Model Context Protocol moderate risk

Bifrostmcp

Bifrost MCP exposes VSCode's language features to AI tools, enabling code navigation, analysis, and manipulation via an HTTP/SSE server.

Connections & Capabilities

Connects To

GitHub

Capabilities

readwrite

Quickstart

Config

{
  "mcpServers": {
    "Bifrost": {
      "command": "cmd",
      "args": [
        "/c",
        "npx",
        "-y",
        "supergateway",
        "--sse",
        "http://localhost:8008/sse"
      ],
      "disabled": false,
      "autoApprove": [],
      "timeout": 600
    }
  }
}

Exposed MCP Tools (19)

safe

find_usages

Locates all references to a specified symbol within the project.

Read-only operation; does not modify code.

safe

go_to_definition

Navigates to the definition of a symbol.

Read-only operation; does not modify code.

safe

find_implementations

Finds all implementations of an interface or abstract method.

Read-only operation; does not modify code.

safe

get_hover_info

Retrieves documentation and type information for a symbol.

Read-only operation; does not modify code.

safe

get_document_symbols

Lists all symbols within a document.

Read-only operation; does not modify code.

safe

get_completions

Provides context-aware code completion suggestions.

Read-only operation; suggests code but doesn't apply it.

safe

get_signature_help

Displays function parameter hints and overloads.

Read-only operation; provides information but doesn't modify code.

safe

get_rename_locations

Finds all locations where a symbol can be renamed.

Read-only operation; identifies locations but doesn't perform the rename.

moderate

rename

Renames a symbol across the project.

Modifies code by renaming symbols; requires careful review.

moderate

get_code_actions

Suggests quick fixes, refactors, and improvements.

Can modify code based on suggestions; requires review.

safe

get_semantic_tokens

Provides enhanced highlighting data for code.

Read-only operation; affects display but not code.

safe

get_call_hierarchy

Shows incoming and outgoing call relationships for a function.

Read-only operation; provides call information but doesn't modify code.

safe

get_type_hierarchy

Visualizes class and interface inheritance.

Read-only operation; provides type information but doesn't modify code.

safe

get_code_lens

Displays inline insights such as references and tests.

Read-only operation; provides information but doesn't modify code.

safe

get_selection_range

Expands code selection intelligently.

Read-only operation; helps select code but doesn't modify it.

safe

get_type_definition

Navigates to the definition of a type.

Read-only operation; does not modify code.

safe

get_declaration

Navigates to the declaration of a symbol.

Read-only operation; does not modify code.

safe

get_document_highlights

Highlights all occurrences of a symbol in the current document.

Read-only operation; does not modify code.

safe

get_workspace_symbols

Searches for symbols across the entire workspace.

Read-only operation; does not modify code.

Safety Assessment

Bifrost MCP is relatively safe for read-only operations like code analysis and navigation. However, the ability to perform code actions and refactoring introduces a moderate risk, especially if the AI assistant is not fully trusted or properly configured. Ensure proper network security and carefully review any proposed code changes.

Exposes VSCode's language server features, not direct file system access.
Requires explicit configuration to connect AI assistants.
Provides code analysis and navigation tools without direct execution capabilities.
Supports multiple project configurations for isolation.

Exposes an HTTP/SSE server, potentially vulnerable if not properly secured.
Allows code actions and refactoring, which can modify code.
Relies on the security of the underlying VSCode language extensions.
Misconfiguration could lead to unintended code modifications by AI assistants.