Actifsource extension for Visual Studio Code

Table of Contents

Information on the Actifsource extension for Visual Studio Code in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex II.

Manufacturer

Item Value
Name Actifsource AG
Address Täfernstrasse 37, CH-5405 Baden-Dättwil, Switzerland
Email info@actifsource.com
Website https://www.actifsource.com
Report a vulnerability as described in the Coordinated Vulnerability Disclosure Policy

Product

Item Value
Name Actifsource extension for Visual Studio Code
Identifier Extension ID Actifsource.actifsource, version per release
Source Visual Studio Marketplace

Intended purpose

The extension is the user interface of Actifsource in Visual Studio Code. It connects Visual Studio Code to an Actifsource server. The model and code generation reside on the server side. The extension does not store any models, only its settings and the labels of opened resources in the Visual Studio Code settings. It is intended for developers in companies who model and generate code with Actifsource.

Security properties:

  • The extension does not establish any connections to the internet and does not send any telemetry.
  • Error reports are only sent after confirmation by the user and only to the connected Actifsource server.
  • The extension does not start any processes and does not load any code at runtime.

Risks

The following circumstances may lead to significant cybersecurity risks:

  • Insecure network: The connection between the extension and the Actifsource server is neither encrypted nor authenticated. Run the server on the same machine or in a trusted network. The operator is responsible for network security, certificates and access control.
  • Third-party workspaces: A .vscode/settings.json file in a third-party repository can change the host and port of the server. In Visual Studio Code, only trust workspaces from known sources.
  • Older versions: Older versions from the Marketplace do not receive security updates and may contain known vulnerabilities.

Secure use

Topic Guidance
Initial commissioning Run the server on localhost or in a trusted network.
Changes to the product Host and port determine which server the extension connects to. Changing them affects the security of the connection.
Security updates Visual Studio Code installs new versions from the Marketplace automatically. Manually: “Extensions” view, “Actifsource”, “Update”.
Turning off automatic updates In Visual Studio Code, globally under Settings, “Extensions: Auto Update”, or per extension in the extension’s context menu. We recommend leaving it turned on.
Decommissioning Before uninstalling, select “Disable Actifsource MCP” in the status bar in every workspace in which Actifsource MCP is enabled. This removes the entry from ~/.claude.json. Then uninstall the extension in the “Extensions” view. Visual Studio Code does not remove any settings when doing so. Delete manually: all actifsource.* settings in the user and workspace settings, including the email address in actifsource.user.mail; in workbench.editor.customLabels.patterns, the entries with paths to .asr files (labels of opened resources); the backup copy ~/.claude.json.bak, if present. Model data resides on the server.

Support period

Each version receives security updates for five years after its release. Security updates are free of charge, either as a patch for your version or as the latest version. With a maintenance contract you also receive new versions with new features and their support period.

EU declaration of conformity

Hereby, Actifsource AG declares that the product with digital elements type Actifsource extension for Visual Studio Code is in compliance with Regulation (EU) 2024/2847. The full text of the EU declaration of conformity is available at the following internet address: https://www.actifsource.com/documentation/manual/security/30-product-information/10-vscode-extension/10-declaration-of-conformity/