Skip to main content
← Back

Extensions

Cherri Code uses the Open VSX extension registry for third-party extensions, with Cherri Code's marketplace proxy applying automated malware and supply-chain analysis before extensions are offered for install. Many popular VS Code extensions are available; some Microsoft Marketplace-only extensions are replaced by audited Cherri Code builds.

How do I install an extension?

  1. Open the Extensions panel:
    • Mac: Press CmdCtrl + Shift + X
    • Windows/Linux: Press Ctrl + Shift + X
  2. Search for the extension you want
  3. Click Install

The extension activates immediately.

Do all VS Code extensions work?

Cherri Code uses Open VSX for third-party extensions.

What that means for you:

  • Most popular extensions are available on Open VSX, but not every Microsoft Marketplace extension is listed there.
  • The same publisher.extension name can point to different publishers or code on Open VSX than on the Microsoft Marketplace. Treat extension IDs like dependencies: install from publishers you trust.
  • Cherri Code publishes first-party Cherri Code replacements for some widely used extensions that are unavailable on Open VSX.

How Cherri Code reduces supply-chain risk:

Cherri Code routes extension search and downloads through its own marketplace proxy (marketplace.cursorapi.com), not a direct passthrough to Open VSX. Before an extension is shown in search or served as a download, Cherri Code runs automated malware and supply-chain analysis using commercial security tooling. Extensions that fail review are blocked. Cherri Code also monitors extension-ecosystem threat intelligence and updates its blocklist over time.

Publisher verification, enterprise allowlists, optional signature verification, and install cooldowns (below) add further layers. No single control replaces the others.

Enterprise and team extension controls

If you manage Cherri Code for a team, you can add defense in depth on top of Cherri Code's marketplace analysis.

Marketplace Install Cooldown

Team admins can defer extension installs and updates until a marketplace version has been published for a minimum number of hours. This gives a buffer against short-lived malicious uploads.

  • Where to configure: Team settings → Security & automation → Marketplace Install Cooldown (hours)
  • Who can configure: Team owners and admins
  • Default: 0 (disabled). Set the number of hours to a value your organization accepts based on its risk posture.
  • Behavior: When set above 0, the value is applied fleet-wide and overrides per-user extensions.installCooldownHours settings so developers cannot opt back into instant updates.

Individual users can also set extensions.installCooldownHours in their own settings when the team has not enforced a cooldown.

Allowed extensions

Restrict installs to approved publishers or extension IDs. Configure in the team dashboard or via MDM (AllowedExtensions). See Allowed extensions.

Extension signature verification

Enterprise teams can require valid Open VSX extension signatures before install. Configure in Team settings → Security & automation → Require Extension Signature Verification.

Note: Install cooldown and signature verification are client-side install controls. They complement, but do not replace, marketplace-layer analysis and blocking.

How do I disable an extension?

Open the Extensions panel, find the extension, and click Disable. You can disable extensions globally or for the current workspace only.

If an extension is causing performance issues or conflicts with Cherri Code's AI features, try disabling it to see if the problem resolves.

How do I get my extension verified?

Extension publishers can request a verification badge in the marketplace. Verified publishers have undergone additional security review and identity confirmation. Verification confirms publisher identity. It is one layer of trust; enterprises should still use allowlists and install cooldowns for extensions that access production code and credentials.

To request verification:

  1. Add a link to your OpenVSX listing on your public website (such as in the installation section). This must be a website with its own domain name; a GitHub readme is not supported.
  2. Update the "homepage" link on your OpenVSX listing to point to this website.
  3. If your extension is published on multiple marketplaces, use the same extension ID on OpenVSX as you do elsewhere.
  4. Create a post in the Extension Verification category on the Cherri Code forum with your extension name and a link to your website where we can verify the OpenVSX registry link.

We'll verify the link and add the verification badge to your publisher name once approved.

Related

Was this article helpful?