@extension.dev/mcp 10.10.2 → 10.10.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "10.10.2",
+      "version": "10.10.3",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "10.10.2",
+  "version": "10.10.3",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 10.10.3
+
+- The engine pin moves off the canary to Extension.js `4.1.31` stable:
+  `extension_dev`, `extension_start` and `extension_build` spawn that
+  release when a project has no engine of its own, and the nightly
+  engine-pin check reads it against `latest` again.
+
+- A human now approves a real store submission and a promotion to stable
+  before either runs, by default. The first call answers
+  `approval-required` with an `approvalUrl` on extension.dev
+  (`/device/approve/<id>`) and an `approvalId`; once a workspace member
+  approves (an owner, for a submission), the same call with that
+  `approvalId` runs exactly that action, once. Promotions to other channels
+  and share revokes stay ungated unless `EXTENSION_DEV_APPROVAL_GATE=1`;
+  `EXTENSION_DEV_APPROVAL_GATE=0` turns the default off. Whatever the
+  setting, a platform that answers `APPROVAL_REQUIRED` now gets the same
+  approval flow instead of a bare failure.
+
+- Two server flags narrow what an agent can reach. `--features=local`
+  or `--features=platform` (env `EXTENSION_DEV_FEATURES`) lists one tool
+  group; `local` alone is about 40% smaller. `--no-ship` (env
+  `EXTENSION_DEV_NO_SHIP`) hides `extension_publish` and
+  `extension_release_promote` and refuses a real submit, a share link and
+  a share revoke, while dry runs and listing keep working. A refused call
+  answers the new code `E_TOOL_DISABLED` with the flag to change. Both
+  default to everything on, so no existing setup changes.
+- Every tool now carries MCP annotations (`readOnlyHint`,
+  `destructiveHint`, `idempotentHint`, `openWorldHint`) from one policy
+  table, so clients can auto-approve reads and ask before the rest. A
+  merged tool takes its worst action: `extension_shares` is destructive
+  because revoke is.
+- A device-flow step waiting on a human (`extension_auth` login,
+  `extension_project_create`, `extension_workspace_create`) now answers
+  `ok: true` with `status: "authorization-pending"` and no error, instead
+  of `ok: false` with `E_AUTH_PENDING`, so clients stop rendering the
+  first login step as a failure. The approval link and code stay in
+  `hint` and `value`; `E_AUTH_PENDING` is retired.
+
 ## 10.10.2
 
 - The engine pin moves to the Extension.js canary

package/README.md

@@ -75,6 +75,30 @@ Or install it as a plugin, the MCP server plus the `/extension`, `/extension-add
 }
 ```
 
+### Choosing what the agent can reach
+
+Two flags (or environment variables) narrow the server before an agent sees it:
+
+- `--features=local` exposes only the tools that work on this machine (create, run, inspect, build), which also cuts the tool list by about 40%. `--features=platform` exposes only the extension.dev account, share, release and store tools. Both are on by default. Env: `EXTENSION_DEV_FEATURES`.
+- `--no-ship` keeps everything that stays on this machine and refuses every call that reaches other people: `extension_publish`, `extension_release_promote`, `extension_submit` with `dryRun: false`, `extension_preview_web` with `share: true`, and a share revoke. Dry runs and share listing still work. Env: `EXTENSION_DEV_NO_SHIP=1`.
+
+A refused call answers `E_TOOL_DISABLED` with the flag to change.
+
+A real store submission and a promotion to stable also wait for a person by default: the first call answers `approval-required` with a link on extension.dev, a workspace member approves exactly that action, and the same call with the returned `approvalId` runs it once. `EXTENSION_DEV_APPROVAL_GATE=1` extends this to every promotion and share revoke; `EXTENSION_DEV_APPROVAL_GATE=0` turns it off.
+
+Every tool also carries MCP annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`), so clients can auto-approve reads and ask before the rest.
+
+```json
+{
+  "mcpServers": {
+    "extension-dev": {
+      "command": "npx",
+      "args": ["@extension.dev/mcp", "--no-ship"]
+    }
+  }
+}
+```
+
 ### Pair with the skill
 
 This server gives agents hands; [`@extension.dev/skill`](https://www.npmjs.com/package/@extension.dev/skill) gives them judgment: the cross-browser rules, silent-failure gotchas, debugging playbooks, and store checklist, packaged in the open [Agent Skills](https://agentskills.io) format. With both installed, agents know to verify against the live browser instead of guessing, and these tools make that a one-call operation.

package/bin/extension-mcp.js

@@ -8,7 +8,7 @@
 // Apache License 2.0 (c) 2026 Cezar Augusto and the extension.dev collaborators
 
 import {createRequire} from 'node:module'
-import {startServer, runCli} from '../dist/module.js'
+import {startServer, runCli, isServerFlag, resolveServerOptions} from '../dist/module.js'
 
 const require = createRequire(import.meta.url)
 const {version} = require('../package.json')
@@ -16,18 +16,28 @@ const {version} = require('../package.json')
 const usage = `@extension.dev/mcp ${version}
 
 Usage:
-  extension-mcp                 Start the MCP server on stdio
+  extension-mcp [flags]         Start the MCP server on stdio
   extension-mcp login [flags]   Device login at extension.dev
   extension-mcp logout          Remove the stored credentials
   extension-mcp whoami          Show the stored identity
   extension-mcp release [...]   Headless release commands
   extension-mcp --version       Print the version
+
+Server flags:
+  --features=local,platform     Tool groups to expose (default: both)
+  --no-ship                     Refuse publish, promote, real submits,
+                                share links and share revokes
 `
 
 const [, , cmd, ...rest] = process.argv
 
-if (cmd === undefined) {
-  startServer()
+if (cmd === undefined || isServerFlag(cmd)) {
+  const resolved = resolveServerOptions(process.argv.slice(2), process.env)
+  if (!resolved.ok) {
+    process.stderr.write(`${resolved.message}\n\n${usage}`)
+    process.exit(1)
+  }
+  startServer(resolved.options)
 } else if (['login', 'logout', 'whoami', 'release'].includes(cmd)) {
   runCli(cmd, rest)
     .then((code) => process.exit(code))

package/dist/module.d.ts

@@ -1 +1,2 @@
 export { startServer, runCli, version } from "./src/index";
+export { isServerFlag, resolveServerOptions } from "./src/lib/tool-policy";

package/dist/module.js

@@ -236,7 +236,7 @@ __webpack_require__.d(workspace_create_namespaceObject, {
     handler: ()=>workspace_create_handler,
     schema: ()=>workspace_create_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"10.10.2","El":{"OP":"4.1.31-canary.1791055414.4bbb683a"}}');
+var package_namespaceObject = JSON.parse('{"rE":"10.10.3","El":{"OP":"4.1.31"}}');
 const ENVELOPE_SCHEMA = 1;
 const collectWarnings = (warnings)=>{
     if (!warnings) return [];
@@ -1986,13 +1986,9 @@ function pendingEnvelope(start) {
     const hasCompleteLink = complete.length > 0 && complete !== start.verificationUri;
     const message = hasCompleteLink ? `Open ${complete} and approve creating the project (code ${start.userCode} is pre-filled), then call extension_project_create again with this deviceCode and the same arguments. If the page asks for a code, enter ${start.userCode} at ${start.verificationUri}.` : `Open ${start.verificationUri}, enter code ${start.userCode}, approve creating the project, then call extension_project_create again with this deviceCode and the same arguments.`;
     return envelope_envelope({
-        ok: false,
+        ok: true,
         command: project_create_COMMAND,
         status: "authorization-pending",
-        error: {
-            code: "E_AUTH_PENDING",
-            message
-        },
         value: {
             userCode: start.userCode,
             verificationUri: start.verificationUri,
@@ -2131,17 +2127,14 @@ async function project_create_handler(args) {
 async function finishFromPoll(poll, ctx) {
     if (!poll.ok) {
         if ("pending" === poll.reason) return envelope_envelope({
-            ok: false,
+            ok: true,
             command: project_create_COMMAND,
             status: "authorization-pending",
-            error: {
-                code: "E_AUTH_PENDING",
-                message: `Still waiting for approval at ${ctx.verificationUri}. Approve there, then call extension_project_create again with this same deviceCode.`
-            },
             value: {
                 verificationUri: ctx.verificationUri,
                 deviceCode: ctx.deviceCode
-            }
+            },
+            hint: `Still waiting for approval at ${ctx.verificationUri}. Approve there, then call extension_project_create again with this same deviceCode.`
         });
         if ("denied" === poll.reason) return fail("CreateDenied", "Creating the project was denied at extension.dev/device.", "create-denied", "E_AUTH_DENIED");
         if ("expired" === poll.reason) return fail("CreateExpired", "The device code expired. Run extension_project_create again to restart.", "create-expired", "E_AUTH_EXPIRED");
@@ -2332,13 +2325,9 @@ function workspace_create_pendingEnvelope(start) {
     const hasCompleteLink = complete.length > 0 && complete !== start.verificationUri;
     const message = hasCompleteLink ? `Open ${complete} and approve creating the workspace (code ${start.userCode} is pre-filled), then call ${workspace_create_COMMAND} again with this deviceCode and the same arguments. If the page asks for a code, enter ${start.userCode} at ${start.verificationUri}. The GitHub account that approves becomes the workspace owner.` : `Open ${start.verificationUri}, enter code ${start.userCode}, approve creating the workspace, then call ${workspace_create_COMMAND} again with this deviceCode and the same arguments. The GitHub account that approves becomes the workspace owner.`;
     return envelope_envelope({
-        ok: false,
+        ok: true,
         command: workspace_create_COMMAND,
         status: "authorization-pending",
-        error: {
-            code: "E_AUTH_PENDING",
-            message
-        },
         value: {
             userCode: start.userCode,
             verificationUri: start.verificationUri,
@@ -2419,17 +2408,14 @@ async function workspace_create_handler(args) {
 async function workspace_create_finishFromPoll(poll, ctx) {
     if (!poll.ok) {
         if ("pending" === poll.reason) return envelope_envelope({
-            ok: false,
+            ok: true,
             command: workspace_create_COMMAND,
             status: "authorization-pending",
-            error: {
-                code: "E_AUTH_PENDING",
-                message: `Still waiting for approval at ${ctx.verificationUri}. Approve there, then call ${workspace_create_COMMAND} again with this same deviceCode.`
-            },
             value: {
                 verificationUri: ctx.verificationUri,
                 deviceCode: ctx.deviceCode
-            }
+            },
+            hint: `Still waiting for approval at ${ctx.verificationUri}. Approve there, then call ${workspace_create_COMMAND} again with this same deviceCode.`
         });
         if ("denied" === poll.reason) return workspace_create_fail("CreateDenied", "Creating the workspace was denied at extension.dev/device.", "create-denied", "E_AUTH_DENIED");
         if ("expired" === poll.reason) return workspace_create_fail("CreateExpired", `The device code expired. Run ${workspace_create_COMMAND} again to restart.`, "create-expired", "E_AUTH_EXPIRED");
@@ -8204,6 +8190,9 @@ async function revokeArtifact(options) {
         error: {
             name: "SharesRevokeError",
             status: res.status,
+            ..."string" == typeof data?.code ? {
+                code: data.code
+            } : {},
             message: `Revoking ${options.artifactId} failed (${res.status}): ${data?.message || "unknown error"}`
         }
     };
@@ -9176,9 +9165,29 @@ const APPROVAL_GATE_ENV = "EXTENSION_DEV_APPROVAL_GATE";
 const APPROVAL_REQUIRED_STATUS = "approval-required";
 const APPROVAL_PENDING_STATUS = "approval-pending";
 const APPROVAL_REJECTED_STATUS = "approval-rejected";
-function approvalGateEnabled() {
+function approvalGateEnabled(defaultOn = false) {
     const raw = String(process.env[APPROVAL_GATE_ENV] || "").trim().toLowerCase();
-    return "" !== raw && "0" !== raw && "false" !== raw && "off" !== raw;
+    if ("" === raw) return defaultOn;
+    return "0" !== raw && "false" !== raw && "off" !== raw;
+}
+function platformRequiresApproval(res, data) {
+    return 403 === res.status && !!data && "object" == typeof data && "APPROVAL_REQUIRED" === data.code;
+}
+async function requestApprovalAfterRefusal(input) {
+    const gate = await evaluateApproval({
+        ...input,
+        approvalId: void 0,
+        enabled: true
+    });
+    return gate.blocked ? gate.envelope : envelope_envelope({
+        ok: false,
+        command: input.command,
+        status: APPROVAL_REQUIRED_STATUS,
+        error: {
+            code: "E_APPROVAL_REQUIRED",
+            message: "The platform requires an approval for this action."
+        }
+    });
 }
 function canonicalScope(scope) {
     return Object.keys(scope).sort().map((key)=>{
@@ -9666,18 +9675,19 @@ async function revokeShare(args) {
     const token = resolveToken({
         project: args.project
     });
+    const gateInput = {
+        command: "extension_shares",
+        action: "extension_shares.revoke",
+        scope: {
+            artifactId: ref
+        },
+        description: `Permanently revoke share ${ref}, killing the link for everyone with no way to restore it.`,
+        approvalId: args.approvalId,
+        token: token || "",
+        api: args.api
+    };
     if (token) {
-        const gate = await evaluateApproval({
-            command: "extension_shares",
-            action: "extension_shares.revoke",
-            scope: {
-                artifactId: ref
-            },
-            description: `Permanently revoke share ${ref}, killing the link for everyone with no way to restore it.`,
-            approvalId: args.approvalId,
-            token,
-            api: args.api
-        });
+        const gate = await evaluateApproval(gateInput);
         if (gate.blocked) return gate.envelope;
     }
     const result = await revokeArtifact({
@@ -9703,6 +9713,7 @@ async function revokeShare(args) {
                 artifactId: ref
             }
         });
+        if (token && !args.approvalId && 403 === result.error.status && "APPROVAL_REQUIRED" === result.error.code) return requestApprovalAfterRefusal(gateInput);
         const isAuth = "SharesAuthError" === result.error.name;
         return envelope_envelope({
             ok: false,
@@ -15393,7 +15404,7 @@ async function release_promote_handler(args) {
     const url = `${apiCheck.base}/api/cli/release/promote`;
     const sourceChannel = args.sourceChannel ? String(args.sourceChannel).trim() : "";
     const gateBrowsers = (Array.isArray(args.browsers) ? args.browsers : []).map((b)=>String(b).trim()).filter(Boolean);
-    const gate = await evaluateApproval({
+    const gateInput = {
         command: "extension_release_promote",
         action: "extension_release_promote",
         scope: {
@@ -15412,6 +15423,10 @@ async function release_promote_handler(args) {
         approvalId: args.approvalId,
         token,
         api: args.api
+    };
+    const gate = await evaluateApproval({
+        ...gateInput,
+        enabled: approvalGateEnabled("stable" === channel)
     });
     if (gate.blocked) return gate.envelope;
     const body = {
@@ -15456,6 +15471,7 @@ async function release_promote_handler(args) {
                 buildId
             }
         });
+        if (!args.approvalId && platformRequiresApproval(res, data)) return requestApprovalAfterRefusal(gateInput);
         const code = "string" == typeof data?.code ? data.code : void 0;
         const enrich = {};
         let hint = "";
@@ -16090,21 +16106,25 @@ async function submit_handler(args) {
     };
     if (args.channel) body.channel = String(args.channel).trim();
     if (args.version) body.version = String(args.version).trim();
+    const gateInput = {
+        command: "extension_submit",
+        action: "extension_submit",
+        scope: {
+            browsers: [
+                ...browsers
+            ].sort(),
+            buildSha: buildSha.toLowerCase(),
+            channel
+        },
+        description: `Submit build ${buildSha} to ${browsers.join(", ")} for store review.`,
+        approvalId: args.approvalId,
+        token,
+        api: args.api
+    };
     if (!dryRun) {
         const gate = await evaluateApproval({
-            command: "extension_submit",
-            action: "extension_submit",
-            scope: {
-                browsers: [
-                    ...browsers
-                ].sort(),
-                buildSha: buildSha.toLowerCase(),
-                channel
-            },
-            description: `Submit build ${buildSha} to ${browsers.join(", ")} for store review.`,
-            approvalId: args.approvalId,
-            token,
-            api: args.api
+            ...gateInput,
+            enabled: approvalGateEnabled(true)
         });
         if (gate.blocked) return gate.envelope;
         if (gate.approvalId) body.approvalId = gate.approvalId;
@@ -16144,6 +16164,7 @@ async function submit_handler(args) {
                 dryRun
             }
         });
+        if (!dryRun && !args.approvalId && platformRequiresApproval(res, data)) return requestApprovalAfterRefusal(gateInput);
         return submit_fail("SubmitError", `${dryRun ? "preflight" : "submit"} failed (${res.status}): ${data?.message || text || "unknown error"}`, "submit-failed", "E_PLATFORM");
     }
     const warnings = Array.isArray(data?.warnings) ? [
@@ -16793,13 +16814,9 @@ function login_pending(start) {
     const hasCompleteLink = complete.length > 0 && complete !== start.verificationUri;
     const message = hasCompleteLink ? `Open ${complete} and approve (code ${start.userCode} is pre-filled), then call extension_auth (action: login) again with this deviceCode and the same project. If the page asks for a code, enter ${start.userCode} at ${start.verificationUri}.` : `Open ${start.verificationUri} and enter code ${start.userCode}, then call extension_auth (action: login) again with this deviceCode and the same project.`;
     return envelope_envelope({
-        ok: false,
+        ok: true,
         command: "extension_auth",
         status: "authorization-pending",
-        error: {
-            code: "E_AUTH_PENDING",
-            message
-        },
         value: {
             userCode: start.userCode,
             verificationUri: start.verificationUri,
@@ -16818,13 +16835,9 @@ function login_pending(start) {
 function resumePending(deviceCode, verificationUri) {
     const message = `Still waiting for authorization. The one-click link and code from the previous response are still valid: open that link (or enter the code at ${verificationUri}), then call extension_auth (action: login) again with this same deviceCode and the same project.`;
     return envelope_envelope({
-        ok: false,
+        ok: true,
         command: "extension_auth",
         status: "authorization-pending",
-        error: {
-            code: "E_AUTH_PENDING",
-            message
-        },
         value: {
             verificationUri,
             deviceCode,
@@ -17843,6 +17856,288 @@ function inputValidationError(toolName, issues, inputSchema) {
         }
     });
 }
+const FEATURE_GROUPS = [
+    "local",
+    "platform"
+];
+const FEATURES_ENV = "EXTENSION_DEV_FEATURES";
+const NO_SHIP_ENV = "EXTENSION_DEV_NO_SHIP";
+const reads = (openWorld = false)=>({
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: openWorld
+    });
+const acts = (over = {})=>({
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false,
+        ...over
+    });
+const TOOL_POLICY = {
+    extension_create: {
+        group: "local",
+        annotations: acts({
+            openWorldHint: true
+        })
+    },
+    extension_templates: {
+        group: "local",
+        annotations: reads(true)
+    },
+    extension_add_feature: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_build: {
+        group: "local",
+        annotations: acts({
+            idempotentHint: true
+        })
+    },
+    extension_dev: {
+        group: "local",
+        annotations: acts()
+    },
+    extension_start: {
+        group: "local",
+        annotations: acts()
+    },
+    extension_wait: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_stop: {
+        group: "local",
+        annotations: acts({
+            idempotentHint: true
+        })
+    },
+    extension_manifest_validate: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_theme_verify: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_analyze: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_assert: {
+        group: "local",
+        annotations: acts({
+            idempotentHint: true
+        })
+    },
+    extension_inspect: {
+        group: "local",
+        annotations: acts({
+            idempotentHint: true
+        })
+    },
+    extension_dom_snapshot: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_list_extensions: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_logs: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_doctor: {
+        group: "local",
+        annotations: reads()
+    },
+    extension_eval: {
+        group: "local",
+        annotations: acts({
+            destructiveHint: true,
+            openWorldHint: true
+        })
+    },
+    extension_storage: {
+        group: "local",
+        annotations: acts({
+            destructiveHint: true
+        })
+    },
+    extension_reload: {
+        group: "local",
+        annotations: acts({
+            idempotentHint: true
+        })
+    },
+    extension_open: {
+        group: "local",
+        annotations: acts({
+            openWorldHint: true
+        })
+    },
+    extension_browsers: {
+        group: "local",
+        annotations: acts({
+            destructiveHint: true,
+            openWorldHint: true
+        })
+    },
+    extension_auth: {
+        group: "platform",
+        annotations: acts({
+            openWorldHint: true
+        })
+    },
+    extension_workspace_create: {
+        group: "platform",
+        annotations: acts({
+            openWorldHint: true
+        })
+    },
+    extension_project_create: {
+        group: "platform",
+        annotations: acts({
+            openWorldHint: true
+        })
+    },
+    extension_preview_web: {
+        group: "platform",
+        annotations: acts({
+            openWorldHint: true
+        }),
+        ships: (args)=>true === args.share
+    },
+    extension_shares: {
+        group: "platform",
+        annotations: acts({
+            destructiveHint: true,
+            openWorldHint: true
+        }),
+        ships: (args)=>"revoke" === args.action
+    },
+    extension_publish: {
+        group: "platform",
+        annotations: acts({
+            openWorldHint: true
+        }),
+        ships: "always"
+    },
+    extension_release_status: {
+        group: "platform",
+        annotations: reads(true)
+    },
+    extension_release_promote: {
+        group: "platform",
+        annotations: acts({
+            destructiveHint: true,
+            openWorldHint: true
+        }),
+        ships: "always"
+    },
+    extension_submit: {
+        group: "platform",
+        annotations: acts({
+            destructiveHint: true,
+            openWorldHint: true
+        }),
+        ships: (args)=>false === args.dryRun
+    }
+};
+const DEFAULT_SERVER_OPTIONS = {
+    features: [
+        ...FEATURE_GROUPS
+    ],
+    noShip: false
+};
+const truthy = (raw)=>{
+    const value = String(raw ?? "").trim().toLowerCase();
+    return "" !== value && "0" !== value && "false" !== value && "off" !== value;
+};
+function isServerFlag(arg) {
+    return "--no-ship" === arg || "--features" === arg || arg.startsWith("--features=");
+}
+function resolveServerOptions(argv, env) {
+    let rawFeatures = env[FEATURES_ENV];
+    let noShip = truthy(env[NO_SHIP_ENV]);
+    for(let i = 0; i < argv.length; i++){
+        const arg = argv[i];
+        if ("--no-ship" === arg) noShip = true;
+        else if ("--features" === arg) rawFeatures = argv[++i] ?? "";
+        else {
+            if (!arg.startsWith("--features=")) return {
+                ok: false,
+                message: `Unknown flag "${arg}".`
+            };
+            rawFeatures = arg.slice(11);
+        }
+    }
+    if (void 0 === rawFeatures || "" === rawFeatures.trim()) return {
+        ok: true,
+        options: {
+            features: [
+                ...FEATURE_GROUPS
+            ],
+            noShip
+        }
+    };
+    const names = rawFeatures.split(",").map((name)=>name.trim().toLowerCase()).filter(Boolean);
+    const unknown = names.filter((name)=>!FEATURE_GROUPS.includes(name));
+    if (unknown.length) return {
+        ok: false,
+        message: `Unknown feature group ${unknown.map((n)=>`"${n}"`).join(", ")}. Use ${FEATURE_GROUPS.join(" or ")}, comma-separated.`
+    };
+    const features = FEATURE_GROUPS.filter((group)=>names.includes(group));
+    return {
+        ok: true,
+        options: {
+            features,
+            noShip
+        }
+    };
+}
+function isToolListed(name, options) {
+    const policy = TOOL_POLICY[name];
+    if (!policy) return false;
+    if (!options.features.includes(policy.group)) return false;
+    return !(options.noShip && "always" === policy.ships);
+}
+function disabledToolEnvelope(name, args, options) {
+    const policy = TOOL_POLICY[name];
+    if (!policy) return null;
+    if (!options.features.includes(policy.group)) return envelope_envelope({
+        ok: false,
+        command: name,
+        status: "tool-disabled",
+        error: {
+            code: "E_TOOL_DISABLED",
+            message: `${name} is in the "${policy.group}" feature group, which this server was started without.`
+        },
+        value: {
+            group: policy.group,
+            features: options.features
+        },
+        hint: `Add ${policy.group} to --features (or ${FEATURES_ENV}) in this server's MCP config, or ask the user to.`
+    });
+    const ships = "always" === policy.ships || "function" == typeof policy.ships && policy.ships(args);
+    if (options.noShip && ships) return envelope_envelope({
+        ok: false,
+        command: name,
+        status: "tool-disabled",
+        error: {
+            code: "E_TOOL_DISABLED",
+            message: `${name} with these arguments reaches people outside this machine, and this server was started in no-ship mode.`
+        },
+        value: {
+            noShip: true
+        },
+        hint: `Dry runs, previews without share, and listing still work. To ship, the user removes --no-ship (or ${NO_SHIP_ENV}) from this server's MCP config.`
+    });
+    return null;
+}
 const tools = [
     create_namespaceObject,
     templates_namespaceObject,
@@ -17898,8 +18193,8 @@ function toolResultFrame(result) {
 }
 const toolMap = new Map();
 for (const tool of tools)toolMap.set(tool.schema.name, tool);
-const SERVER_INSTRUCTIONS = "extension-dev runs, inspects, drives, builds and publishes browser extensions (Chrome, Edge, Firefox, Safari and the other Chromium and Gecko browsers) through Extension.js and extension.dev.\nWhen the ask is to run, start, wait for, watch, inspect, drive, test, debug or build a browser extension, search this server first and use its tools: extension_dev starts the dev session (allowEval: true also turns on control), extension_wait blocks until it is ready, extension_logs streams its console, extension_open opens a surface or a url, extension_dom_snapshot and extension_inspect read a live page, extension_eval runs code in a context, extension_build makes a store-ready bundle, extension_stop ends the session.\nThese replace hand-rolled ps, curl, remote-debugging-port lookups and CDP or Playwright scripts: the server already holds the session's debug port, the extension id and the session token.\nEvery tool answers one JSON envelope {ok, status, value, error, hint, warnings}; read hint and warnings before choosing the next call, and treat ok: false as the answer, not a transport error.";
-function createServer() {
+const SERVER_INSTRUCTIONS = "extension-dev runs, inspects, drives, builds and publishes browser extensions (Chrome, Edge, Firefox, Safari and the other Chromium and Gecko browsers) through Extension.js and extension.dev.\nWhen the ask is to run, start, wait for, watch, inspect, drive, test, debug or build a browser extension, search this server first and use its tools: extension_dev starts the dev session (allowEval: true also turns on control), extension_wait blocks until it is ready, extension_logs streams its console, extension_open opens a surface or a url, extension_dom_snapshot and extension_inspect read a live page, extension_eval runs code in a context, extension_build makes a store-ready bundle, extension_stop ends the session.\nThese replace hand-rolled ps, curl, remote-debugging-port lookups and CDP or Playwright scripts: the server already holds the session's debug port, the extension id and the session token.\nEvery tool answers one JSON envelope {ok, status, value, error, hint, warnings}; read hint and warnings before choosing the next call, and treat ok: false as the answer, not a transport error. status authorization-pending is ok: true and means a human approves at the link in hint before you call again; it is not done yet.";
+function createServer(options = DEFAULT_SERVER_OPTIONS) {
     const server = new Server({
         name: "extension-dev",
         version: package_namespaceObject.rE
@@ -17910,10 +18205,11 @@ function createServer() {
         instructions: SERVER_INSTRUCTIONS
     });
     server.setRequestHandler(ListToolsRequestSchema, async ()=>({
-            tools: tools.map((t)=>({
+            tools: tools.filter((t)=>isToolListed(t.schema.name, options)).map((t)=>({
                     name: t.schema.name,
                     description: t.schema.description,
-                    inputSchema: t.schema.inputSchema
+                    inputSchema: t.schema.inputSchema,
+                    annotations: TOOL_POLICY[t.schema.name].annotations
                 }))
         }));
     server.setRequestHandler(CallToolRequestSchema, async (request)=>{
@@ -17932,7 +18228,7 @@ function createServer() {
                             message: `Unknown tool: ${name}`
                         },
                         value: {
-                            availableTools: tools.map((t)=>t.schema.name)
+                            availableTools: tools.map((t)=>t.schema.name).filter((toolName)=>isToolListed(toolName, options))
                         }
                     })
                 }
@@ -17940,6 +18236,16 @@ function createServer() {
             isError: true
         };
         const normalizedArgs = normalizeArgAliases(tool.schema.inputSchema, args ?? {});
+        const disabled = disabledToolEnvelope(name, normalizedArgs, options);
+        if (disabled) return {
+            content: [
+                {
+                    type: "text",
+                    text: disabled
+                }
+            ],
+            isError: true
+        };
         const issues = validateToolInput(tool.schema.inputSchema, normalizedArgs);
         if (issues.length) return {
             content: [
@@ -17976,9 +18282,9 @@ function createServer() {
     });
     return server;
 }
-async function startServer() {
+async function startServer(options = DEFAULT_SERVER_OPTIONS) {
     installCarrierExitCleanup();
-    const server = createServer();
+    const server = createServer(options);
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }
@@ -18074,4 +18380,4 @@ async function runCli(cmd, args) {
     return 1;
 }
 var version_0 = package_namespaceObject.rE;
-export { runCli, startServer, version_0 as version };
+export { isServerFlag, resolveServerOptions, runCli, startServer, version_0 as version };

package/dist/src/index.d.ts

@@ -1,6 +1,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { version } from "../package.json";
 export { version };
+import { type ServerOptions } from "./lib/tool-policy";
 export interface ToolModule {
     schema: {
         name: string;
@@ -18,6 +19,6 @@ export declare function toolResultFrame(result: string): {
     isError?: boolean;
 };
 export declare const SERVER_INSTRUCTIONS: string;
-export declare function createServer(): Server;
-export declare function startServer(): Promise<void>;
+export declare function createServer(options?: ServerOptions): Server;
+export declare function startServer(options?: ServerOptions): Promise<void>;
 export declare function runCli(cmd: string, args: string[]): Promise<number>;

package/dist/src/lib/approval-gate.d.ts

@@ -2,7 +2,11 @@ export declare const APPROVAL_GATE_ENV = "EXTENSION_DEV_APPROVAL_GATE";
 export declare const APPROVAL_REQUIRED_STATUS = "approval-required";
 export declare const APPROVAL_PENDING_STATUS = "approval-pending";
 export declare const APPROVAL_REJECTED_STATUS = "approval-rejected";
-export declare function approvalGateEnabled(): boolean;
+export declare function approvalGateEnabled(defaultOn?: boolean): boolean;
+export declare function platformRequiresApproval(res: {
+    status: number;
+}, data: unknown): boolean;
+export declare function requestApprovalAfterRefusal(input: ApprovalGateInput): Promise<string>;
 export type ApprovalScope = Record<string, string | string[]>;
 export declare function actionFingerprint(action: string, scope: ApprovalScope): string;
 export interface ApprovalGateInput {

package/dist/src/lib/artifacts-api.d.ts

@@ -55,6 +55,7 @@ export type ArtifactsOutcome<T> = {
         name: string;
         message: string;
         status?: number;
+        code?: string;
     };
     held?: boolean;
     body?: unknown;

package/dist/src/lib/envelope.d.ts

@@ -1,6 +1,6 @@
 export declare const ENVELOPE_SCHEMA: 1;
 export declare const DECISION_D6 = "The MCP tool name owns the envelope `command` key; forking the key to `tool` would fork the schema the checksum test pins.";
-export type ErrorCode = "E_AMBIGUOUS_TARGET" | "E_APPROVAL_PENDING" | "E_APPROVAL_REJECTED" | "E_APPROVAL_REQUIRED" | "E_AUTH_DENIED" | "E_AUTH_EXPIRED" | "E_AUTH_FAILED" | "E_AUTH_PENDING" | "E_AUTH_REQUIRED" | "E_BAD_HOST_URL" | "E_BAD_MANIFEST" | "E_BAD_REQUEST" | "E_BRIDGE" | "E_BROWSER_EXITED" | "E_BROWSER_INSTALL" | "E_BROWSER_UNINSTALL" | "E_BUILD_FAILED" | "E_CARRIER_IN_DIST" | "E_CDP" | "E_CLI" | "E_COMPILE" | "E_CONFIG" | "E_CONTRACT_ERROR" | "E_CONTROL_CHANNEL" | "E_CONTROL_ENVELOPE" | "E_ENGINE_TOO_OLD" | "E_ENTRYPOINT_MISSING" | "E_FIRST_COMPILE" | "E_INPUT_VALIDATION" | "E_INTERNAL" | "E_INVALID_BUNDLE_ID" | "E_LOGS_MISSING" | "E_MANIFEST_BLOCKING" | "E_MANIFEST_NOT_FOUND" | "E_NAVIGATE_ERROR" | "E_NAVIGATE_FAILED" | "E_NETWORK" | "E_NO_CONTROL_CHANNEL" | "E_NO_DIST" | "E_NO_EXTENSION_ID" | "E_NO_MATCHING_TARGET" | "E_NO_REFERENCE_TEMPLATE" | "E_NO_SESSION" | "E_NO_SURFACE_DOCUMENT" | "E_NO_TARGET" | "E_NOT_ATTACHED" | "E_PARSE" | "E_PLATFORM" | "E_PREVIEW_HOST_UNREACHABLE" | "E_PROFILE_LOCKED" | "E_RDP" | "E_SAFARI_ONLY_OPTION" | "E_EVAL" | "E_SCAFFOLD_FAILED" | "E_SCAFFOLD_INCOMPLETE" | "E_SESSION_EXISTS" | "E_SESSION_EXITED" | "E_STALE_CONTRACT" | "E_SURFACE_DID_NOT_OPEN" | "E_TEMPLATE_FETCH" | "E_TEMPLATE_NOT_FOUND" | "E_UNKNOWN_COMMAND" | "E_UNKNOWN_TOOL" | "E_UNSUPPORTED_BROWSER" | "E_WAIT_TIMEOUT";
+export type ErrorCode = "E_AMBIGUOUS_TARGET" | "E_APPROVAL_PENDING" | "E_APPROVAL_REJECTED" | "E_APPROVAL_REQUIRED" | "E_AUTH_DENIED" | "E_AUTH_EXPIRED" | "E_AUTH_FAILED" | "E_AUTH_REQUIRED" | "E_BAD_HOST_URL" | "E_BAD_MANIFEST" | "E_BAD_REQUEST" | "E_BRIDGE" | "E_BROWSER_EXITED" | "E_BROWSER_INSTALL" | "E_BROWSER_UNINSTALL" | "E_BUILD_FAILED" | "E_CARRIER_IN_DIST" | "E_CDP" | "E_CLI" | "E_COMPILE" | "E_CONFIG" | "E_CONTRACT_ERROR" | "E_CONTROL_CHANNEL" | "E_CONTROL_ENVELOPE" | "E_ENGINE_TOO_OLD" | "E_ENTRYPOINT_MISSING" | "E_FIRST_COMPILE" | "E_INPUT_VALIDATION" | "E_INTERNAL" | "E_INVALID_BUNDLE_ID" | "E_LOGS_MISSING" | "E_MANIFEST_BLOCKING" | "E_MANIFEST_NOT_FOUND" | "E_NAVIGATE_ERROR" | "E_NAVIGATE_FAILED" | "E_NETWORK" | "E_NO_CONTROL_CHANNEL" | "E_NO_DIST" | "E_NO_EXTENSION_ID" | "E_NO_MATCHING_TARGET" | "E_NO_REFERENCE_TEMPLATE" | "E_NO_SESSION" | "E_NO_SURFACE_DOCUMENT" | "E_NO_TARGET" | "E_NOT_ATTACHED" | "E_PARSE" | "E_PLATFORM" | "E_PREVIEW_HOST_UNREACHABLE" | "E_PROFILE_LOCKED" | "E_RDP" | "E_SAFARI_ONLY_OPTION" | "E_EVAL" | "E_SCAFFOLD_FAILED" | "E_SCAFFOLD_INCOMPLETE" | "E_SESSION_EXISTS" | "E_SESSION_EXITED" | "E_STALE_CONTRACT" | "E_SURFACE_DID_NOT_OPEN" | "E_TEMPLATE_FETCH" | "E_TEMPLATE_NOT_FOUND" | "E_TOOL_DISABLED" | "E_UNKNOWN_COMMAND" | "E_UNKNOWN_TOOL" | "E_UNSUPPORTED_BROWSER" | "E_WAIT_TIMEOUT";
 export declare const ERROR_CODES: ErrorCode[];
 export interface EnvelopeError {
     code: ErrorCode | string;

package/dist/src/lib/tool-policy.d.ts

@@ -0,0 +1,33 @@
+export type FeatureGroup = "local" | "platform";
+export declare const FEATURE_GROUPS: FeatureGroup[];
+export declare const FEATURES_ENV = "EXTENSION_DEV_FEATURES";
+export declare const NO_SHIP_ENV = "EXTENSION_DEV_NO_SHIP";
+export interface ToolAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
+}
+type Args = Record<string, unknown>;
+export interface ToolPolicy {
+    group: FeatureGroup;
+    annotations: ToolAnnotations;
+    ships?: "always" | ((args: Args) => boolean);
+}
+export declare const TOOL_POLICY: Record<string, ToolPolicy>;
+export interface ServerOptions {
+    features: FeatureGroup[];
+    noShip: boolean;
+}
+export declare const DEFAULT_SERVER_OPTIONS: ServerOptions;
+export declare function isServerFlag(arg: string): boolean;
+export declare function resolveServerOptions(argv: string[], env: Record<string, string | undefined>): {
+    ok: true;
+    options: ServerOptions;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function isToolListed(name: string, options: ServerOptions): boolean;
+export declare function disabledToolEnvelope(name: string, args: Args, options: ServerOptions): string | null;
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "10.10.2",
+  "version": "10.10.3",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 31 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "Apache-2.0",
@@ -91,9 +91,9 @@
     "@modelcontextprotocol/sdk": "^1.12.1",
     "browser-extension-manifest-fields": "^2.2.9",
     "cross-spawn": "^7.0.6",
-    "extension-create": "4.1.31-canary.1791055414.4bbb683a",
-    "extension-develop": "4.1.31-canary.1791055414.4bbb683a",
-    "extension-install": "4.1.31-canary.1791055414.4bbb683a",
+    "extension-create": "4.1.31",
+    "extension-develop": "4.1.31",
+    "extension-install": "4.1.31",
     "ws": "^8.20.0"
   },
   "devDependencies": {

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "10.10.2",
+  "version": "10.10.3",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "10.10.2",
+      "version": "10.10.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"