TokenGuard Copilot

AI Security Review

Evidence context: threat category none; evidence quality moderate.

TokenGuard Copilot exists to point VS Code Copilot Chat at OpenAI-compatible model endpoints, so outbound HTTP is the feature, not a side effect. Every network finding lives in the compiled entry point, extension/out/extension.js, as NET-FETCH-extension/out/extension.js-1, NET-FETCH-extension/out/extension.js-47, NET-FETCH-extension/out/extension.js-49 and NET-SOCKET_IO-extension/out/extension.js-44. A fetch call at the top of a bundle and a socket connection at line 44 are what a chat model provider looks like in practice: one HTTP client for the completion request, one streaming connection for the response tokens. No finding in this scan involves shell execution, child processes or install-time hooks.

On filesystem and process access, nothing turned up at the manifest level, and the listing declares no permissions and no endpoints. The 79 code-smell hits are all low severity and land on compiled output, which is where a bundler funnels several npm packages into one file. Those rules match generic Node patterns such as crypto, fs and process.env, so they describe the runtime the extension sits in rather than anything it chooses to do.

Credential findings: there are none in the secret category. Nothing reads .env files, .git/config, SSH keys or cloud credential stores, and nothing reaches into VS Code secret storage. That matters here because this extension does accept an API key you paste in, and the real question is where that key travels. The only outbound calls in the evidence are the ones the extension advertises, and no indicator-of-compromise hit names a domain that would route a key somewhere unexpected. With zero IoC entries, zero malware signatures and no obfuscation finding, the scan contains no artifact pointing at exfiltration.

The strongest argument against this call is the publisher name. The listing attributes the extension to AdGuard, a company known for ad blocking and DNS privacy products, while the extension itself is a model router for Copilot Chat. That mismatch is odd and worth flagging for anyone weighing the install. It does not change the conclusion, because a spoofed name only matters when the code backs it up, and here the code does the documented job: it fetches from the endpoint you configure. The other mild caveat is scale, 415 installs at version 1.7.0 is a small audience, so less community scrutiny than a mainstream extension draws.

A second counterargument is that any extension forwarding prompts, and whatever workspace context Copilot Chat attaches, to a third-party endpoint moves data off your machine. That is true, and it is the trade a user makes when installing a tool described in those exact words. Nothing in the findings shows it sends that data anywhere beyond the endpoint you set up.

Key Reasons

• All four network findings (NET-FETCH and NET-SOCKET_IO) sit in extension/out/extension.js and match the extension's stated purpose of calling OpenAI-compatible model endpoints
• No secret-category findings: no .env, .git/config, SSH key or cloud credential access anywhere in the scan
• Zero malware signatures, zero IoC matches, zero obfuscation findings and no tool-poisoning indicators
• The 79 remaining findings are low-severity code-smell rules firing on bundled build output, which is expected noise
• The extension declares no permissions and no endpoints, leaving the four NET-* titles as the only concrete signal

False Positive Considerations

• 79 low-severity code-smell matches on compiled extension/out/extension.js bundle output rather than hand-written source
• Network findings are fetch and socket calls that a chat model provider has to make, not unexplained callbacks
• Code-smell rules match generic Node.js patterns (crypto, fs, process.env) present in any bundled extension
• Empty permissions and network_endpoints arrays mean no declared capability supports a malicious reading

Reviewed 2026-10-11; recommended action: no action; model confidence 72%.