Continue continue.dev ↗

Open-source IDE assistant (Apache-2.0, VS Code + JetBrains, ~33k stars). Configured via ~/.continue/config.yaml. No sandbox — runs in-process inside the IDE. BYO model providers, MCP servers, custom context providers, Continue Hub for shared assistants. No published CVEs as of writing.

Version Pinning and Extension Marketplace Provenance

Continue ships through VS Code Marketplace, Open VSX, and JetBrains Marketplace with a rolling "pre-release" channel landing new code ~a week before stable. Install only publisher Continue.continue; disable auto-updates.

// VS Code settings.json
"extensions.autoUpdate": false,
"extensions.autoCheckUpdates": false

Tip: subscribe to GitHub releases feed for continuedev/continue, avoid the pre-release channel on production developer machines.

Continue Panel Exposure and IDE Secret Storage

API keys typed into the onboarding panel are persisted via vscode.SecretStorage (OS keychain); any key written into config.yaml lives on disk in plaintext.

# ~/.continue/config.yaml — reference, do not inline
models:
  - name: Claude Sonnet
    provider: anthropic
    model: claude-sonnet-4-5
    apiKey: ${{ secrets.ANTHROPIC_API_KEY }}

Tip: never paste keys into config.yaml; let the IDE store them, or load via secrets.* from environment / Hub.

Authentication and Continue Hub Identity

Local Continue has no built-in auth — anyone with shell access reads ~/.continue/ and keychain entries unlocked by your IDE session. The Continue Hub (Mission Control) adds org identity for shared assistants/secrets.

models:
  - uses: anthropic/claude-sonnet-4-5
    with:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Tip: enable SSO + MFA on the Hub account, scope shared assistants to least-privilege secret blocks, disable Hub access from machines that only need local models.

Isolation — No Sandbox, In-IDE Execution

Continue runs inside the IDE extension host process and inherits its full filesystem, network, and environment access; MCP servers are spawned as child processes of that host. Use OS-level isolation for any repo you do not fully trust.

// .devcontainer/devcontainer.json
"extensions": ["Continue.continue"],
"mounts": ["source=${localEnv:HOME}/.continue,target=/home/vscode/.continue,type=bind,readonly"]

Tip: open untrusted repos inside a devcontainer or Restricted Mode workspace; mount ~/.continue read-only.

Agent Mode Tool Allowlist and MCP Scope

MCP is only available in Agent mode; each MCP server is launched with a command/args/env tuple — arbitrary binaries with your user privileges.

mcpServers:
  - name: filesystem
    type: stdio
    command: /usr/local/bin/npx
    args: ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me/projects/safe-repo"]
    env:
      NODE_ENV: production

Tip: pin MCP commands to absolute paths, constrain filesystem servers to a single project root, disable Agent mode in repos where you do not need tool execution.

Credential Handling in `~/.continue/`

~/.continue/config.yaml, workspace .continue/, and ~/.continue/logs/core.log are world-readable by your user; logs may capture prompts in verbose mode.

chmod 700 ~/.continue
chmod 600 ~/.continue/config.yaml
export ANTHROPIC_API_KEY="$(security find-generic-password -s anthropic -w)"

Tip: rotate keys quarterly, exclude .continue/ from dotfile repos and backups, turn off Verbose logging once you finish debugging.

Custom Context Providers and Invokable Prompt Files

Context providers shell out to real binaries — search runs ripgrep, terminal reads the last shell command + output, clipboard reads recent clipboard items, http fetches arbitrary URLs. Invokable prompt files (invokable: true in .continue/prompts/) become slash commands.

context:
  - provider: code
  - provider: diff
  # avoid by default:
  # - provider: terminal   # leaks shell history
  # - provider: clipboard  # leaks pasted secrets
  # - provider: http       # SSRF / data exfil surface

Tip: review .continue/prompts/ and .continue/mcpServers/ in code review, drop high-risk providers from defaults, require signed-off changes to add new MCP servers.

Prompt Injection from Indexed Code, Docs, Web

Continue indexes your codebase (local embeddings under ~/.continue/index/) and any docs: sites you add. A malicious comment in a dependency, a poisoned docs: page, or an MCP tool result can hijack the agent.

docs:
  - name: internal-runbooks
    startUrl: https://docs.internal.example.com/
# do NOT index untrusted third-party sites

Tip: only add first-party docs: sources, treat agent tool output as untrusted, require human approval on every write/exec tool call — never blanket auto-approval.

Updates, Telemetry, Outbound Network

Continue sends anonymous telemetry to PostHog by default; the CLI variant honours CONTINUE_TELEMETRY_ENABLED=0. For self-hosted endpoints behind a private CA, configure TLS verification explicitly rather than disabling it.

allowAnonymousTelemetry: false
requestOptions:
  verifySsl: true
  caBundlePath: /etc/ssl/corp-root.pem
  proxy: http://proxy.internal:3128

Tip: disable allowAnonymousTelemetry, route through corporate proxy with caBundlePath, never set verifySsl: false to "fix" a cert error.

Audit and Logging

Continue writes runtime logs to ~/.continue/logs/core.log and exposes a development data pipeline (data: section) that can stream chat/edit/autocomplete events to an HTTP sink or local file.

data:
  - name: audit-sink
    destination: https://siem.internal.example.com/continue
    schema: 0.2.0
    events: [chatInteraction, autocomplete, tokensGenerated, tool_call_outcome]
    level: all
    requestOptions:
      headers:
        Authorization: Bearer ${{ secrets.SIEM_TOKEN }}

Tip: ship data: events to a SIEM, monitor core.log for unexpected MCP spawns, report suspected vulnerabilities privately to [email protected].

References & further reading