# VS Code extension

> Review your changes before you push, see findings in the editor with fixes you can apply, and check your pull request's merge gate from VS Code, Cursor and other VS Code-based editors.

The MergeHarbor extension brings reviews into your editor. It reviews the changes on your machine with the same rules, configuration and codebase context as pull request reviews, shows each finding on the line it is about, and shows your branch's pull request with its merge gate. It works in VS Code, Cursor, Windsurf, VSCodium and other editors built on VS Code (1.85 or later).

## Install

- **VS Code:** search for **MergeHarbor** in the Extensions view, or install it from the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=mergeharbor.mergeharbor).
- **Cursor, Windsurf, VSCodium and other editors:** install it from [Open VSX](https://open-vsx.org/extension/mergeharbor/mergeharbor), which these editors use.
- **From a terminal:** `code --install-extension mergeharbor.mergeharbor` (use `cursor` instead of `code` for Cursor).

The console's **Settings → Coding agents → Your tools → Editor extension** tab has the same links with your installation's address filled in.

## Sign in

Run **MergeHarbor: Sign in** from the command palette. The extension shows a code and opens your browser; check that the code matches, choose the organization, and approve. This is the same sign-in as [`mh login`](https://mergeharbor.com/docs/cli): the editor receives an API key that acts as you, sees only the repositories you can see, never holds more than your role, expires after 90 days, and is listed under **Settings → API keys** with your editor's and computer's names (for example `CLI: Cursor on dana-laptop`), where you can revoke it.

The key is kept in your editor's secret storage (the operating system's keychain), never in settings files. **MergeHarbor: Sign in with an API key** accepts a key you created in the console instead, and **MergeHarbor: Sign out** forgets it.

Self-hosted MergeHarbor: set **MergeHarbor: Api Url** (`mergeharbor.apiUrl`) to your server's address before signing in. It must use `https://`; plain `http://` is accepted only for `localhost`.

## Review your changes

Run **MergeHarbor: Review my changes**, or one of:

| Command                    | What it reviews                                                               |
| -------------------------- | ----------------------------------------------------------------------------- |
| Review working tree        | Commits on your branch plus staged, unstaged and new files (like `mh review`) |
| Review staged changes      | Only what you are about to commit (like `mh review --staged`)                 |
| Review branch against base | Only the commits you are about to push (like `mh review --committed`)         |

Before anything is sent, the extension asks the server what the review will cost and shows it: the tier, its credits, and any limit from your organization's monthly credit budget. Nothing runs until you confirm. If the budget pauses reviews, or the tier you chose is over the budget, the dialog says so. The repository's configuration can raise the tier for risky changes; the finished review shows the credits it actually used.

The repository must be connected to your organization. Local reviews count toward your plan like pull request reviews, appear in the console under **Pull requests → Local reviews**, and are counted as editor reviews in **Insights → Teams → Local reviews by source**. Nothing is posted to your code host. The diff is sent to MergeHarbor and deleted once the review finishes.

## Findings in the editor

Findings appear as problems on the lines they are about, with their severity: critical findings as errors, major as warnings, minor as information and nits as hints. Hover over one for the explanation and the suggested change. The light bulb (or **Quick Fix**) offers:

- **Apply suggested fix** replaces the lines with the suggested change. It is an ordinary edit you can undo.
- **Explain** opens the full explanation, suggestion, rule and confidence beside your code. It makes no model call.
- **Ask about this** asks a question about a finding on your pull request in its conversation, where answers use credits (one credit for every ten answers). For local findings it shows the explanation, since local reviews have no conversation.
- **Copy fix prompt for my coding agent** copies a prompt you can paste into Claude Code, Cursor, Codex or another agent.
- **Dismiss** asks why (false positive, not applicable, won't fix, fixed elsewhere, or other) and takes an optional note. Dismissing a finding as a false positive or not applicable teaches MergeHarbor to avoid similar comments, the same as dismissing it in the console.

## Pull request panel

The MergeHarbor view in the activity bar shows the pull request for your branch's commits: the review summary and confidence score, its open findings (select one to open the file at that line), the merge gate's verdict and readiness score with the checklist of what to do to pass, and links to the pull request in the console and on your code host. Open findings of the pull request also appear in the editor, labeled with the pull request number; turn this off with `mergeharbor.showPullFindings`.

## Status bar

The status bar item shows the review state (reviewing, the number of findings, or an error) and the credits your own local reviews used this month. People who can see usage also see the organization's credits against its monthly budget. Select it for a menu of commands.

## Settings

| Setting                            | Default                       | What it does                                                                                                  |
| ---------------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------- |
| `mergeharbor.apiUrl`               | `https://app.mergeharbor.com` | The MergeHarbor server                                                                                        |
| `mergeharbor.tier`                 | `auto`                        | `auto` lets the repository configuration choose; `standard` (1 credit), `deep` (3) or `max` (10) ask for more |
| `mergeharbor.defaultScope`         | `all`                         | What **Review my changes** reviews: `all`, `staged` or `committed`                                            |
| `mergeharbor.autoReviewOnSave`     | off                           | Review the working tree after you save, at most once every 30 seconds and never while a review runs           |
| `mergeharbor.autoReviewMaxCredits` | `1`                           | Automatic reviews run without asking only when they cost at most this many credits                            |
| `mergeharbor.severityThreshold`    | `minor`                       | Show findings at or above this severity                                                                       |
| `mergeharbor.showPullFindings`     | on                            | Show the open findings of the branch's pull request in the editor                                             |

Automatic reviews on save are off by default because each one uses credits. When you turn them on, a review that would cost more than `mergeharbor.autoReviewMaxCredits`, or that the credit budget would stop, is skipped and the status bar says why.

## Workspace trust

Reviews read your git history and send diffs to MergeHarbor, so they run only in workspaces you trust. In restricted mode the extension shows your pull request but does not review local changes.