Score the privilege a Chrome MV3 extension takes from its manifest, and diff permission sets.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Static privilege analysis of a Chrome MV3 manifest.json. Returns a 0-100 risk score, the permissions and host patterns that drive it, dangerous permission combinations, and MV3 policy problems (remote code, unsafe-eval, <all_urls> web_accessible_resources). Content-script matches are counted as host access even when host_permissions is empty.
The manifest.json content, as a JSON object or a JSON string.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Static privilege analysis of a Chrome MV3 manifest.json. Returns a 0-100 risk score, the permissions and host patterns that drive it, dangerous permission combinations, and MV3 policy problems (remote code, unsafe-eval, <all_urls> web_accessible_resources). Content-script matches are counted as host access even when host_permissions is empty.
| Argument | Type | Description |
|---|---|---|
| manifest* | any | The manifest.json content, as a JSON object or a JSON string. |
{
"type": "object",
"required": [
"manifest"
],
"properties": {
"manifest": {
"description": "The manifest.json content, as a JSON object or a JSON string."
}
}
}Compares the permissions and host patterns of two versions of an extension. Reports the score delta, what was added or removed, and whether the change widens the install-time warning set, which makes Chrome disable the extension for existing users until they re-accept.
| Argument | Type | Description |
|---|---|---|
| after* | array | API permissions in the new version. |
| before* | array | API permissions in the current published version. |
| after_hosts | array | host_permissions in the new version. |
| before_hosts | array | host_permissions in the current published version. |
{
"type": "object",
"required": [
"before",
"after"
],
"properties": {
"after": {
"type": "array",
"items": {
"type": "string"
},
"description": "API permissions in the new version."
},
"before": {
"type": "array",
"items": {
"type": "string"
},
"description": "API permissions in the current published version."
},
"after_hosts": {
"type": "array",
"items": {
"type": "string"
},
"description": "host_permissions in the new version."
},
"before_hosts": {
"type": "array",
"items": {
"type": "string"
},
"description": "host_permissions in the current published version."
}
}
}Returns the privilege weight (0-10) for a single Chrome extension permission or host pattern, what it actually grants, whether it triggers an install-time warning, and the narrower alternative if one exists.
| Argument | Type | Description |
|---|---|---|
| permission* | string | A permission name such as cookies, or a host pattern such as <all_urls>. |
{
"type": "object",
"required": [
"permission"
],
"properties": {
"permission": {
"type": "string",
"description": "A permission name such as cookies, or a host pattern such as <all_urls>."
}
}
}