Editor extension

The editor extension shows a package's notes where you use it: on hover over the manifest line, and in the note editor. It is Depos — Dependency Notes in VS Code, in JetBrains IDEs (IntelliJ IDEA, PyCharm, WebStorm, Rider and the others) and in Visual Studio 2022 and newer, for .NET projects. Signed in to Depos, it shows your organization's notes instead of the notes files in the folder, and each package's allowlist result.

Sign in

1. Start the sign-in:
   • in VS Code, run Depos: Sign In from the Command Palette, or click Sign in in the Organization section of the Depos view;
   • in a JetBrains IDE, choose Tools → Depos → Sign In, or click Sign in in the ORGANIZATION group of the Depos tool window;
   • in Visual Studio, choose Tools → Depos → Sign In, or click Sign in in the ORGANIZATION group in the settings of the Depos tool window. The address of Depos is Server address under Tools → Options → Depos → General.
2. The editor shows a code and opens Depos in your browser. Sign in there if you are not signed in yet.
3. Check that the page shows the same code, then click Approve.

Approve a code only if you started the sign-in yourself. Deny if you did not; the editor stays signed out.

Org mode

A folder is in org mode when you are signed in and its GitHub repository is added to one of your organizations in Depos (see Repositories). In a JetBrains IDE, the folders are the project's folder and each of its content roots. In Visual Studio, they are the repository folders of the solution and of each of its projects. In org mode:

• The organization's notes in Depos are the notes. The editor does not read the folder's DEPENDENCY-NOTES.md files, and never writes to them. Notes you wrote there before signing in can be imported in Depos, under Notes → Review.
• Admins can add, edit and delete notes from the editor. Editors and readers see them read-only. A change made in the editor appears in Depos at once, under Notes → All notes and in Activity.
• If someone else changed the same note since your editor last received it, your save is refused. The editor fetches the new version; check it and save again.

Any other folder stays as it was without Depos: the extension reads the notes files and sends no request.

Allowlist results

In org mode the editor shows the allowlist result of each package of the repository, as Depos decides it for that repository:

• At the manifest line, and in the Problems panel (the Error List in Visual Studio): Denied and Not listed packages. In an ecosystem set to Audit this is a warning; in Enforce it is an error. Allowed packages stay quiet.
• On hover (quick documentation in a JetBrains IDE, Quick Info in Visual Studio) and in the note editor: the result, the entry's reason and expiry, and a link to the package's page in Depos.
• An ecosystem set to Off shows nothing.

A line you have just added is checked at once, before you push it. An entry that expires reads as Not listed from that moment.

AI agents

In VS Code, the extension also offers each folder's notes and allowlist results to the AI agents in VS Code, over MCP. A JetBrains IDE has no way for a plugin to add an MCP server, so there Tools → Depos → Copy MCP Setup copies the setup for the folder's repository; the agent connects with an MCP key. In Visual Studio, Tools → Depos → Copy MCP Setup copies the setup in Visual Studio's .mcp.json format, and Visual Studio asks for the MCP key when the server starts. See AI agents.

Working offline

The editor keeps a copy of the notes and the allowlist results on your machine and asks Depos only for what changed since that copy: at start, when the window gets focus, every few minutes, and when you run Refresh Organization Notes. While Depos cannot be reached, the copy is used, and the editor shows when it was received.

Sign out

Run Sign Out (Depos: Sign Out in VS Code, Tools → Depos → Sign Out in a JetBrains IDE or in Visual Studio). This ends the editor's session in Depos and removes the copy from your machine. Your browser stays signed in.