@extension.dev/mcp 10.10.3 → 10.10.4

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "10.10.3",
+      "version": "10.10.4",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "10.10.3",
+  "version": "10.10.4",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 10.10.4
+
+- `--project <workspace>/<project>` (env `EXTENSION_DEV_PROJECT`) pins a
+  server to one project. Every unnamed credential read takes that
+  project's login instead of the most recent one, an agent signed in to
+  several projects can no longer act on the wrong one, and a call that
+  names a different project is refused with `status: "project-pinned"`.
+  A pinned project with no stored login falls back to
+  `EXTENSION_DEV_TOKEN`, so CI keeps working.
+- New `@extension.dev/mcp/clients` export: `CLIENTS` and
+  `buildRecipe({ client, reach, strictApproval, project })` build the
+  exact setup for Claude Code, Cursor, VS Code, Codex and any
+  `mcpServers` client. The README's Setup section is generated from it
+  (`pnpm readme:clients`, checked by a spec), and the extension.dev
+  console's Connect dialog renders the same recipes, so the instructions
+  cannot drift. It never emits a setting that turns approvals off.
+
 ## 10.10.3
 
 - The engine pin moves off the canary to Extension.js `4.1.31` stable:

package/README.md

@@ -45,10 +45,12 @@ Built on [Extension.js](https://extension.js.org), the open-source cross-browser
 
 ## Setup
 
+<!-- setup:start (generated from src/clients, run pnpm readme:clients) -->
+
 ### Claude Code
 
 ```bash
-claude mcp add extension-dev npx @extension.dev/mcp
+claude mcp add extension-dev -- npx @extension.dev/mcp
 ```
 
 Or install it as a plugin, the MCP server plus the `/extension`, `/extension-add`, `/extension-debug`, and `/extension-publish` commands in one step:
@@ -62,19 +64,84 @@ Or install it as a plugin, the MCP server plus the `/extension`, `/extension-add
 
 [![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=extension-dev&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJAZXh0ZW5zaW9uLmRldi9tY3AiXX0%3D)
 
-### Claude Desktop / `.mcp.json`
+`.cursor/mcp.json`:
 
 ```json
 {
   "mcpServers": {
     "extension-dev": {
       "command": "npx",
-      "args": ["@extension.dev/mcp"]
+      "args": [
+        "@extension.dev/mcp"
+      ]
     }
   }
 }
 ```
 
+### VS Code (Also GitHub Copilot)
+
+```bash
+code --add-mcp '{"name":"extension-dev","command":"npx","args":["@extension.dev/mcp"]}'
+```
+
+`.vscode/mcp.json`:
+
+```json
+{
+  "servers": {
+    "extension-dev": {
+      "type": "stdio",
+      "command": "npx",
+      "args": [
+        "@extension.dev/mcp"
+      ]
+    }
+  }
+}
+```
+
+### Codex
+
+```bash
+codex mcp add extension-dev -- npx @extension.dev/mcp
+```
+
+`~/.codex/config.toml`:
+
+```toml
+[mcp_servers.extension-dev]
+command = "npx"
+args = ["@extension.dev/mcp"]
+```
+
+### Other clients (Claude Desktop and .mcp.json)
+
+`.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "extension-dev": {
+      "command": "npx",
+      "args": [
+        "@extension.dev/mcp"
+      ]
+    }
+  }
+}
+```
+
+### Signing in and pinning a project
+
+The platform tools need a login. Sign in once per project, then add `--project <workspace>/<project>` to the server's arguments (or set `EXTENSION_DEV_PROJECT`) so that server only ever acts on that project, however many logins this machine holds. The console's Connect dialog fills both in for your project.
+
+```bash
+npx @extension.dev/mcp login --project <workspace>/<project>
+```
+
+<!-- setup:end -->
+
 ### Choosing what the agent can reach
 
 Two flags (or environment variables) narrow the server before an agent sees it:

package/bin/extension-mcp.js

@@ -27,6 +27,7 @@ Server flags:
   --features=local,platform     Tool groups to expose (default: both)
   --no-ship                     Refuse publish, promote, real submits,
                                 share links and share revokes
+  --project <workspace>/<proj>  Use only this project's login
 `
 
 const [, , cmd, ...rest] = process.argv

package/dist/clients.js

@@ -0,0 +1,157 @@
+const CLIENTS = [
+    {
+        id: "claude-code",
+        label: "Claude Code"
+    },
+    {
+        id: "cursor",
+        label: "Cursor"
+    },
+    {
+        id: "vscode",
+        label: "VS Code",
+        subtitle: "Also GitHub Copilot"
+    },
+    {
+        id: "codex",
+        label: "Codex"
+    },
+    {
+        id: "json",
+        label: "Other clients",
+        subtitle: "Claude Desktop and .mcp.json"
+    }
+];
+const SERVER_NAME = "extension-dev";
+const PACKAGE = "@extension.dev/mcp";
+function serverArgs(input) {
+    const args = [
+        PACKAGE
+    ];
+    if ("local" !== input.reach && input.project) args.push("--project", input.project);
+    if ("no-ship" === input.reach) args.push("--no-ship");
+    if ("local" === input.reach) args.push("--features=local");
+    return args;
+}
+function serverEnv(input) {
+    return "everything" === input.reach && input.strictApproval ? {
+        EXTENSION_DEV_APPROVAL_GATE: "1"
+    } : {};
+}
+const shellQuote = (value)=>/^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+const base64 = (text)=>"function" == typeof btoa ? btoa(text) : globalThis.Buffer.from(text).toString("base64");
+const tomlString = (value)=>JSON.stringify(value);
+function loginCommand(project) {
+    return `npx ${PACKAGE} login --project ${shellQuote(project)}`;
+}
+function buildRecipe(input) {
+    const args = serverArgs(input);
+    const env = serverEnv(input);
+    const envEntries = Object.entries(env);
+    const stdio = {
+        command: "npx",
+        args,
+        ...envEntries.length ? {
+            env
+        } : {}
+    };
+    const login = loginCommand(input.project);
+    const argLine = args.map(shellQuote).join(" ");
+    switch(input.client){
+        case "claude-code":
+            return {
+                client: "claude-code",
+                command: [
+                    "claude mcp add",
+                    SERVER_NAME,
+                    ...envEntries.map(([k, v])=>`-e ${k}=${shellQuote(v)}`),
+                    "-- npx",
+                    argLine
+                ].join(" "),
+                login
+            };
+        case "cursor":
+            return {
+                client: "cursor",
+                deeplink: `https://cursor.com/en/install-mcp?name=${SERVER_NAME}&config=${encodeURIComponent(base64(JSON.stringify(stdio)))}`,
+                config: {
+                    language: "json",
+                    path: ".cursor/mcp.json",
+                    text: JSON.stringify({
+                        mcpServers: {
+                            [SERVER_NAME]: stdio
+                        }
+                    }, null, 2)
+                },
+                login
+            };
+        case "vscode":
+            {
+                const named = {
+                    name: SERVER_NAME,
+                    ...stdio
+                };
+                return {
+                    client: "vscode",
+                    command: `code --add-mcp ${shellQuote(JSON.stringify(named))}`,
+                    deeplink: `vscode:mcp/install?${encodeURIComponent(JSON.stringify(named))}`,
+                    config: {
+                        language: "json",
+                        path: ".vscode/mcp.json",
+                        text: JSON.stringify({
+                            servers: {
+                                [SERVER_NAME]: {
+                                    type: "stdio",
+                                    ...stdio
+                                }
+                            }
+                        }, null, 2)
+                    },
+                    login
+                };
+            }
+        case "codex":
+            {
+                const lines = [
+                    `[mcp_servers.${SERVER_NAME}]`,
+                    'command = "npx"',
+                    `args = [${args.map(tomlString).join(", ")}]`
+                ];
+                if (envEntries.length) {
+                    lines.push("", `[mcp_servers.${SERVER_NAME}.env]`);
+                    for (const [k, v] of envEntries)lines.push(`${k} = ${tomlString(v)}`);
+                }
+                return {
+                    client: "codex",
+                    command: [
+                        "codex mcp add",
+                        SERVER_NAME,
+                        ...envEntries.map(([k, v])=>`--env ${k}=${shellQuote(v)}`),
+                        "-- npx",
+                        argLine
+                    ].join(" "),
+                    config: {
+                        language: "toml",
+                        path: "~/.codex/config.toml",
+                        text: lines.join("\n")
+                    },
+                    login
+                };
+            }
+        case "json":
+            return {
+                client: "json",
+                config: {
+                    language: "json",
+                    path: ".mcp.json",
+                    text: JSON.stringify({
+                        mcpServers: {
+                            [SERVER_NAME]: stdio
+                        }
+                    }, null, 2)
+                },
+                login
+            };
+    }
+}
+export { CLIENTS, PACKAGE, SERVER_NAME, buildRecipe, loginCommand, serverArgs, serverEnv };

package/dist/module.js

@@ -236,7 +236,7 @@ __webpack_require__.d(workspace_create_namespaceObject, {
     handler: ()=>workspace_create_handler,
     schema: ()=>workspace_create_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"10.10.3","El":{"OP":"4.1.31"}}');
+var package_namespaceObject = JSON.parse('{"rE":"10.10.4","El":{"OP":"4.1.31"}}');
 const ENVELOPE_SCHEMA = 1;
 const collectWarnings = (warnings)=>{
     if (!warnings) return [];
@@ -509,8 +509,20 @@ function readCredentialStore() {
         entries
     };
 }
+const PROJECT_PIN_ENV = "EXTENSION_DEV_PROJECT";
+function pinnedProject() {
+    return String(process.env[PROJECT_PIN_ENV] || "").trim().toLowerCase();
+}
+function isProjectRef(value) {
+    return /^[a-z0-9][a-z0-9-_.]*\/[a-z0-9][a-z0-9-_.]*$/i.test(value);
+}
+function sameProject(named, pinned) {
+    const a = named.trim().toLowerCase();
+    if (!a || !pinned) return true;
+    return a.includes("/") ? a === pinned : a === pinned.split("/")[1];
+}
 function selectEntry(store, selector) {
-    const wanted = String(selector?.project ?? "").trim().toLowerCase();
+    const wanted = (String(selector?.project ?? "").trim() || pinnedProject()).toLowerCase();
     if (!wanted) return store.active && store.entries[store.active] || Object.values(store.entries)[0] || null;
     if (wanted.includes("/")) return store.entries[wanted] ?? null;
     const bySlug = Object.values(store.entries).filter((entry)=>entry.projectSlug.toLowerCase() === wanted);
@@ -7921,12 +7933,15 @@ async function openSidebarThroughGesture(projectPath, browser, refusal) {
     return actFrameJson(refusal);
 }
 function resolveToken(options = {}) {
-    const project = String(options.project ?? "").trim();
+    const named = String(options.project ?? "").trim();
+    const project = named || pinnedProject();
     if (project) {
         const creds = readValidCredentials(void 0, {
             project
         });
-        return creds?.token ? String(creds.token).trim() : "";
+        if (creds?.token) return String(creds.token).trim();
+        if (named) return "";
+        return String(process.env.EXTENSION_DEV_TOKEN || "").trim();
     }
     const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
     if (fromEnv) return fromEnv;
@@ -18058,30 +18073,41 @@ const truthy = (raw)=>{
     return "" !== value && "0" !== value && "false" !== value && "off" !== value;
 };
 function isServerFlag(arg) {
-    return "--no-ship" === arg || "--features" === arg || arg.startsWith("--features=");
+    return "--no-ship" === arg || "--features" === arg || arg.startsWith("--features=") || "--project" === arg || arg.startsWith("--project=");
 }
 function resolveServerOptions(argv, env) {
     let rawFeatures = env[FEATURES_ENV];
     let noShip = truthy(env[NO_SHIP_ENV]);
+    let project = String(env[PROJECT_PIN_ENV] || "").trim().toLowerCase();
     for(let i = 0; i < argv.length; i++){
         const arg = argv[i];
         if ("--no-ship" === arg) noShip = true;
         else if ("--features" === arg) rawFeatures = argv[++i] ?? "";
+        else if (arg.startsWith("--features=")) rawFeatures = arg.slice(11);
+        else if ("--project" === arg) project = String(argv[++i] ?? "").trim().toLowerCase();
         else {
-            if (!arg.startsWith("--features=")) return {
+            if (!arg.startsWith("--project=")) return {
                 ok: false,
                 message: `Unknown flag "${arg}".`
             };
-            rawFeatures = arg.slice(11);
+            project = arg.slice(10).trim().toLowerCase();
         }
     }
+    if (project && !isProjectRef(project)) return {
+        ok: false,
+        message: `--project takes "<workspace>/<project>", got "${project}".`
+    };
+    const pin = project ? {
+        project
+    } : {};
     if (void 0 === rawFeatures || "" === rawFeatures.trim()) return {
         ok: true,
         options: {
             features: [
                 ...FEATURE_GROUPS
             ],
-            noShip
+            noShip,
+            ...pin
         }
     };
     const names = rawFeatures.split(",").map((name)=>name.trim().toLowerCase()).filter(Boolean);
@@ -18095,7 +18121,8 @@ function resolveServerOptions(argv, env) {
         ok: true,
         options: {
             features,
-            noShip
+            noShip,
+            ...pin
         }
     };
 }
@@ -18138,6 +18165,40 @@ function disabledToolEnvelope(name, args, options) {
     });
     return null;
 }
+function pinProjectArgs(name, args, inputSchema, options) {
+    const pinned = options.project;
+    if (!pinned) return {
+        args
+    };
+    const named = "string" == typeof args.project ? args.project : "";
+    if (named && !sameProject(named, pinned)) return {
+        refused: envelope_envelope({
+            ok: false,
+            command: name,
+            status: "project-pinned",
+            error: {
+                code: "E_TOOL_DISABLED",
+                message: `This server is pinned to ${pinned} and was asked to act on ${named}.`
+            },
+            value: {
+                pinned,
+                named
+            },
+            hint: `Work on ${named} through an MCP server configured with --project ${named}, or change this server's --project (or ${PROJECT_PIN_ENV}).`
+        })
+    };
+    const properties = inputSchema.properties ?? {};
+    const statusOnly = "extension_auth" === name && "status" === args.action;
+    if (named || statusOnly || !("project" in properties)) return {
+        args
+    };
+    return {
+        args: {
+            ...args,
+            project: pinned
+        }
+    };
+}
 const tools = [
     create_namespaceObject,
     templates_namespaceObject,
@@ -18235,8 +18296,8 @@ function createServer(options = DEFAULT_SERVER_OPTIONS) {
             ],
             isError: true
         };
-        const normalizedArgs = normalizeArgAliases(tool.schema.inputSchema, args ?? {});
-        const disabled = disabledToolEnvelope(name, normalizedArgs, options);
+        const aliasedArgs = normalizeArgAliases(tool.schema.inputSchema, args ?? {});
+        const disabled = disabledToolEnvelope(name, aliasedArgs, options);
         if (disabled) return {
             content: [
                 {
@@ -18246,6 +18307,17 @@ function createServer(options = DEFAULT_SERVER_OPTIONS) {
             ],
             isError: true
         };
+        const pinned = pinProjectArgs(name, aliasedArgs, tool.schema.inputSchema, options);
+        if ("refused" in pinned) return {
+            content: [
+                {
+                    type: "text",
+                    text: pinned.refused
+                }
+            ],
+            isError: true
+        };
+        const normalizedArgs = pinned.args;
         const issues = validateToolInput(tool.schema.inputSchema, normalizedArgs);
         if (issues.length) return {
             content: [
@@ -18284,6 +18356,7 @@ function createServer(options = DEFAULT_SERVER_OPTIONS) {
 }
 async function startServer(options = DEFAULT_SERVER_OPTIONS) {
     installCarrierExitCleanup();
+    if (options.project) process.env.EXTENSION_DEV_PROJECT = options.project;
     const server = createServer(options);
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/src/clients/index.d.ts

@@ -0,0 +1,31 @@
+export type ClientId = "claude-code" | "cursor" | "vscode" | "codex" | "json";
+export type Reach = "everything" | "no-ship" | "local";
+export interface ClientInfo {
+    id: ClientId;
+    label: string;
+    subtitle?: string;
+}
+export declare const CLIENTS: readonly ClientInfo[];
+export interface Recipe {
+    client: ClientId;
+    command?: string;
+    config?: {
+        language: "json" | "toml";
+        path: string;
+        text: string;
+    };
+    deeplink?: string;
+    login: string;
+}
+export interface RecipeInput {
+    client: ClientId;
+    reach: Reach;
+    strictApproval: boolean;
+    project: string;
+}
+export declare const SERVER_NAME = "extension-dev";
+export declare const PACKAGE = "@extension.dev/mcp";
+export declare function serverArgs(input: Omit<RecipeInput, "client">): string[];
+export declare function serverEnv(input: Omit<RecipeInput, "client">): Record<string, string>;
+export declare function loginCommand(project: string): string;
+export declare function buildRecipe(input: RecipeInput): Recipe;

package/dist/src/clients/readme.d.ts

@@ -0,0 +1,4 @@
+export declare const README_SETUP_START = "<!-- setup:start (generated from src/clients, run pnpm readme:clients) -->";
+export declare const README_SETUP_END = "<!-- setup:end -->";
+export declare function renderReadmeSetup(): string;
+export declare function spliceReadmeSetup(readme: string): string;

package/dist/src/lib/credentials.d.ts

@@ -18,6 +18,10 @@ export interface CredentialSelector {
 }
 export declare function credentialKey(workspaceSlug: string, projectSlug: string): string;
 export declare function readCredentialStore(): CredentialStore | null;
+export declare const PROJECT_PIN_ENV = "EXTENSION_DEV_PROJECT";
+export declare function pinnedProject(): string;
+export declare function isProjectRef(value: string): boolean;
+export declare function sameProject(named: string, pinned: string): boolean;
 export declare function readCredentials(selector?: CredentialSelector): StoredCredentials | null;
 export declare function listCredentials(): Array<StoredCredentials & {
     key: string;

package/dist/src/lib/tool-policy.d.ts

@@ -18,6 +18,7 @@ export declare const TOOL_POLICY: Record<string, ToolPolicy>;
 export interface ServerOptions {
     features: FeatureGroup[];
     noShip: boolean;
+    project?: string;
 }
 export declare const DEFAULT_SERVER_OPTIONS: ServerOptions;
 export declare function isServerFlag(arg: string): boolean;
@@ -30,4 +31,9 @@ export declare function resolveServerOptions(argv: string[], env: Record<string,
 };
 export declare function isToolListed(name: string, options: ServerOptions): boolean;
 export declare function disabledToolEnvelope(name: string, args: Args, options: ServerOptions): string | null;
+export declare function pinProjectArgs(name: string, args: Args, inputSchema: Record<string, unknown>, options: ServerOptions): {
+    args: Args;
+} | {
+    refused: string;
+};
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "10.10.3",
+  "version": "10.10.4",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 31 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "Apache-2.0",
@@ -26,6 +26,10 @@
     ".": {
       "types": "./dist/module.d.ts",
       "import": "./dist/module.js"
+    },
+    "./clients": {
+      "types": "./dist/src/clients/index.d.ts",
+      "import": "./dist/clients.js"
     }
   },
   "main": "./dist/module.js",
@@ -46,6 +50,7 @@
   ],
   "scripts": {
     "clean": "rm -rf dist",
+    "readme:clients": "UPDATE_README=1 vitest run src/__tests__/readme-clients.test.ts",
     "watch": "rslib build --watch",
     "compile": "rslib build",
     "build": "pnpm run compile",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "10.10.3",
+  "version": "10.10.4",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "10.10.3",
+      "version": "10.10.4",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"