Grok Chat

A focused Grok coding workspace, directly inside VS Code.
Chat about code, work securely with projects, and create images or videos with Grok Imagine without leaving the editor.

[!IMPORTANT] Grok Chat is an independent, unofficial extension. It is not affiliated with, endorsed by, or sponsored by xAI. Grok, xAI, and related names belong to their respective owners.

[!TIP] New in 1.2.2: Grok Imagine is enabled only while the active authentication method is an xAI API key. SuperGrok OAuth never enables or supplies credentials to Imagine.

Why install Grok Chat?

The most complete Grok workspace for Visual Studio Code.

Use Grok directly inside your editor with OAuth authentication, API Keys, project-aware conversations, voice input, secure credential storage and powerful developer tools.

✔ OAuth Login

✔ xAI API Key Support

✔ Project Context

✔ Multi Conversation Chat

✔ Voice Input

✔ Grok Imagine Image & Video Generation

✔ Tool Calling

✔ Secure Secret Storage

✔ VS Code Native Experience

Preview

Screenshots

Get started

1. Install Grok Chat from the Visual Studio Marketplace or from a trusted .vsix.
2. Open a folder in VS Code.
3. Select the Grok Chat icon in the Activity Bar.
4. Connect with Grok OAuth or an xAI API key.
5. Choose a model and start a conversation.

The first-run experience can prepare a new project, integrate guidance into an existing project, or skip setup and open chat immediately.

Authentication: two separate modes

Grok Chat never treats OAuth and API billing as the same thing.

Mode 1 — Grok OAuth

• Opens the browser so you can sign in with your Grok account.
• Uses the subscription and access available to that account.
• Does not require an xAI API key.
• Stores the resulting OAuth session in VS Code Secret Storage.

Mode 2 — xAI API

• Requires an API key created for api.x.ai.
• Uses the xAI API independently from the OAuth subscription mode.
• May consume paid credits or generate costs according to the xAI account.
• Stores the API key in VS Code Secret Storage.

If both credentials exist, Settings clearly shows which method is active. Switching methods does not silently delete the other credential.

Grok Imagine: images and video

Choose Imagine from the mode selector at the bottom of the chat panel. In this experimental 1.2.1 test build, an active SuperGrok OAuth session can enable Imagine when no xAI API key is saved.

• Generate or edit images with Standard or Quality models, 1K/2K resolution, configurable aspect ratio, and up to four variations.
• Attach up to three PNG, JPEG, or WebP reference images for image editing and composition.
• Generate videos from text or animate a source image, with 1–15 second duration and supported 480p/720p/1080p choices depending on the selected model.
• Use multiple references with compatible video models; invalid model/input combinations are disabled.
• Review the estimated output cost before higher-cost requests. Video and multi-image requests require confirmation.
• Results are downloaded from xAI's temporary URL into private extension storage and can be opened, exported, or deleted from the Imagine gallery.

xgrok.experimentalImagineOAuth is enabled for this test build. The interface identifies this route as experimental and asks for confirmation before generation. xAI may reject the OAuth credential because its public Imagine API documents API-key authentication; the setting can be disabled to restore API-key-only behavior.

Models

The model picker combines three sources:

1. A stable built-in fallback so the extension remains usable offline or when discovery is unavailable.
2. Models dynamically available to the active authenticated xAI account.
3. Optional custom model IDs configured by the user.

Dynamic discovery is best effort. A discovery error never disables the static fallback.

Workspace context

Automatic context excludes common credential-bearing files such as .env, private keys, and cloud credential files. Regular files can still be attached manually when appropriate.

When the opened workspace contains a project inside a subfolder, Grok Chat automatically detects the most likely project root (up to two levels deep) using common markers such as package.json, tsconfig.json, pyproject.toml, or go.mod. The opened workspace remains the security boundary. Changing the VS Code workspace clears and reloads the project map.

Permissions and user control

Both modes retain these controls:

• Paths are constrained to the open workspace.
• Absolute paths and traversal outside the workspace are rejected.
• Symlink and junction escapes are checked against canonical paths.
• Terminal commands are restricted by allowlist and denylist policies.
• Full Workspace Access requires VS Code Workspace Trust.
• A repository cannot grant itself Full Workspace Access through workspace settings.

Grok Chat cannot use its agent file tools to browse or change arbitrary locations outside the open workspace. Full Workspace Access is not an operating-system sandbox; enable it only for workspaces and tasks you trust.

Privacy

Grok Chat does not include advertising, analytics, or behavioral telemetry, and it does not sell personal data.

When you send a model request, the payload can include:

• Your prompt and conversation messages.
• Files or folders you attached.
• Project context produced by the selected context mode.
• Tool definitions and tool results required to complete the conversation.

Additional network activity occurs only for the feature being used:

• OAuth communicates with xAI authentication services.
• API chat communicates with the allowlisted api.x.ai endpoint.
• Imagine sends prompts and explicitly attached reference images to the official xAI image/video endpoints. Generated media is downloaded from allowlisted xAI media hosts into extension-owned local storage.
• SuperGrok usage refresh performs a separate authenticated usage request.
• Local voice stays on the device.
• Opt-in xAI voice sends microphone audio to xAI for transcription while the microphone session is active.

OAuth tokens, API keys, and a dedicated voice key are persisted only through VS Code Secret Storage. Chat history is stored locally in VS Code workspace storage after secret redaction; embedded image data is not retained in persisted history. Temporary xAI voice recordings are deleted on a best-effort basis after transcription.

Imagine assets are stored separately under VS Code's extension global storage until deleted or exported. They are not written into the opened repository automatically. Imagine generation is metered by xAI and may consume API credits; cancellation after a request starts does not guarantee that xAI will not charge it.

Local history storage does not mean inference requests are zero-retention. According to xAI's API data policy, API inputs and outputs are normally retained encrypted for up to 30 days for abuse and security auditing and are not used for training without explicit permission. Teams enrolled in xAI Zero Data Retention have different behavior, but some server-side features such as stateful Responses, Files, and Collections are unavailable. Grok Chat continues to work with local history and Chat Completions when those features are unavailable.

Security

• OAuth authorization code flow with PKCE, state, and nonce validation.
• OS-backed VS Code Secret Storage for persisted credentials.
• Strict allowlist before authentication headers can be sent.
• Webview Content Security Policy and validated message types.
• Escaped model output; raw model HTML is not executed.
• Secret redaction in errors, history, and tool activity.
• Workspace Trust, path protection, and protected tool approval.
• Exact command/URL previews with session-scoped terminal, network, and commit approval.
• Patched PDF parsing with generated-code evaluation disabled and bounded resource use.

Voice input

The microphone communicates its current state: ready, opening, listening, processing, or error.

• Local: private Windows speech recognition with system dictation fallback.
• xAI: opt-in cross-platform transcription; requires explicit consent, FFmpeg, and may be metered.
• Auto: selects local voice on Windows and xAI voice on macOS or Linux.

The phrase grok send can submit the final transcript hands-free. If a response is already running, the prompt joins the existing queue.

VS Code Chat

Use @grok in the built-in Chat view:

• /explain
• /fix
• /tests
• /refactor

Commands

Requirements

• Visual Studio Code 1.104 or later, or a compatible host.
• A Grok account with applicable access, or an xAI API key.
• An open workspace folder for project context and file tools.
• Microphone permission for voice input.
• FFmpeg only when using xAI voice capture.

FAQ

Is this an official xAI extension?

No. Grok Chat is independent and is not affiliated with, endorsed by, or sponsored by xAI.

Does OAuth use my API credits?

OAuth and API key mode are separate. OAuth uses access associated with the signed-in Grok account. API key mode uses api.x.ai and may consume paid API credits.

Can a project enable Full Workspace Access itself?

No. The extension accepts Full Workspace Access only from the user's global configuration and only after VS Code trusts the workspace.

Are my credentials stored in the project?

No. Persisted credentials use VS Code Secret Storage, not project files or normal workspace settings.

Why do some models appear or disappear?

Dynamic models reflect what the active account reports. The built-in fallback remains available when discovery cannot be completed, and custom model IDs can be added in Settings.

Troubleshooting

Login does not complete

• Finish the browser authorization and return to VS Code.
• Retry Sign in with SuperGrok from the Command Palette.
• Check whether a firewall is blocking the temporary localhost OAuth callback.

API key validation fails

• Confirm the key belongs to xAI and has access to the chosen model.
• Check account credits and endpoint permissions.
• Save without validation only when you understand that the first real request may still fail.

Workspace tools are unavailable

• Open a folder rather than an empty VS Code window.
• Trust the workspace for protected actions.
• Check whether Ask Before Changes is waiting for an approval card.

Voice input does not start

• Allow microphone access for the VS Code host application in operating-system privacy settings.
• For xAI voice, install FFmpeg or configure its machine-specific path.
• Select a microphone device if automatic detection chooses the wrong input.

Try LocalMan

Looking for another way to improve your local development workflow? Discover LocalMan, a companion VS Code extension from An Unknown Artist. Give it a try and bring more of your everyday tools directly into the editor.

License

This project is source-available under the PolyForm Noncommercial License 1.0.0. You may use, modify, and distribute it for noncommercial purposes. Commercial use, sale, monetization, sublicensing, and transfer of rights are not permitted without prior written authorization.

Created by An Unknown Artist. Contact www.anunknownartist.com