Overview & safety
Vegha gives language models 21 tools for your collections. The same tools are available in three ways:
| Where | How |
|---|---|
| GitHub Copilot Chat (agent mode) | Native VS Code language-model tools. Reference them with #veghaSend, #veghaRequest and so on. See Copilot tools. |
@vegha in chat | A request-focused assistant with slash commands. See @vegha participant. |
| Claude Code, Cursor, Claude Desktop, Windsurf… | Vegha’s MCP server. See MCP for other agents. |
What the tools can do
Section titled “What the tools can do”- Discover: list collections, search requests, read a request, list environments.
- Change requests: create and update requests, set scripts, assertions, captures and request chains, import cURL, create folders, delete a request.
- Run: send a request or run a folder.
- Look up: read the last response, generate code, read history, and read the scripting reference.
You stay in control
Section titled “You stay in control”- Every change shows its
.brudiff for approval and lands as an undoable edit. - Every send shows its target URL before it goes out.
- Deleting a request always asks you to confirm.
- MCP clients apply their own approval prompts to the same tools.
Secrets never reach the model
Section titled “Secrets never reach the model”- Secret environment values, literal credentials in auth settings, and credential headers
(
Authorization, cookies, API keys) are shown to the model as«redacted». - Tools refuse to write that placeholder back over a real secret.
- API responses are passed to the model as untrusted data, so instructions inside a response body aren’t treated as instructions.
Vegha itself has no telemetry and makes no network calls except the requests you send. The model calls are made by the AI tool you use (Copilot, Claude Code, Cursor…) under its own terms.