tasks.json, .vscode/launch.json, .vscode/mcp.json, .mcp.json, *.code-workspace, VS Code's user settings folder, and the extensions folder, with the file tools or as a command argument.

Some protections apply in every mode:

• Secrets: a command that reads a file that may hold secrets (cat .env, Get-Content id_rsa, copy), and file content or command output that contains something that looks like a secret, ask first (see Files that may hold secrets).
• git: git run without your approval is started with settings that stop a repository from launching other programs (core.fsmonitor, core.hooksPath, core.pager; GIT_EXTERNAL_DIFF and GIT_PAGER are removed). If the repository's own configuration starts programs that cannot be turned off this way (diff.external, diff drivers, filter), every git command asks first.
• aigis-shield.planDirectory and aigis-shield.projectInstructionsFile are read from user settings only, so a repository's .vscode/settings.json cannot change them.
• File changes cannot be approved from the VS Code notification. Its button opens the diff and the chat, where you approve on the card.

These rules reduce accidents. They are not a security boundary.

Undoing the AI's changes

Before the AI changes a file with its file tools (write, edit, patch, copy, move, delete, extract, or a file saved from the gateway), the extension keeps a copy of the earlier content. This also happens in Auto mode.

To go back, point at one of your messages and click the Restore to before this message icon below it. After you confirm, every file the AI changed from that message on returns to its earlier state, and files the AI created are moved to the trash. The conversation itself is kept.

• Files changed by a command the AI ran are not restored. Use your version control for those.
• A file larger than 20 MB is not kept, and is listed as not restored.
• Copies are stored in the extension's own storage, outside your workspace, and are removed when you delete the conversation or after 30 days without use.

What the AI is told about your project

With every message, the extension tells the AI a few things it would otherwise have to find out each time: your OS and shell, the folders you opened, the git branch and whether there are uncommitted changes, and the current task list.

If a file named AGENTS.md is at the top of a workspace folder, its content is passed along too (the first 8,000 characters). Use it for project conventions and how to build and test. The file is shown as a chip above the input box; click the chip to stop passing it in that chat tab. Change the file name, or turn this off with an empty value, in aigis-shield.projectInstructionsFile.

This information is not stored in the conversation. When masking is on, it is masked the same way as your message.

Checking code

The AI can ask VS Code for the problems it reports (errors and warnings) and can look up definitions, references, and symbols through the language extensions you have installed. After the AI edits a file, any new error VS Code reports for that file is returned to the AI with the result, so it can fix what it broke. A language without a language extension gives no results.

Fewer round trips

Each reply from the AI takes around ten seconds, so the time a task takes depends mostly on how many round trips it needs. Two tools let the AI do more per reply:

• Edit in bulk: several replacements, across one or more files, in one step. You review one diff per file.
• Run script: the AI writes a Node or Python script and runs it in one step, without going through the shell. Unless you registered node or python as an external command, you are shown the script and asked before it runs.

Task list

For work with several steps, the AI shows a checklist above the input box and updates it as it goes. It is a display only; it does not run anything.

Commands

Open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P) and type AIGIS SHIELD.

Settings

Change settings in either of these places:

• Settings UI: File > Preferences > Settings, then search for aigis-shield.
• settings.json: Run Preferences: Open User Settings (JSON) from the Command Palette, and add the keys below.

Example:

{
  "aigis-shield.externalCommands": ["git status", "git diff", "npm run test"],
  "aigis-shield.commandTimeoutSeconds": 300,
  "aigis-shield.planDirectory": "docs/plans",
  "aigis-shield.language": "en"
}

External commands

The AI runs commands in PowerShell on Windows (PowerShell 7 if installed) and in your shell (zsh / bash) on Mac.

A command line runs without confirmation only when it is simple and uses registered commands only (joined with &&, |, and so on). Otherwise, for example when it uses an unregistered command, command substitution, a subshell, redirection, or variables, the whole line and the reasons are shown to you, and it runs only if you approve. In Plan mode, every command asks first.

File operations, archives, diffs, and search are built into the extension, so you do not need to register commands for them.

For a command that keeps running, such as a dev server or a watcher, the AI can start it in the background and read its output later. A background command keeps running after the AI's reply ends; it is stopped when the AI stops it, when you delete the conversation, or when you close VS Code. Pressing Stop does not stop it. Up to five can run per conversation.

An entry can include arguments. "git status" covers only calls that start with git status, so git push still asks. An entry without arguments, such as "git", covers every call of that command.

In Confirm and Semi-auto modes, operations that are hard to undo ask even when the command is registered: force push and remote branch deletion, git reset --hard, git clean, git branch -D, git restore and git checkout that discard changes, git stash drop, recursive or forced delete (rm -rf, Remove-Item -Recurse), disk commands such as format, Clear-Content, registry changes (reg add / reg delete, and PowerShell commands on HKLM: / HKCU:), and Set-ExecutionPolicy. -Recurse:$true counts as -Recurse. Commands that send data outside your PC also ask (see Guardrails). This list catches common accidents; it is not a security boundary.

Before version 0.0.22 the default was ["git"]. If you had not changed the setting, git commands that change something (git add, git commit, and so on) now ask first. To keep the earlier behavior, set the value to ["git"].

Adding a command

From the chat view: Click the gear icon in the chat, or choose External command settings from the ... menu of the chat view, and add a row.

From settings.json: Add an entry to aigis-shield.externalCommands. Write either the name only (arguments may follow), or an object with a path and a description.

"aigis-shield.externalCommands": [
  "git status",
  "git diff",
  "npm",
  {
    "name": "plink",
    "path": "C:\\Program Files\\PuTTY\\plink.exe",
    "description": "SSH into the internal server. Always pass -batch."
  }
]

aigis-shield.externalCommands is read from your user settings only. A value in a workspace .vscode/settings.json is ignored, so opening a folder cannot add commands that run without confirmation.

MCP servers

The AI can use the tools of MCP servers that you start on this PC. The extension connects only to HTTP MCP servers on 127.0.0.1, localhost, or [::1]. It never starts a server itself, so entries that start a command (stdio) are not used, and it does not connect to remote servers. Starting and stopping the servers is up to you.

Write the servers in the user setting aigis-shield.mcpServers, in the same format as the inside of Claude Code's mcpServers. Only your user settings are read: workspace settings and .mcp.json in the workspace folder are ignored, so opening a folder cannot change where the extension connects. ${ENV_VAR} (or ${ENV_VAR:-default}) in a value is replaced with the environment variable, so you do not have to write tokens in the file.

"aigis-shield.mcpServers": {
  "playwright": {
    "type": "http",
    "url": "http://127.0.0.1:8931/mcp",
    "headers": { "Authorization": "Bearer ${AIGIS_MCP_PLAYWRIGHT_TOKEN}" }
  }
}

The key (playwright above) is the server's name. It is shown in the list and becomes part of the tool names the AI sees. Each server takes these parameters:

• ${ENV_VAR} and ${ENV_VAR:-default} can be used in url and headers. The environment variable is read from VS Code's environment, so after setting it (for example with setx), restart VS Code. If the variable does not exist and no default is given, the server is not used and the list says which variable is missing.
• You may also wrap the servers in { "mcpServers": { ... } }, so a Claude Code configuration can be pasted as is.
• The following are not used, and the server is shown as not allowed with the reason:
  • command, args, env, or "type": "stdio" (servers the extension would have to start)
  • a url whose host is not on this PC (another PC, a LAN address, or an internet address)
• The extension does not follow redirects. It also checks that localhost resolves to this PC.

Open the list with the plug icon in the chat, or MCP servers in the ... menu of the chat view. It shows each server's status and tools. There you can turn a server or a single tool off, reconnect (for example after you start the server), and clear "always allow" choices. The list is updated as soon as you change the setting.

• Names: the AI sees a tool as mcp__<server>__<tool>.
• Approval: in Confirm and Semi-auto modes every call asks first, showing all the arguments (long arguments are folded; open them to read everything). You can allow the call once, always allow that tool, or always allow the server. In Auto mode calls run without asking. In Plan mode only the tools the server marks as read-only can be used.
• Tool definitions: they are adjusted to what the AI service accepts. A tool whose input cannot be adjusted is left out, and the reason is shown in the list. Every tool definition is sent with every message, so turn off tools you do not need. The list warns you when there are many.
• Results: text is passed to the AI. When a tool returns images, the first image is passed.

Files that may hold secrets

What the AI reads is sent to the server. To avoid sending secrets by accident, files whose name matches aigis-shield.sensitiveFiles are handled differently:

• They are left out of file search and text search. (Search also skips files ignored by .gitignore.)
• Reading one, comparing one, sending one to the AI Governance Gateway, or passing one to a command (cat .env) asks you, even in Auto mode. Allow this file in this conversation stops asking for the same file until the conversation ends.

A pattern without / is compared with the file name (* matches any text); a pattern with / (such as .aws/* or .docker/config.json) is compared with the end of the path, folders included. Samples ending in .example, .sample, .template, or .dist are not covered.

Content is checked too, whatever the file name: when a file the AI reads, a search result, a diff, the output of a command or script, or a file sent to the gateway contains something that looks like a secret (a private key, an AWS access key, a password in a connection string, or a common API key format such as GitHub, Slack, Stripe, OpenAI, Anthropic, or Google keys, or an .env-style API_KEY=... line), you are asked before it is passed to the AI, even in Auto mode. If you do not allow it, those parts are replaced with [REDACTED: ...]. Placeholders such as ${VAR}, <password>, or changeme are not treated as secrets.

This reduces accidents rather than enforcing a boundary.

The AI's file tools work only inside the folders you opened. A link (symbolic link or junction) inside the workspace that points outside it is not followed.

Attaching files

Attach files to the chat in any of these ways:

• Right-click a file in the Explorer and choose Attach to the AIGIS SHIELD chat.
• Right-click an editor tab and choose the same command.
• Run the command from the Command Palette to attach the current file.

Updates

When a new version is available, a notification appears after you sign in. Click Update to install it from the Marketplace, then Reload. If you choose Later, you will not be asked again for that version.

Troubleshooting

• Logs: Open the Output panel (View > Output) and select AIGIS SHIELD.
• Cannot connect: Run Reconnect. If that does not help, sign out and sign in again.