# VS Code

Add Lockpick to VS Code so its agent can check your site and fix what Lockpick found.

Connecting an assistant lets it check your sites, read your reports and help you fix what Lockpick found, using your own Lockpick account. It never runs a scanner itself. It asks Lockpick, which runs the same limited, read-only checks as the web app.

## Connect VS Code

[Add to VS Code](vscode:mcp/install?%7B%22name%22%3A%22lockpick%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fmcp.lockpick.app%2Fmcp%22%7D)

VS Code opens and asks to add Lockpick. Sign in when it asks.

Or add this to `.vscode/mcp.json` in your project.

```
{
  "servers": {
    "lockpick": {
      "type": "http",
      "url": "https://mcp.lockpick.app/mcp"
    }
  }
}
```

Sign in from your terminal, the window where developers type commands. You approve it in your browser.

```
npx lockpicks login --host https://www.lockpick.app
```

Then add this to `.vscode/mcp.json` in your project.

```
{
  "servers": {
    "lockpick": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "lockpicks",
        "mcp"
      ],
      "env": {
        "LOCKPICK_HOST": "https://www.lockpick.app"
      }
    }
  }
}
```

## Try it

Once it's connected, ask something like this.

```text title="Prompt"
Use Lockpick to check my site and explain the most important fix in plain words.
```

[Prompts that work well](/docs/ai/prompts) has more, and [permissions](/docs/mcp/permissions) explains what the assistant can and can't do.