VS Code reaches MCP servers through a third-party extension. The three most common options are Cline, Continue, and GitHub Copilot Chat. This guide targets Cline since its config file is the closest to the Cursor and Claude Desktop schema and the flow ports cleanly to Continue with a minor field rename.
The current CLI package accepts Node.js 22.22.2 through 22.x, 24.15.0 through 24.x, or 26 and later. You also need a current VS Code MCP-capable client or extension installed. Review the generation report before configuring VS Code: built-in checks run locally, while external scanner coverage depends on installed binaries and the supplied source metadata.
The exact path depends on which MCP extension you use. Cline reads a workspace-scoped file by default. The current @smeltsec/sync writer targets ~/.vscode/mcp.json; it does not write every extension-specific user-data path shown below.
Verify these paths against the extension's current docs; storage locations shift between releases. The project-scoped .vscode/mcp.json path is the most stable option and survives workspace moves.
The public npm release is 0.1.0. Pin that version so the commands in this guide match your installed CLI. Review its package files and dependencies before installation.
npm install -g @smeltsec/cli@0.1.0 smeltsec --version
The version check prints the build hash. If the command is not found, fix your npm prefix before moving on; VS Code extensions spawn node with a minimal PATH and will not find anything outside well-known bin directories.
smeltsec init interactively scaffolds the project and asks for an output directory. smeltsec ci evaluates that directory against configured security and quality thresholds.
smeltsec init smeltsec ci ./my-server --output ./my-server/smeltsec-ci.json cd my-server npm run build
Copy the absolute path to dist/server.js. VS Code extensions do not resolve relative paths reliably because the extension host's working directory is not your workspace.
For Cline, the schema is the mcpServers object keyed by name. Continue uses the same keys but nests them inside the top-level config.yaml. Here is the Cline JSON block.
{
"mcpServers": {
"my-server": {
"command": "node",
"args": ["/Users/you/projects/my-server/dist/server.js"],
"env": {
"API_KEY": "sk-..."
},
"disabled": false
}
}
}The disabled flag is Cline-specific; it lets you keep the entry in source control while turning the server off temporarily. Commit this file to the repo so every contributor gets the same server list.
Run Developer: Reload Window from the command palette. Open the Cline sidebar. Click the MCP Servers section. Your server should show a green status and a tool count greater than zero.
Send a chat message that calls one tool by name. Cline approves or asks, depending on your per-tool approval setting. If the tool is not offered, the list did not refresh; right-click the server and pick Refresh Tools to force a new tools/list call.
Your .vscode/mcp.json has a JSON error. Open it, run jq . on the file, and fix the syntax. Reload the window. Cline logs parse errors silently, so a trailing comma can vanish your whole config.
Open the Cline output channel from View > Output and pick Cline from the dropdown. The stderr tail shows the crash reason. A missing env var or a wrong node path is usually the cause.
VS Code on macOS launched from Spotlight has a minimal PATH. Replace "node" in the command field with the absolute path from which node. For nvm users, use the full .nvm/versions/node path so VS Code does not need to read your shell rc.
VS Code caches the parse result until the window reloads. Save the file, then run Developer: Reload Window. Cline also exposes a Refresh MCP Servers action in its sidebar menu that reloads without restarting the whole editor.
Free tier includes Gate 1 scanning and 5 generations per month.