Giulia Stocco (gfs) · Oct 9, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
@@ -2,12 +2,11 @@
 
 ## Repository Overview
 
-DevSkim is a framework of IDE extensions and language analyzers that provide inline security analysis in the dev environment as the developer writes code. The repository contains:
+DevSkim is a .NET library and cross-platform command line tool that performs static security analysis of source code. The repository contains:
 
-- **DevSkim Library** (C#/.NET): Core security analysis engine (`./DevSkim-DotNet/`)
+- **DevSkim Library** (C#/.NET): Core security analysis engine (`./DevSkim-DotNet/Microsoft.DevSkim/`)
 - **DevSkim CLI** (C#/.NET): Command-line tool (`./DevSkim-DotNet/Microsoft.DevSkim.CLI/`)
-- **Visual Studio Extension** (C#/.NET): VS extension (`./DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/`)
-- **VS Code Plugin** (TypeScript): VSCode extension (`./DevSkim-VSCode-Plugin/`)
+- **Tests** (C#/.NET): MSTest project (`./DevSkim-DotNet/Microsoft.DevSkim.Tests/`)
 - **Security Rules**: Default rules and guidance (`./rules/default/`, `./guidance/`)
 
 ## Critical Repository-Specific Rules
@@ -17,12 +16,11 @@ DevSkim is a framework of IDE extensions and language analyzers that provide inl
 **⚠️ IMPORTANT**: This repository uses private Azure DevOps feeds for package management:
 
 - **nuget.config**: Contains private feed configuration (`PublicRegistriesFeed`)
-- **.npmrc files**: VSCode plugin uses `.npmrc.pipeline` for private feeds
 
 **Rules for agents**:
-1. You MAY temporarily modify `nuget.config` or `.npmrc` files to use public feeds (nuget.org, npmjs.com) when working locally
+1. You MAY temporarily modify `nuget.config` to use public feeds (nuget.org) when working locally
 2. You MUST NOT commit these changes - always revert them before committing
-3. Use `git restore nuget.config` or `git restore DevSkim-VSCode-Plugin/.npmrc.pipeline` before creating commits
+3. Use `git restore nuget.config` before creating commits
 4. The private feed configuration must remain in the repository commits
 
 ### Changelog Requirements
@@ -62,35 +60,6 @@ DevSkim is a framework of IDE extensions and language analyzers that provide inl
 
 ## Building and Testing
 
-### VS Code Plugin (TypeScript)
-
-**Location**: `./DevSkim-VSCode-Plugin/`
-
-**Setup**:
-```bash
-cd DevSkim-VSCode-Plugin
-npm run setup          # Install dependencies and build .NET language server
-npm run setup:release  # Release build
-```
-
-**Build**:
-```bash
-npm run compile        # Compile TypeScript
-npm run build          # Full build (setup + compile)
-npm run watch          # Watch mode for development
-```
-
-**Lint**:
-```bash
-npm run lint           # Run ESLint on TypeScript files
-```
-
-**Package**:
-```bash
-npm run pack-ext       # Package extension for release
-npm run pack-ext:debug # Package extension for debug
-```
-
 ### .NET Projects (C#)
 
 **Location**: `./DevSkim-DotNet/`
@@ -114,15 +83,6 @@ cd DevSkim-DotNet/Microsoft.DevSkim.CLI
 dotnet run -- analyze --source-code <path>
 ```
 
-### Language Server
-
-**Build**:
-```bash
-cd DevSkim-DotNet/Microsoft.DevSkim.LanguageServer
-dotnet publish -c Debug -f net8.0 -o ../../DevSkim-VSCode-Plugin/devskimBinaries
-dotnet publish -c Release -f net8.0 -o ../../DevSkim-VSCode-Plugin/devskimBinaries
-```
-
 ## Code Style and Conventions
 
 ### C# Code
@@ -131,12 +91,6 @@ dotnet publish -c Release -f net8.0 -o ../../DevSkim-VSCode-Plugin/devskimBinari
 - Add XML documentation comments for public APIs
 - Security-focused: prioritize secure defaults
 
-### TypeScript Code
-- Use ESLint configuration in `DevSkim-VSCode-Plugin/.eslintrc.js`
-- Follow TypeScript best practices
-- Use type annotations
-- Avoid `any` types when possible
-
 ### Security Rules
 - Rules are JSON files in `./rules/default/`
 - Each rule has corresponding guidance in `./guidance/`
@@ -153,13 +107,10 @@ dotnet publish -c Release -f net8.0 -o ../../DevSkim-VSCode-Plugin/devskimBinari
 
 ### Updating Dependencies
 - For .NET: Use `dotnet add package` or edit `.csproj` files
-- For npm: Use `npm install` or edit `package.json`
 - Document in Changelog.md under `### Dependencies`
 
 ### Debugging
-- **VS Code plugin**: Use F5 in VS Code to launch Extension Development Host
-- **.NET projects**: Use Visual Studio or `dotnet run`
-- **Language Server**: Attach debugger to running process
+- Use Visual Studio, VS Code with the C# extension, or `dotnet run`
 
 ## Git Workflow
 

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -2,7 +2,7 @@
 #
 # Goal: one pull request to review and merge instead of one per dependency.
 #
-# * Version updates for every ecosystem (npm, NuGet, GitHub Actions) are assigned to
+# * Version updates for every ecosystem (NuGet, GitHub Actions) are assigned to
 #   the `all-dependencies` multi-ecosystem group, so Dependabot consolidates them --
 #   across every directory it monitors -- into a single weekly pull request.
 # * Security updates cannot join a multi-ecosystem group, so each ecosystem also
@@ -30,32 +30,7 @@ multi-ecosystem-groups:
       - "no changelog"
 
 updates:
-  # VS Code plugin: extension host and language client packages.
-  - package-ecosystem: "npm"
-    directories:
-      - "/DevSkim-VSCode-Plugin"
-      - "/DevSkim-VSCode-Plugin/client"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:00"
-      timezone: "Etc/UTC"
-    multi-ecosystem-group: "all-dependencies"
-    patterns:
-      - "*"
-    open-pull-requests-limit: 1
-    labels:
-      - "dependencies"
-      - "no changelog"
-      - "javascript"
-    groups:
-      npm-security-updates:
-        applies-to: security-updates
-        patterns:
-          - "*"
-
-  # .NET: library, CLI, language server, and Visual Studio extension projects
-  # discovered through Microsoft.DevSkim.sln.
+  # .NET: library, CLI, and test projects discovered through Microsoft.DevSkim.sln.
   - package-ecosystem: "nuget"
     directory: "/DevSkim-DotNet"
     schedule:

diff --git a/.gitignore b/.gitignore
@@ -1,24 +1,11 @@
 # Binaries
-*.vsix
 **/bin/
 **/obj
 
 # User-specific files
 **/.idea
 DevSkim-DotNet/Microsoft.DevSkim.sln.DotSettings.user
 
-# Build artifacts
-DevSkim-VSCode-Plugin/client/dist/*
-DevSkim-VSCode-Plugin/devskimBinaries/*
-DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/generatedLanguageServerBinaries/*
-DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/Server/*
-
-# Debug artifacts
-DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/devskim-server-*.txt
-
-# Legacy Files
-DevSkim-VSCode-Plugin/server/
-
 # Mac OS Metadata
 **/.DS_Store
 

diff --git a/.vscode/extensions.json b/.vscode/extensions.json
diff --git a/.vscode/launch.json b/.vscode/launch.json
diff --git a/.vscode/settings.json b/.vscode/settings.json
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
diff --git a/Changelog.md b/Changelog.md
@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.101] - 2026-09-23
+### Removed
+- Removed the Visual Studio Code extension (`DevSkim-VSCode-Plugin`) and the Visual Studio extension (`Microsoft.DevSkim.VisualStudio`), along with the IDE-only `Microsoft.DevSkim.LanguageServer` and `Microsoft.DevSkim.LanguageProtoInterop` projects. DevSkim is now distributed only as the `Microsoft.CST.DevSkim` library and the `Microsoft.CST.DevSkim.CLI` tool.
+- Removed Visual Studio-only media assets and the root `.vscode` workspace configuration used for extension development.
+
+### Pipeline
+- Removed the VS Code and Visual Studio extension PR and release pipelines.
+- Removed the npm ecosystem from `.github/dependabot.yml`.
+
+### Changed
+- Rewrote `README.md` to cover only the DevSkim library and CLI.
+- Removed extension build artifacts from `.gitignore` and extension guidance from the Copilot instructions.
+
 ## [1.0.100] - 2026-09-22
 ### Added
 - Added Kubernetes Security Baseline rules (`DS200000`-`DS200007`) covering privileged containers, privilege escalation, host namespace sharing, writable root filesystems, running as root, unpinned images, dangerous Linux capabilities, and `hostPath` volumes. These are the first rules to use the engine's `ymlpaths` support, which no shipped rule had used.