Local VS Code diagnostics that flag Play/security foot-guns in AndroidManifest.xml before you ship — exported components, debuggable, cleartext traffic, and loose backup settings.
Not a snippet pack. Peer Marketplace listings insert uses-permission text; Manifest Guard audits risky attributes into the Problems panel.
Runs fully offline. No network, no telemetry, no accounts.
60-second win
- Open an
AndroidManifest.xmlwithandroid:exported="true"and no permission, orandroid:debuggable="true". - Open Problems — see
MG001/MG002/MG003/MG004. - Fix the attribute → diagnostics clear on save.
- Optional: Manifest Guard: Rescan Workspace from the Command Palette, or click the status bar when a Manifest is focused.
Rules (v1)
| Code | Check | Severity | Fix |
|---|---|---|---|
| MG001 | Component android:exported="true" without android:permission (activity / service / receiver) |
Warning | Add a protecting permission, or set exported="false" if the entry point is not needed |
| MG002 | android:debuggable="true" on <application> or a component |
Error | Remove debuggable from the release Manifest (quick-fix available) |
| MG003 | android:usesCleartextTraffic="true" |
Warning | Prefer network security config, or set false |
| MG004 | android:allowBackup="true" without fullBackupContent / dataExtractionRules |
Warning | Add backup/extraction rules, or set allowBackup="false" |
Settings
| Setting | Purpose |
|---|---|
manifestGuard.include |
Globs to find Manifests (default **/AndroidManifest.xml) |
manifestGuard.exclude |
Skip build/merged Manifests (**/build/**, etc.) |
manifestGuard.rules.MG00N.enabled |
Turn a rule on/off |
manifestGuard.rules.MG00N.severity |
Override severity (default keeps the rule default) |
Keywords
android manifest · exported · debuggable · cleartext · allowBackup · play security
Privacy
This extension analyzes files in your workspace locally. It does not send Manifest contents anywhere.
Non-goals
Snippet / autocomplete packs · full Android Studio Lint / AGP · logcat / ADB · Gradle integration.