Coconut for VS Code & Cursor
Bring your team's knowledge into every AI conversation.
Coconut is where your team curates the documents, briefs, and references your AI agents need to do their best work. This extension surfaces that knowledge directly inside VS Code and Cursor — one click to authenticate, one drag to give your agent fresh, authoritative context.
No more pasting links and hoping the model can read them. No more dumping stale snippets into prompts. Open the Coconut sidebar, pick the document, attach it.
Features
- One-click sign-in. OAuth 2.1 with PKCE through Coconut's MCP server — no API keys, no copy-and-pasted tokens. Credentials live in your OS keychain.
- CONTEXT sidebar. Browse your home-shared groups exactly the way they appear on app.coconut.dev. Expand a group to see its documents; click any document to read it as a Markdown preview right inside the editor.
- Drop documents into chat. Right-click any file and choose Copy as File — the document is materialized to a temp path and the path is on your clipboard, ready to paste into Cursor's chat as a real file attachment (not a wall of inline text).
- Multiple copy actions. Copy the document's URL, filename, or full Markdown contents — whichever shape your workflow needs.
- Per-group refresh. Hover any group for an inline refresh button; the rest of the tree stays exactly where you left it.
- Native look and feel. Built on VS Code's tree view and webview primitives. Inherits your theme. No custom UI surprises.
Quick start
- Install the extension and reload the window.
- Click the palm tree icon in the activity bar.
- Hit Connect — your browser opens to authorize, and you're back in the editor in seconds.
That's it. Your CONTEXT groups are loaded; documents are one click away.
If you don't have a Coconut workspace yet, hit Open Coconut on the welcome screen to create one at app.coconut.dev, or read more at coconut.dev.
Why this matters for AI agents
Coding agents are only as smart as the context you give them. Retrieval-augmented embeddings drift, generic web search hallucinates, and copy-paste loses provenance the moment you close the tab. Coconut is the opposite: a small, curated set of documents your team explicitly maintains as ground truth — product specs, API conventions, post-mortems, runbooks, customer summaries.
This extension shortens the path between that ground truth and your agent. Instead of context-switching to a browser, copying source, sanitizing it, pasting into chat, and praying the format survives, you:
- See your CONTEXT groups in the same sidebar where you keep your files.
- Open the document you want.
- Drag it (or Copy as File) into the chat.
The agent receives a real Markdown file, freshly fetched from the source, with structure preserved. You get an answer grounded in what your team actually wrote — not what some embedding index guessed last week.
Privacy & security
- OAuth 2.1 + PKCE with dynamic client registration. No long-lived API keys.
- OS keychain storage. Access tokens, refresh tokens, the registered client secret, and the PKCE verifier all live in
vscode.SecretStorage — your operating system's keychain — not in plaintext files.
- Loopback redirect only. The OAuth callback hits a single-use HTTP server on
127.0.0.1 that's reachable only from your own machine. RFC 8252 native-app conventions throughout.
- No telemetry. This extension makes calls only to the Coconut MCP server you authenticated against, and only when you request data.
- Disconnect anytime. The Disconnect command in the view title bar wipes every stored credential.
Settings
coconut.debug — log MCP and OAuth events to the "Coconut" output channel. Off by default; flip on when diagnosing connection or document-fetch issues.coconut.showCoconuts — show the COCONUTS section in the sidebar. Off by default while the section's features are still being built out.
Links
Develop
git clone <repo>
cd coconut-extension
npm install
npm run watch # incremental rebuilds
Press F5 to launch an Extension Development Host. Engineering notes — including the OAuth quirks, caching strategy, and tree provider lifecycle — live in AGENTS.md alongside the source.
License
MIT.
