Siphrix — VS Code extension

Guards Claude Code with the Siphrix AI action firewall, and surfaces the local Siphrix daemon inside VS Code. It never executes an action — it wires the firewall in and shows its decisions.

One-click setup (start here)

Install this extension and run “Siphrix: Set Up Agent Firewall” (it is also offered automatically on first activation). One click:

1. finds a Python 3.11+ interpreter,
2. installs the Siphrix engine (from the wheel bundled in the .vsix, or from PyPI),
3. runs siphrix agent-setup — exports the active policy and configures every detected agent with what it supports: the enforcing PreToolUse hook for Claude Code, and the advisory Siphrix MCP registration for Codex (~/.codex/config.toml),
4. offers to open the live console.

From then on, every Claude Code tool call is evaluated by Siphrix before it runs: blocked calls are explained back to the model, and every decision is in the audit trail you can view below. Codex (when present) gains verdict tools it can consult before acting. No manual pip install, no editing settings.json, no environment variables. The button is a thin front door over the same siphrix agent-setup brain the Windows installer uses.

The rest of the extension is a thin, security-conscious client over the daemon's loopback HTTP API — it only shows the daemon's decisions.

A packaged .vsix is built from this tree (npx @vscode/vsce package). To install it locally without the Marketplace, see Install the .vsix locally below. To publish it to the VS Code Marketplace, see PUBLISHING.md.

What it gives you

• Status bar item — polls GET /health and shows whether the daemon is up ($(shield) Siphrix: up) or down ($(alert) Siphrix: down, with a hint to start it).
• Siphrix: Check Daemon Health — one-shot health check.
• Siphrix: Evaluate an Action — pick (or type) an action name, POST /evaluate, and see the verdict (ALLOW / BLOCK / …) with its reason and decision_id. Decision-only; nothing runs.
• Siphrix: Show Decision/Audit Trail — GET /audit, rendered into the Siphrix output channel.
• Siphrix: Block an Action (local rule) — pick an action type and a text to match, and the extension creates a local block rule via POST /rules. That rule governs every evaluation surface: the daemon's /evaluate, the Claude Code PreToolUse hook, and the MCP tools Codex consults — one rule store, one command center.
• Siphrix: Manage Local Block/Allow Rules — list local rules and switch each between BLOCK (enabled) and ALLOW (disabled) via PUT /rules/{id}, or delete it. Flip a rule here (or in the Web Console — same store) and the very next matching agent tool call obeys it.
• Siphrix: Pause / Resume Monitoring — pause the extension's health polling (the status bar shows a paused state). Honest scope: this pauses the extension; the daemon's rules still apply to integrated agents.
• Siphrix: Set / Clear Daemon Bearer Token — the bearer token is stored in VS Code SecretStorage, never in settings.json and never logged. /health is public, so the status bar works before a token is set; /evaluate and /audit require the token.

Settings

Build & run from source

cd tools/vscode_extension
npm install
npm run compile        # tsc -> out/extension.js

Then open tools/vscode_extension in VS Code and press F5 to launch an Extension Development Host with the extension loaded.

Start the daemon it talks to (in another terminal):

siphrix serve --foreground
# prints one local_daemon_ready_v1 JSON line, then serves on 127.0.0.1:8765

If /evaluate / /audit return "needs a bearer token", set one with Siphrix: Set Daemon Bearer Token (the token portion of your SIPHRIX_LOCAL_DAEMON_TOKENS entry).

Install the .vsix locally

Build the package, then install it into your editor — no Marketplace account required:

cd tools/vscode_extension
npm install
npx @vscode/vsce package --no-dependencies   # -> siphrix-vscode-0.1.0.vsix
code --install-extension siphrix-vscode-0.1.0.vsix

(Or in VS Code: Extensions panel → … menu → Install from VSIX… → pick the file.)

Posture

• Talks only to the loopback daemon URL you configure.
• Never executes an action — /evaluate is decision-only.
• The bearer token lives in SecretStorage; it is never written to settings, never logged, and never echoed.
• No telemetry, no external network calls.