Actifsource extension for Visual Studio Code
Table of Contents
Information on the Actifsource extension for Visual Studio Code in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex II.
Manufacturer
| Item | Value |
|---|---|
| Name | Actifsource AG |
| Address | Täfernstrasse 37, CH-5405 Baden-Dättwil, Switzerland |
| info@actifsource.com | |
| Website | https://www.actifsource.com |
| Report a vulnerability | as described in the Coordinated Vulnerability Disclosure Policy |
Product
| Item | Value |
|---|---|
| Name | Actifsource extension for Visual Studio Code |
| Identifier | Extension ID Actifsource.actifsource, version per release |
| Source | Visual Studio Marketplace |
Intended purpose
The extension is the user interface of Actifsource in Visual Studio Code. It connects Visual Studio Code to an Actifsource server. The model and code generation reside on the server side. The extension does not store any models, only its settings and the labels of opened resources in the Visual Studio Code settings. It is intended for developers in companies who model and generate code with Actifsource.
Security properties:
- The extension does not establish any connections to the internet and does not send any telemetry.
- Error reports are only sent after confirmation by the user and only to the connected Actifsource server.
- The extension does not start any processes and does not load any code at runtime.
Risks
The following circumstances may lead to significant cybersecurity risks:
- Insecure network: The connection between the extension and the Actifsource server is neither encrypted nor authenticated. Run the server on the same machine or in a trusted network. The operator is responsible for network security, certificates and access control.
- Third-party workspaces: A
.vscode/settings.jsonfile in a third-party repository can change the host and port of the server. In Visual Studio Code, only trust workspaces from known sources. - Older versions: Older versions from the Marketplace do not receive security updates and may contain known vulnerabilities.
Secure use
| Topic | Guidance |
|---|---|
| Initial commissioning | Run the server on localhost or in a trusted network. |
| Changes to the product | Host and port determine which server the extension connects to. Changing them affects the security of the connection. |
| Security updates | Visual Studio Code installs new versions from the Marketplace automatically. Manually: “Extensions” view, “Actifsource”, “Update”. |
| Turning off automatic updates | In Visual Studio Code, globally under Settings, “Extensions: Auto Update”, or per extension in the extension’s context menu. We recommend leaving it turned on. |
| Decommissioning | Before uninstalling, select “Disable Actifsource MCP” in the status bar in every workspace in which Actifsource MCP is enabled. This removes the entry from ~/.claude.json. Then uninstall the extension in the “Extensions” view. Visual Studio Code does not remove any settings when doing so. Delete manually: all actifsource.* settings in the user and workspace settings, including the email address in actifsource.user.mail; in workbench.editor.customLabels.patterns, the entries with paths to .asr files (labels of opened resources); the backup copy ~/.claude.json.bak, if present. Model data resides on the server. |
Support period
Each version receives security updates for five years after its release. Security updates are free of charge, either as a patch for your version or as the latest version. With a maintenance contract you also receive new versions with new features and their support period.
EU declaration of conformity
Hereby, Actifsource AG declares that the product with digital elements type Actifsource extension for Visual Studio Code is in compliance with Regulation (EU) 2024/2847. The full text of the EU declaration of conformity is available at the following internet address: https://www.actifsource.com/documentation/manual/security/30-product-information/10-vscode-extension/10-declaration-of-conformity/
