Local VS Code diagnostics that flag Play/security foot-guns in AndroidManifest.xmlbefore you ship — exported components, debuggable, cleartext traffic, and loose backup settings.
Not a snippet pack. Peer Marketplace listings insert uses-permission text; Manifest Guard audits risky attributes into the Problems panel.
Runs fully offline. No network, no telemetry, no accounts.
60-second win
Open an AndroidManifest.xml with android:exported="true" and no permission, or android:debuggable="true".
Open Problems — see MG001 / MG002 / MG003 / MG004.
Fix the attribute → diagnostics clear on save.
Optional: Manifest Guard: Rescan Workspace from the Command Palette, or click the status bar when a Manifest is focused.
Rules (v1)
Code
Check
Severity
Fix
MG001
Component android:exported="true" without android:permission (activity / service / receiver)
Warning
Add a protecting permission, or set exported="false" if the entry point is not needed
MG002
android:debuggable="true" on <application> or a component
Error
Remove debuggable from the release Manifest (quick-fix available)
MG003
android:usesCleartextTraffic="true"
Warning
Prefer network security config, or set false
MG004
android:allowBackup="true" without fullBackupContent / dataExtractionRules
Warning
Add backup/extraction rules, or set allowBackup="false"
Settings
Setting
Purpose
manifestGuard.include
Globs to find Manifests (default **/AndroidManifest.xml)
manifestGuard.exclude
Skip build/merged Manifests (**/build/**, etc.)
manifestGuard.rules.MG00N.enabled
Turn a rule on/off
manifestGuard.rules.MG00N.severity
Override severity (default keeps the rule default)
