Enforce AI policy in VS Code, Cursor and Windsurf

The Shield360 extension for VS Code, Cursor and Windsurf follows your organisation’s AI policy in the editor. Once it is connected, it:

• warns developers about installed AI extensions (GitHub Copilot, Cline, Continue and others) that the AI tools policy warns about or blocks, and reports them as guard decisions
• flags MCP servers in the workspace that are not on your organisation’s approved list, with a quick fix that opens a pre-filled AI request
• checks model calls in code against your organisation’s approved models instead of a local list
• shows in Fleet as an IDE, with its last check-in

Caution

A VS Code extension cannot see or stop another extension’s network traffic. The Shield360 extension does not intercept GitHub Copilot, Cursor chat or Windsurf requests, and it cannot uninstall or disable other extensions. Use it for configuration and for what developers see. Blocking comes from two other places:

• AI extensions: VS Code’s own enterprise policy, AllowedExtensions, which Shield360 generates from your AI tools policy (see Block AI extensions).
• AI traffic from coding tools: the collector’s coding-agent hooks on the developer’s machine.

Prerequisites

• The Shield360 extension installed in VS Code, Cursor or Windsurf (from its .vsix; see ide/vscode/README.md in the repository).
• An install key, or permission to create connection codes, under Settings → Collection & deployment.
• An AI tools policy under Govern → Policies & rules → AI tools. See Enforcement policy.

Connect the extension

The extension enrols as a device of kind ide, the same way the browser extension does. Either way, it gets its own device token, which it keeps in the editor’s secret storage. The token is never written to settings.json, and you can revoke it from Fleet.

Device management

Open Settings → Collection & deployment → IDE extension, create or rotate the install key, and copy the settings it shows into the user settings.json on developers’ machines:

{
  "shield360.enforcement.url": "https://app.shield360.ai",
  "shield360.enforcement.installKey": "s360i_…"
}

Both settings are machine-scoped, so a workspace’s .vscode/settings.json cannot change them. When the extension starts, it exchanges the install key for its own token. If the token is revoked, it enrols again with the key. A developer cannot disconnect an editor that is managed this way.

Connection code

For an editor without device management, open Settings → Collection & deployment → IDE extension and choose Create connection code. In the editor, run Shield360: Connect this editor with a connection code from the command palette, then enter the Shield360 address and the code. Each code connects one editor and is valid for ten minutes.

A developer can disconnect an editor connected this way, or disable the extension.

The extension reads its policy when it starts and every 15 minutes after that (GET /api/collector/device/policy, with the device token in x-shield360-collector-token). Each read counts as a check-in, so it updates the device’s Last seen in Fleet.

The project API key used by Shield360: Connect to Shield360… is separate. It brings in prices, agent activity and the Prompt Hub. It plays no part in enforcement.

What the extension enforces

AI extensions

The extension matches installed extensions against the AI extensions the collector recognises, using the same list as the AI software inventory. It looks up each one by vendor in the AI tools policy: the vendor’s own entry, then the default, then Allow.

Policy	In the editor
Block	An error each time the editor starts, and whenever the set of blocked extensions changes. It names the extensions and offers to show them in the Extensions view. It has no “don’t show again” option, and the status bar item turns red.
Warn	A one-time notice for each extension and policy version.
Allow	Nothing.

Blocked and warned extensions are reported once per session to POST /api/collector/device/events as guard decisions. A decision carries shield360.guard.name ai-tools, target tool, the extension ID as the client, and the editor as the tool. Shield360 records the decision’s source as coding_agent, so these decisions appear in Violations under coding agents. They carry no code and no content.

MCP servers

The extension reads .vscode/mcp.json, .cursor/mcp.json and .mcp.json in each workspace folder. A server counts as approved when any of these is true:

• It is the Shield360 MCP gateway (<your Shield360 address>/api/mcp).
• Its URL host matches the host of an MCP server registered in the agent gateway (Agent access → Resources).
• Its name matches the name or slug of a registered MCP server.

Every other server gets a warning in the Problems panel, with two quick fixes:

• Ask for approval in Shield360 opens Govern → Compliance program → AI requests with an MCP server request pre-filled.
• Add the Shield360 MCP gateway to this workspace routes the workspace’s tools through the gateway.

The approved list comes from GET /api/collector/device/mcp-servers, read with the device token from the device’s own environment. Only each server’s name, slug and host are returned, never its URL or credentials. If your organisation has no registered MCP servers, nothing is flagged. If the list cannot be read, the extension keeps the last list it had.

Approved models

When the device policy carries approved models (the approved-model list is on, and the enforcement policy warns or blocks outside it), the editor checks model calls in code (rule S360-LLM-005) against that list instead of the shield360.approvedModels setting:

• A model from a provider that is not on the list is flagged.
• If the list names models, a model that matches none of them is flagged. * matches any characters.

If your organisation checks no models, the setting applies.

When the policy cannot be read

The extension keeps the last policy it read, without the fingerprint key, which it does not use. If it has not read a fresh policy for 24 hours, what happens depends on the fail-closed setting under Govern → Policies & rules → Sensitive data:

• Fail closed on: every AI extension is treated as blocked until a policy arrives.
• Fail closed off: the last policy keeps applying.

The status bar shows the policy version, the number of issues and whether the policy is out of date. Shield360: Show what is enforced in this editor lists everything in one place.

Block AI extensions

Settings → Collection & deployment → IDE extension → Block AI extensions in VS Code generates VS Code’s AllowedExtensions policy (the extensions.allowed setting, VS Code 1.96 and later) from the environment’s AI tools policy. The policy allows every extension ("*": true) and sets each AI extension whose vendor is blocked to false. VS Code disables those extensions and refuses to install them.

The card gives the policy in three forms:

• a .reg file for Group Policy or Intune (HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\VSCode, value AllowedExtensions)
• the com.microsoft.VSCode payload for a macOS configuration profile
• the setting for settings.json, for machines without device management or for dev containers

The same output is available as JSON for scripting. The route needs a signed-in user with collector read access and uses the user’s current environment:

GET /api/collector/ide-policy

The policy does not update itself. Push it again when you change the AI tools policy. Cursor and Windsurf are built on VS Code but do not all honour its policies. The Shield360 extension warns in all three either way.

Next steps

Fleet

See enrolled editors, their last check-in, and revoke them.

Enforcement policy

Set what is blocked or warned about for each AI tool.

Coding agents

Block AI traffic from coding tools with the collector’s hooks.