Proxy-1 AI

Proxy-1 AI connects VS Code to Proxy-1 for code questions, reviewed edits and security investigations.

License and support

Copyright (c) 2026 PROXIMUS Research Labs Foundation. Proxy-1 AI uses the proprietary Proxy-1 AI Source-Available License 1.0 included in LICENSE. Source recipients may inspect and audit it, including private copies and isolated local testing for that review. Official unmodified builds may be used for personal work or internal business work with authorized Proximus accounts.

Reusing the code in another product, redistributing or rebranding the extension, selling modified versions, and offering it as a hosted service require separate written permission. This is not an open-source license. Third-party licenses and mandatory legal rights remain unaffected. The full LICENSE controls.

Contact hello@proximus.sh for support, security reports and licensing requests. Hosted Proxy-1 access and credits remain subject to the applicable Proximus service terms.

Requirements

• VS Code 1.96 or later on macOS, Windows or Linux.
• A Proximus account with approved Proxy-1 access and active access purchased with credits.
• A personal Proximus API key with assistant:read and assistant:write scopes.
• A Proxy-1 feature grant for both your user account and the API key in Access permissions.
• A trusted, single-folder local workspace for file access, edits and commands.

Installation

Open Proxy-1 AI in the Visual Studio Marketplace and select Install. You can also open Extensions in VS Code, search for Proxy-1 AI and choose the extension published by PROXIMUS Research Labs Foundation.

Alternatively:

code --install-extension proximus.proximus-1k

Open Proxy-1 AI in the activity bar. Choose Connect API key. Create a key at Build - API keys if needed. Configure Proxy-1 grants in Access permissions, then activate access in the Proxy-1 dashboard.

Modes

Code and Security use a bounded agent loop with up to eight steps per message. Results feed back into the next model request. Each file edit opens a VS Code diff and requires approval. Each command displays its full text and requires approval before execution.

The extension is not a sandbox. Approved commands run on your computer with your user permissions. Commands stop after 60 seconds and captured output is limited to 24 KB. Interactive commands and persistent development servers should be run manually in your terminal.

Context and changes

Use Attach selection or file from the editor context menu or the attachment button. Select lines first to share a smaller excerpt. Up to four attachments can be selected, subject to a 48 KB total message limit. Credential paths, binary files, parent-directory traversal and symlink escapes are rejected. Automatic reads are limited to the trusted workspace.

Edits require one unique match in the current file. The extension checks for changes made during review before applying. Changes remain in the editor for you to save and can be undone with VS Code. Save files before approving commands that test them from disk. New files require an existing parent directory.

Workspace references

Type @ in the composer or click the @ button. Choose Findings, Pentests, Cases or Evidence, then search by title or paste an ID. Select a record to attach it to your next message.

The API key needs the optional workspace:read scope. The key owner's current role must also allow the record type, such as pentests.read, cases.read or evidence.read. Searches use the key's workspace and environment. Cases are workspace-wide, while linked evidence remains environment-specific.

A finding includes its saved evidence. A pentest includes its associated findings. A case includes linked evidence when your role permits it. Up to three references can be attached. Large records are explicitly marked as excerpts, with source URLs. Context is rechecked on the server when sending. Selecting a reference does not execute tests, apply a fix or change its status.

Account and billing

The extension is free to install. One Proximus credit costs US$0.10. This version uses your existing Proxy-1 access pass and does not purchase access or deduct an additional per-message fee. The server returns the current access quote. At implementation time, that quote is 720 credits per 24 hours, equivalent to US$72. Review the current dashboard price before activating access.

Data handling

• API keys use VS Code SecretStorage, never workspace settings or webview state.
• Requests go to https://api.proximus.sh/v1/assistant. Redirects are rejected and workspaces cannot change the destination.
• Messages, attached code and tool results are sent to Proximus. Server conversations are private to the key owner, marked source=vscode and excluded from the app's Proxy-1 chat history.
• Local conversation history is stored in VS Code workspace state, separately for each API key. It is limited to the latest 60 entries. Clear Local Conversation clears the current local history and archives its server conversation. It does not erase server records. Server records remain subject to the platform retention policy.
• Disconnect removes the stored API key. Revoke the key in the dashboard to terminate its access everywhere.
• Common credential formats are redacted as a precaution. Review context and command output before sharing confidential information. Redaction is not exhaustive.
• No separate extension telemetry is collected.

API reference

All endpoints require Authorization: Bearer <key> and return JSON with Cache-Control: private, no-store.

IDs must be UUIDs. Retrying the same request ID and identical input is idempotent. Reusing an ID with different input returns 409. IDs are namespaced to the API key, so other keys and dashboard identifiers cannot address these conversations. Existing platform rate limits, access eligibility, active-chat limits and paid-access rules still apply.

Replies update by polling the run approximately every 2.5 seconds. There is no invented token-rate indicator or simulated stream. Maximum output is 2,048 tokens per model step. Server message limits currently allow six new runs per minute, so long agent loops may require a pause and continuation.

Development

npm ci
npm test
npm run package

Run the extension in an isolated VS Code Extension Development Host using --extensionDevelopmentPath pointing to this directory. Screenshots are captured from the actual extension in a test host using an illustrative project and controlled account/message fixtures. They do not represent a live model benchmark.

Source inspection and local test builds are subject to LICENSE. Publication, redistribution and operational use of modified builds require separate written permission.

Maintainers can find release instructions in PUBLISHING.md, pricing research in PRICING.md, and backend requirements in BACKEND.md. These internal documents are excluded from the extension package.