PromptFlowEngine for VS Code

Codebase → Prompt → Codebase. Turn your code and a task into a structured engineering prompt, send it to AI chat behind a privacy guard, and review the changes that come back.

The analysis, restructuring, and privacy detectors come from the shared engine and MCP server packages, the same code that powers promptflowengine.com, the Chrome extension, the CLI, and the HTTP API. Everything runs in-process: no external server and no model calls.

Install it from the Visual Studio Marketplace or with code --install-extension promptflow-ai.ide-extension.

See CHANGELOG.md for what changed in 2.2 and docs/MCP_ARCHITECTURE.md for the tool contracts.

The workflow

CODEBASE   pick a scope: workspace, current file, chosen files, or none
   ↓
PROMPT     describe the task; the engine structures it and grounds it in the code
   ↓
AI         send to VS Code Chat (privacy guard first), copy, or save
   ↓
CODEBASE   review changes in Source Control, or build a review prompt from the modified files

Open the PromptFlowEngine icon in the Activity Bar. The panel has the four steps in order.

1. Codebase. Files are filtered (no node_modules, build output, binaries), scored for relevance to the task, and capped, so the prompt carries a handful of relevant files.
2. Prompt. Generate prompt produces role, objective, project context, the relevant code, requirements, constraints, edge cases, testing, acceptance criteria, and expected output. Sections appear only when the task needs them. The panel shows how many lines came from your task, the codebase, and added engineering guidance, and the prompt stays editable.
3. AI. Send to AI Chat opens the prompt in VS Code Chat, falling back to the clipboard. The privacy guard scans for credentials and personal data first (strict blocks, redact replaces with placeholders, warn asks). Reduce tokens applies verified, meaning-preserving cleanup.
4. Codebase. Review changes opens Source Control. Build review prompt reads the files with uncommitted changes (through the built-in Git extension, read-only) and generates a prompt that checks them against your task.

Commands

Analyze Prompt writes the quality score, token count, estimated input cost, the date the price was verified, and each issue with its reason and fix to the PromptFlowEngine output channel. The status bar item shows the last prompt's quality and token count and opens the panel.

Restructure, Analyze, Insert Prompt Template, Send, Scan Selection, and Redact are also in the editor context menu under PromptFlowEngine.

Sensitive-data protection

Every prompt the extension hands to AI chat (Send Prompt to AI Chat and the panel's send button) goes through one on-device check first. promptflow.privacy.mode decides what happens when it finds credentials or personal data. redact (the default) replaces the values with placeholders such as [REDACTED_PASSWORD] and sends the rest. warn asks first. strict does not send. When this editor is connected to an organization, its policy applies instead. If the check itself fails, nothing is sent.

What the extension cannot see: prompts you type into other extensions' chat boxes (GitHub Copilot Chat, Continue, Cursor), and files an assistant attaches as context. For agents that run a command before each prompt (Claude Code, Cursor, Windsurf, Copilot agent sessions, Gemini CLI), Install Agent Hooks adds the same check there. For open files, exposure warnings flag credentials. Use Scan Selection on any text before you paste it elsewhere. What is detected, and its limits: docs/SENSITIVE_DATA_DETECTION.md.

Protection Dashboard

Show Protection Dashboard shows:

• prompts scanned, with and without findings
• findings by category
• outcomes: warned, redacted, blocked, cancelled, and handed off
• a 14-day trend and where scans came from
• the policy and detector version in force, and the last scan time

Each outcome is defined on the page. Handed off means VS Code put the prompt, as checked, into the Chat view or on the clipboard. It is never counted as submitted, because VS Code does not confirm that an assistant received it.

The dashboard keeps daily counts only: no prompt text, values, excerpts, file names, or paths. They are stored in VS Code's storage on this machine and profile, are not synchronized, and are kept for 90 days. They work offline and are never uploaded. Turn counting off with promptflow.dashboard.metrics, and delete the counts with Reset Protection Metrics. With protection turned off, prompts are not scanned and are not counted.

Keyboard shortcuts

Chords under Ctrl+Alt+P (Cmd+Alt+P on macOS), so no single shortcut is taken:

Activity history and account (optional)

Both are off until you choose them, and neither is needed for any feature.

• PromptFlowEngine: Turn On Activity History shows what is recorded and asks for consent. Records (time, event, sensitive-data categories and counts, action, quality scores) stay in VS Code's local storage on this machine and are never synchronized or uploaded. A prompt placed in AI chat is recorded as placed in chat or clipboard, never as submitted. Prompt text is kept only after Turn Prompt Text in History On or Off and a second warning, with detected secrets replaced.
• Show Activity History (search, open, delete), Export Activity History (CSV or JSON), Delete Activity History, Pause or Resume, Set Activity History Retention (default 30 days).
• Sign in from the Account & Activity view in the PromptFlowEngine sidebar (or the account item in the status bar, or PromptFlowEngine: Sign In): your email, then a 6-digit code (no password; the first sign-in creates the account). The token is kept in VS Code's SecretStorage. The view also shows offline and expired states and offers sign out and account deletion. The setting promptflow.account.server chooses the server.

Details: docs/ACCOUNTS_AND_LOCAL_ACTIVITY.md.

Models and cost

Token counts and cost estimates use the platform's model catalog, the same one promptflowengine.com/docs/models shows. Choose a model with Select Model for Tokens and Cost or the promptflow.model setting; the panel's own model list can override it for one prompt. Counts are exact where the provider publishes its tokenizer and labeled approximate otherwise. Prices are list prices with the date each was verified; a model without a reference price shows no cost rather than a guess. The catalog is built into the extension, so prices are as current as the installed version.

Copilot agent mode

On activation the extension writes a .vscode/mcp.json entry (if the workspace has none) so GitHub Copilot Agent mode can call the same tools over a bundled standalone MCP server (node dist/mcp-server.js, see src/mcpServerEntry.ts). This is the one part that needs an external process and node on PATH. The panel and commands call the engine in-process.

Compatibility

Requires VS Code 1.85 or later; tested in the extension host against current VS Code stable. Versions 2.2 and 2.5 add commands and one setting each and remove nothing.

Version 2.1 renamed the product to PromptFlowEngine and removed the separate Optimize view and the promptflow.optimize command. Kept unchanged so existing installs and configuration carry over: the extension id (promptflow-ai.ide-extension), every promptflow.* setting, the other command ids, and the promptflow MCP server entry.

Contributing

See CONTRIBUTING.md for local setup, build, and test scripts.