AIMO — Pooled AI for VS Code

An in-editor coding agent on your organisation's Bosphorus platform. AIMO chats with the models you are permitted, reads and edits your workspace, runs commands, reaches the platform's tool servers, and keeps your secrets in your own vault — asking before it changes anything, and handing your secrets to commands and tools rather than to the model.

Every request is yours: it is signed in as you, counted against your quota and rate limits, checked by your organisation's policies, and listed on the platform's activity and usage pages under your name.

AIMO needs a Bosphorus installation to talk to. Without one there is nothing for it to sign in to. Installation guide and downloads: https://bosphorus.morten.com.tr/workspaces/aimo-for-vs-code/

Before you start

• VS Code 1.85 or later.
• Your organisation's gateway address, for example https://ai.corp.example. Your administrator gives it to you.
• Your corporate account on the identity provider the platform uses.
• A network path to the gateway. On many installations it answers only on the company network or over VPN.

Connect to your gateway

Run AIMO: Set Gateway URL from the Command Palette and enter the address your administrator gave you. Nothing else works until this is set. The address is kept in your own user settings; a repository's settings cannot change it.

Sign in

AIMO signs you in with the identity provider the platform itself uses — Microsoft Entra ID on some installations, an OpenID Connect provider such as Keycloak on others. It learns which from the gateway, so there is nothing more to configure.

1. Run AIMO: Sign in. A short code is copied to your clipboard and the sign-in page opens.
2. Paste the code and finish the sign-in in the browser.
3. AIMO exchanges that sign-in for your own platform key and keeps it in VS Code's secret storage.

Signing in on a second machine rotates the key; the first machine gets a new one by itself on its next request. AIMO: Sign out removes the key from this machine.

Chat

Images

Up to five images go with one message, each shown as a thumbnail above the message box; an image on its own is a message. Each is scaled to at most 1568 px on its long edge before it is sent, so a full-screen screenshot costs about 1,700 tokens of the model's window.

• The model has to be able to see. Select Model marks the models the gateway confirms as vision. Sent to a model that is not confirmed, the image goes anyway with a one-time notice; if the model refuses it, the image is attached again so you can pick another model and send.
• Dropping onto the chat needs Shift held while you drop. Files from the Explorer get the same checks as + File.
• Screenshot (macOS) runs the system capture tool: drag a region, Space for a window, Esc to cancel. macOS may ask you to allow VS Code under System Settings ▸ Privacy & Security ▸ Screen Recording. Elsewhere, paste a screenshot.
• Images are not kept with a stored chat — only thumbnails.

Type / in the message box for the commands: /new, /model, /tools, /vault, /compact, /undo, /history, /tab, /chats, /clear, /status, /help.

Shortcuts: Ctrl+Alt+A (macOS Ctrl+Cmd+A) opens the chat, Ctrl+Alt+L (macOS Ctrl+Cmd+L) adds the selection to it. In the message box, Enter sends, Shift+Enter starts a new line, ↑ recalls your last message and Esc stops an answer.

What the agent can do

Every file path is contained to the workspace folder, judged by where it points: a link inside the workspace that leads out of it is outside. Stopping a turn, or a command's timeout, ends the command and everything it started.

Files that usually hold credentials — .env, private keys, cluster credentials, *.tfvars, secrets.yaml and the like — are read only after you agree, and a search that matches inside one says so without showing the line.

Models and the context window

Leave aimo.model empty and AIMO uses the model the platform recommends for you. AIMO: Select Model lists every model you may use with what it is confirmed to do and the size of its context window.

AIMO sizes every request to the model's window before sending it. When a conversation outgrows the window, older tool output is shortened first, then whole older turns are dropped; a notice tells you when that happened, and the gauge under the message box shows how full the window is.

Tool servers

The platform's MCP tool servers reach you through the gateway's governed relay. AIMO never learns a server's address or credentials.

• On demand is how every server works unless you decide otherwise. The model is given three small tools — list the servers, search for a tool, call a tool — and looks up what it needs. The size of the registry costs nothing.
• Pinned servers load their tools into every request. Pin the one or two you use all day with AIMO: Choose Tool Servers, which shows what each costs.

Vault

Where your installation keeps people's keys in OpenBao, AIMO works with your own vault there. It hands values to your tools, terminals and commands, and never puts one in a chat, a log or a stored conversation.

• AIMO Vault: Sign in to the Vault opens your browser at the identity provider and comes back to http://localhost:8250.
• Tool-server variables: a tool server that needs something of yours — an API key, a token — reads it from your vault on every call you make to it.
• Workspace vault variables (aimo.vault.env) map environment variables to places in the vault. The mapping holds references, not values, so it can be committed and every developer gets their own value. The model is told the names; a value a command prints as it is reaches the model as [vault:NAME].

The vault address is derived from the gateway address. Set aimo.vault.address if yours is elsewhere.

Settings

Settings marked user can be set in your own settings only. A repository's .vscode/settings.json cannot set them, so opening a project cannot redirect your sign-in, your key or your secrets, or switch the approvals off.

Troubleshooting