{
  "entry": {
    "kind": "extension",
    "slug": "sourcegraph-cody",
    "name": "Sourcegraph Cody",
    "vendor": "Sourcegraph",
    "description": "Cody is Sourcegraph's AI coding assistant, distinguished from peers by tight integration with the Sourcegraph code-graph platform — it can pull context from any repository indexed by a Sourcegraph instance, not only the file currently open. That makes it particularly effective on large monorepos and across services owned by different teams. It is distributed for VS Code, JetBrains, and the Sourcegraph web app.\n\nDeclared capabilities include reading workspace files, writing edits back to files when the developer accepts a suggestion, making outbound network requests to either Sourcegraph's hosted Cody service or a self-hosted Sourcegraph instance, and accessing the user's Sourcegraph and provider API credentials. Shell execution is not requested by the extension itself, though some agent workflows in newer versions can run commands when explicitly opted in.\n\nCody is community trust in the catalog because Sourcegraph is not a marketplace-publisher trust authority. The combination of filesystem write plus credential access matches the credential-theft dangerous combination; the recommended posture is to use a workspace-scoped Sourcegraph account, prefer the self-hosted deployment for sensitive codebases, and review which repositories are indexed before granting Cody access.",
    "website": "https://sourcegraph.com/cody",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "community",
    "capabilities": [
      "filesystem:read",
      "filesystem:write",
      "network:outbound",
      "credentials:access"
    ],
    "packaging": {
      "manager": "vsix",
      "packageName": "sourcegraph.cody-ai"
    },
    "configFiles": null,
    "category": null,
    "updatedAt": "2026-09-02T18:21:41.256Z",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [
        {
          "id": "trust-community",
          "kind": "trust",
          "label": "Established community project",
          "contribution": -10
        },
        {
          "id": "high-risk-capabilities",
          "kind": "capability",
          "label": "2 high-risk capabilities: filesystem:write, credentials:access",
          "contribution": 20
        },
        {
          "id": "credential-theft-risk",
          "kind": "combination",
          "label": "Credential theft risk (high)",
          "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
          "contribution": 15
        }
      ],
      "dangerousCombos": [
        {
          "id": "credential-theft-risk",
          "name": "Credential theft risk",
          "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
          "capabilities": [
            "filesystem:write",
            "credentials:access"
          ],
          "severity": "high"
        }
      ]
    },
    "dangerousCombos": [
      {
        "id": "credential-theft-risk",
        "name": "Credential theft risk",
        "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
        "capabilities": [
          "filesystem:write",
          "credentials:access"
        ],
        "severity": "high"
      }
    ]
  }
}