VS Code Profiles Guide for Cline: How to Isolate Agent Environments

Two coding agents pointed at the same workspace will happily overwrite each other's work, and neither will notice. Similarly, a developer switching between client projects and personal repositories with a single global Cline instance risks leaking API keys, mixing up custom system prompts, and polluting task histories across different projects. Manual adjustments to configuration panels before every window switch are error-prone and fail to scale when working across multiple client agreements.

When an AI assistant has direct command line access and write permissions, configuration boundaries are not just a convenience; they are a security requirement. A single misconfigured prompt can cause the agent to run scripts meant for a dev environment in a production workspace, or use a personal API key to write commercial code. Storing settings globally means that the active LLM instructions, provider keys, and custom tools are shared across every open VS Code window. If you are developing a proprietary project while maintaining an open-source tool, the agent might apply proprietary guidelines to the open-source codebase, or worse, expose personal API keys in logs.

To establish safe boundaries, developers must isolate their development environments. Visual Studio Code includes a profile management system that isolates settings, extensions, and configuration states. Setting up isolated environments for Cline enables developers to maintain strict boundaries between client projects. This prevents configuration drift, protects credentials, and ensures that the agent operates under the exact guidelines required for each specific task.

Understanding the mechanism of profile isolation is necessary for building a secure multi-agent setup. When you switch profiles in Visual Studio Code, the editor swaps out the active environment configuration. Learning how to switch cline configs vscode makes it simple to move between different development contexts. A profile switch is fast, taking only a few seconds in the VS Code UI, which allows developers to switch between environments without restarting the application.

During a profile swap, Visual Studio Code scopes 3 primary configuration layers:

1. User Settings: The global settings.json file is replaced with a profile-specific version. This determines which editor preferences, font choices, and extension options are active.

2. Extension State: The activation state of every extension is managed per-profile. This means you can enable Cline only in profiles meant for AI-assisted development, while keeping it disabled in standard browsing or presentation profiles to save system memory.

3. Global State: Data saved by extensions via the VS Code ExtensionContext.globalState API is isolated to the active profile. Cline uses globalState to store non-sensitive configuration options, such as the active provider, model selections, custom prompt guidelines, and task metadata.

However, there is an important security limitation. VS Code's SecretStorage API, accessed via ExtensionContext.secrets, is not profile-aware. This API is designed to store sensitive tokens and API keys securely in the operating system's native credential manager. Because SecretStorage scopes keys by the extension's identifier, any secret stored under a key name like "anthropicApiKey" is shared globally across all VS Code profiles for that extension.

If both your "Work" and "Personal" profiles use the Anthropic provider, they will read the same Anthropic API key from the system keychain. To prevent this credential sharing, developers can read the agent storage guidelines and use different API providers for different profiles, or they can use environment variables when launching VS Code from the command line, or they can create entirely separate user data directories to achieve absolute secret isolation.

Creating a new profile in VS Code is the first step toward isolating your agent. The editor provides a built-in interface to manage profiles, allowing you to create them from scratch or copy settings from an existing setup. This setup details how to isolate cline settings json files and rules from your global editor state.

To configure a dedicated profile for Cline, follow these steps:

1. Open the Manage gear icon in the bottom-left corner of the editor window and select "Profiles," then choose "Create Profile."

2. Name the new configuration something descriptive, such as "Cline Work" or "Cline Personal," and choose a template or copy configurations from your default profile.

3. Once the new profile is active, navigate to the Extensions marketplace, search for Cline, and ensure it is enabled for this profile.

4. Open the Cline panel in the sidebar, click the settings gear icon, and configure the model provider, API key, and custom instructions for this specific environment.

5. Repeat this process to create separate profiles for other projects, ensuring each profile uses its own configuration.

One point trips people up here: there is nothing to configure in settings.json. The Cline extension contributes no VS Code configuration properties, so keys like cline.apiProvider or cline.customInstructions do not exist and pasting them into settings.json has no effect. Cline keeps its provider selection, model choice, API key, and custom instructions in its own extension state, which you edit through the Cline panel.

That is exactly why profiles work for this. VS Code scopes extension state per profile, so the provider, model, and instructions you set in the Cline panel belong to the active profile and do not bleed into your other environments. Switching profiles switches the agent's entire configuration with it. You can also write a .clinerules file in the root of your project directory. This file is read by the agent on startup and provides project-specific system instructions, ensuring the agent follows correct coding patterns, folder structures, and testing guidelines for that specific codebase.

Isolate agent environments in a secure cloud workspace

Provide your coding agents with shared, versioned cloud workspaces and built-in semantic search. Create your vscode profiles for cline environment and start your 14-day free trial on Fast.io to safely coordinate humans and agents in one unified workspace.

Start 14-Day Trial

Because VS Code's SecretStorage API shares credentials across profiles for the same extension, developers who need to isolate API keys for the same provider must use a different approach. If you must use 2 different Anthropic keys for work and personal projects, VS Code profiles alone will not prevent them from overwriting each other.

The solution is to launch VS Code with a custom user data directory. This tells the editor to run an entirely separate application instance, complete with its own configuration files, extension directory, global state, and system keychain namespace.

To launch VS Code with a custom user data directory on macOS or Linux, open your terminal and run the following command:

code --user-data-dir ~/Library/Application\ Support/Code-Work-Env ~/projects/work-repo

On Windows systems, you can launch the isolated instance by running:

code --user-data-dir "%APPDATA%\Code-Work-Env" C:\projects\work-repo

Using this command creates a new folder named Code-Work-Env inside your application support folder. This folder acts as a complete sandbox. Any API keys you enter in this instance are stored in a separate keychain location, preventing them from overlapping with your personal keys.

If you also want to keep your extensions completely separate, you can specify a custom extensions directory using the --extensions-dir flag:

code --user-data-dir ~/Library/Application\ Support/Code-Work-Env --extensions-dir ~/.vscode-work-extensions ~/projects/work-repo

Running this setup is the most stable way to guarantee absolute isolation between client environments. It ensures that no credentials, file caches, or settings are shared between work and personal projects, satisfying strict data isolation requirements. Refer to the Model Context Protocol specification site for protocol details, the Fast.io storage for agents page for the hosted server, and the onboarding guidelines for setup notes.

alias code-work="code --user-data-dir ~/Library/Application\ Support/Code-Work-Env"
alias code-personal="code --user-data-dir ~/Library/Application\ Support/Code-Personal-Env"

While VS Code profiles and custom user data directories isolate your local editor state, coordinating development work across teams and agents requires a shared substrate. Storing code bases on local hard drives or raw cloud buckets like S3 presents major limitations for teams. These configurations lack version tracking, have no built-in access controls, and fail to provide visibility into agent actions, leading to conflicts when multiple agents work on the same repository.

Fast.io provides a collaborative, cloud-backed workspace designed specifically for agentic teams. By storing files in Fast.io workspaces, humans and AI agents can collaborate securely on the same context. Every file stored in the workspace maintains a detailed version history, which allows you to inspect changes and restore previous versions if an agent writes faulty code. The platform records every file action in an append-only audit log, ensuring complete transparency and compliance.

Fast.io features Collaborative Notes for real-time co-editing and webhooks to notify external systems when files change. When you enable Intelligence Mode, the workspace automatically indexes all documents for hybrid search. This combines full-text search with meaning-based semantic search and metadata search, enabling agents to query files with citation-backed answers without configuring complex vector databases.

To connect your local Cline instance to the workspace, you can configure the Model Context Protocol (MCP) server. Rather than running local scripts that fail to resolve paths, the agent connects directly to the remote Fast.io MCP endpoint:

{
  "mcpServers": {
    "fastio-shared-workspace": {
      "url": "https://mcp.fast.io/mcp/key",
      "headers": {
        "Authorization": "Bearer your_fastio_api_key"
      }
    }
  }
}

This remote connection allows the agent to read and write files directly in the shared workspace, bypassing local file system limitations. Every organization starts with a 14-day free trial, which requires a credit card. Paid subscriptions include the Starter plan at USD 29 per month, the Business plan at USD 99 per month, and the Growth plan at USD 299 per month. Review the complete Fast.io pricing breakdown to select the right environment for your team. Using these shared workspaces helps teams build collaborative, secure development environments for people and agents alike.