routeVSCODE reached 326 GitHub stars in the 55 minutes between GitHub's recorded repository creation time, 01:25 UTC, and MrKeyoor's 02:20 UTC crawl on September 10. The repository contains a VS Code extension whose loopback chat proxy does not authenticate its caller before adding the user's 9Router key to an outbound request. Hundreds of stars supplied the attention; the missing inbound check is the reason developers should inspect the code before installing its bundled VSIX.
GitHub showed 326 stars, zero forks, zero open issues, and zero people watching separately from stars when this article was prepared. The project's commit history contains 22 commits authored between August 26 and September 10, so the code predates the repository's public creation timestamp. Those figures do not prove adoption or misuse. They show that a newly visible project attracted hundreds of star clicks before it had any visible downstream development activity.
A stable model ID with a mutable destination
The project addresses a real annoyance in multi-model coding setups. VS Code already supports bring-your-own-key models and custom endpoints, including endpoints that speak the Chat Completions, Responses, or Messages API. A custom model normally appears as a fixed entry in the model picker. routeVSCODE creates one entry named 9Router via Proxy, gives it the model ID 9router-active, and points it at http://localhost:20129/v1/chat/completions.
That endpoint stays fixed while the destination changes underneath it. On every chat request, the extension reads activeModel from its configuration, replaces the payload's model field, and forwards the request to a 9Router service on port 20128. Streaming responses are piped back to VS Code. Switching models from the status bar or dashboard changes one setting instead of repeatedly rewriting the model picker entry or reloading the editor.
VS Code talks to one OpenAI-compatible address, while 9Router handles access to the selected provider and the extension changes the requested model. The README attributes support for more than 40 providers to 9Router. In the connector, available models are fetched from the gateway, with a saved model used when discovery fails.
VS Code's own limits still apply to this route. Microsoft's BYOK documentation says chat models can work without a Copilot plan, while semantic search, inline suggestions, and features based on embeddings still require GitHub services. Business and Enterprise administrators can disable BYOK. routeVSCODE changes the chat model behind a custom endpoint; it does not move those other editor features onto 9Router.
The single proxy identity reports the same capabilities for every destination. It declares tool calling and vision support, plus a one-million-token input limit and 65,536-token output limit. Those values are hard-coded in the extension, even though the chosen upstream model can change. A model with smaller limits or no vision support may receive capabilities that the picker says are available. The gateway or provider then has to reject or adapt the request.
Loopback limits exposure without identifying callers
The proxy binds to 127.0.0.1, which blocks direct connections from other computers on the local network. The server setup also sends Access-Control-Allow-Origin: *, accepts browser preflight requests, and routes any POST URL containing /chat/completions to the forwarding handler. There is no origin allowlist, random session token, or comparison against the incoming Authorization header.
The published handler reduces the network boundary to two relevant lines:
res.setHeader('Access-Control-Allow-Origin', '*');
// ...
proxyServer.listen(PROXY_PORT, '127.0.0.1');
CORS does not expose the port beyond the machine. It tells browser origins that they may read the response when the browser permits a request to the loopback address. Local applications can call loopback independently of CORS. With no caller check in the request route, any process that can reach port 20129 can submit a chat payload to the handler.
The outgoing request gets different credentials. The extension drops the inbound authorization header and constructs a new bearer header from the 9Router API key saved in VS Code configuration. The proxy response does not reveal the key. Even so, a local caller can ask the proxy to make a credentialed model request. Such calls can consume quota and send caller-chosen content to the configured gateway. The handler also accumulates the full request body without a size ceiling before parsing it.
This is a source-level finding. MrKeyoor did not install the VSIX or send a proof-of-concept request through the proxy. Browser behavior can vary as vendors tighten access from public sites to local-network addresses. The missing application-level authentication remains visible in the forwarding code, and a loopback bind does not replace caller authentication for a service that holds a usable credential.
The key crosses several plaintext locations
The dashboard adds another part to the trust boundary. Its JavaScript saves the full configuration object, including apiKey, in browser localStorage. When a user activates a model, the page includes that key and the gateway base URL in a vscode:// query string. The extension's URI handler reads both values and writes the key into a global VS Code setting.
The key path begins before any proxy call. The dashboard's buildVSCodeUri function serializes the model ID, label, provider, base URL, and API key with URLSearchParams. The extension accepts both apiKey and baseUrl from that URI, so the handoff can change the credential and the outbound gateway together. The checked-in dashboard generates the link, while the URI handler itself does not verify its source.
The extension then copies the same value into the apiKey field of chatLanguageModels.json. Microsoft's current custom-endpoint documentation advises using an input variable instead of placing a raw key in that file. For extension-owned credentials, the VS Code team documents SecretStorage, which encrypts secrets on disk and explicitly warns that ordinary state stores are plaintext.
Masking the dashboard input as a password field only changes what is visible on screen. The current data flow leaves the 9Router key in browser storage, a custom URI, VS Code configuration, and the custom-model file. The extension should keep the credential in SecretStorage, pass an opaque one-time value through the URI handler, and avoid duplicating the gateway key in the local proxy entry. VS Code's ${input:...} mechanism is designed to keep raw custom-endpoint keys out of that JSON configuration.
A prebuilt extension arrives before a release process
The repository is MIT-licensed and small enough to inspect, but its convenient setup path asks for substantial trust. The Linux and macOS script installs 9router globally through npm when it is absent, selects the first VSIX found in the repository's releases directory, and installs it into VS Code with --force. The root npm run setup command performs the same global-package and VSIX steps through JavaScript.
As of this review, the repository's GitHub Releases page is empty even though releases/routevscode.model-connector-2.5.0.vsix is committed to the default branch. The root package manifest has start, development, setup, and extension-install commands, with no test command. The repository tree contains no test directory or GitHub Actions workflow. That absence does not establish that the extension is harmful. It means users have no published automated evidence tying the prebuilt VSIX to a tested source revision.
A stronger release would build the VSIX in CI from a tagged commit, publish a checksum, and test the proxy's authorization boundary. The current handler also needs an exact route match, a request-size limit, and a random inbound credential generated when the extension starts. A restricted origin policy could cover the bundled dashboard without advertising access to every browser origin.
Watch the repository for a caller-authentication patch, removal of wildcard CORS, migration to SecretStorage, and a reproducible tagged release. Forks, issue reports, and outside contributors would show whether the first hour's attention is turning into use. Until those changes land, the stable-endpoint trick remains useful engineering, while its proxy belongs in the same risk category as any local service carrying a paid API credential.