@extension.dev/mcp 3.17.0-canary.1779910200.ddcd9eb → 3.17.0

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+# Changelog
+
+## 3.17.0
+
+First stable release on npm. The registry previously carried only canary
+builds (3.17.0-canary.*), so `npx @extension.dev/mcp` resolved a canary;
+this release graduates that line to stable and becomes `latest`.
+
+- 26 tools across scaffolding, build/dev/preview, live inspection (CDP +
+  agent bridge), act tools (eval/storage/reload/open), browser management,
+  and platform auth/publish.
+- Claude Code integration assets (CLAUDE.md, slash commands, rules) and the
+  @extension.dev/skill pairing.
+- MIT license shipped; repository moved to extensiondev/mcp.
+
 # @extension.dev/mcp — Changelog
 
 ## Unreleased — agent-bridge tools
@@ -34,3 +49,36 @@ New tools (22 total):
 Internal: `lib/act` (CLI shell-out helper), `lib/exec.runExtensionCli` (capture),
 `lib/cdp.getClosedShadowRoots`. Test infra aligned to the workspace vitest
 catalog.
+
+## Unreleased — login (auth tools)
+
+Adds the missing `login` flow so `extension_publish` no longer requires the user
+to mint and export `EXTENSION_DEV_TOKEN` by hand. Auth stays auth-AWARE: the
+token lives in a local credentials file, never in the MCP process state or logs.
+
+New tools (25 total):
+
+- **`extension_login`** — GitHub **device-code** flow (no local server; works
+  headless). Two-phase: call with `project` (`<workspace>/<project>`) to get a
+  code + URL, call again with the returned `deviceCode` to finish. On success it
+  writes a project-scoped token to the credentials file. Never returns the token.
+- **`extension_whoami`** — report the stored workspace/project and token expiry
+  without revealing the token.
+- **`extension_logout`** — delete the local credentials file.
+
+Token resolution for publish is now `EXTENSION_DEV_TOKEN` env **>** the
+credentials file (expired file tokens are ignored).
+
+Credentials file (versioned, `0600`): `$XDG_CONFIG_HOME/extension-dev/auth.json`
+(or `~/.config/...`; `%APPDATA%\extension-dev\auth.json` on Windows).
+
+Platform endpoints this depends on (in `apps/www.extension.dev`):
+
+- `GET /api/cli/login/config` — public GitHub OAuth client id + scope.
+- `POST /api/cli/login/exchange` — trades a GitHub **user** token for a
+  project-scoped access token after checking workspace membership. Modeled on
+  `/api/oidc/exchange`; tokens are recorded so they stay revocable.
+
+> ⚠️ **Ops:** the device flow requires **device flow enabled** on the GitHub
+> OAuth App behind `WWW_GITHUB_OAUTH_CLIENT_ID`. Until then, `extension_login`
+> can't complete and users fall back to a dashboard-minted `EXTENSION_DEV_TOKEN`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Extension Dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,27 +1,46 @@
+[npm-version-image]: https://img.shields.io/npm/v/%40extension.dev%2Fmcp
+[npm-version-url]: https://www.npmjs.com/package/@extension.dev/mcp
+[action-image]: https://github.com/extensiondev/mcp/actions/workflows/ci.yml/badge.svg?branch=main
+[action-url]: https://github.com/extensiondev/mcp/actions
+
+[![Version][npm-version-image]][npm-version-url] [![workflow][action-image]][action-url]
+
 # @extension.dev/mcp
 
-MCP server for building, debugging, and publishing cross-browser extensions. Exposes 15 tools that let AI assistants scaffold, develop, build, inspect, and debug extensions using the [extension.dev](https://extension.dev) platform and template catalog.
+Give your AI agent hands for browser extension development. One command connects Claude Code, Claude Desktop, Cursor, or any MCP client to 26 tools that scaffold, run, inspect, debug, and publish cross-browser extensions:
+
+```bash
+claude mcp add extension-dev npx @extension.dev/mcp
+```
+
+Extensions fail silently: content scripts that never inject, panels that never open, permissions that return `undefined` with no error. These tools give agents eyes on the live browser (DOM probes, unified logs from every context, storage access, event replay) so they debug from evidence instead of guessing. Scaffolding draws on the 60+ template catalog of the [extension.dev](https://extension.dev) platform, built on [Extension.js](https://extension.js.org).
 
 ## What's in this package
 
 ```
 @extension.dev/mcp
-  src/              MCP server source (15 tools across 3 tiers)
+  src/              MCP server source (26 tools)
   claude/           Claude Code integration (CLAUDE.md, slash commands, rules)
   bin/              CLI entrypoint
 ```
 
-**MCP server** — programmatic bridge between AI assistants and the extension.dev platform. Imports from published npm packages:
+**MCP server**: programmatic bridge between AI assistants and the extension.dev platform. Imports from published npm packages:
 
-- `extension-create` — project scaffolding
-- `extension-develop` — build/dev/preview
-- `extension-install` — managed browser binaries
+- `extension-create`: project scaffolding
+- `extension-develop`: build/dev/preview
+- `extension-install`: managed browser binaries
 
-**Claude Code integration** — drop-in instructions, slash commands, and rules for Claude Code:
+**Claude Code integration**: drop-in instructions, slash commands, and rules for Claude Code:
 
-- `claude/CLAUDE.md` — project-level instructions for any extension project
-- `claude/commands/` — slash commands (`/extension`, `/extension-add`, `/extension-debug`, `/extension-publish`)
-- `claude/rules/` — rules for extension development, cross-browser compat, and MCP tools
+- `claude/CLAUDE.md`: project-level instructions for any extension project
+- `claude/commands/`: slash commands (`/extension`, `/extension-add`, `/extension-debug`, `/extension-publish`)
+- `claude/rules/`: rules for extension development, cross-browser compat, and MCP tools
+
+**Agent Skill**: the knowledge companion to this server lives in [`@extension.dev/skill`](https://npmjs.com/package/@extension.dev/skill): a portable [Agent Skills](https://agentskills.io)-format skill (SKILL.md + references) covering cross-browser rules, silent-failure gotchas, debugging playbooks, and store publishing. This server gives agents hands; the skill gives them judgment. Pair them:
+
+```bash
+mkdir -p .claude/skills && cp -R node_modules/@extension.dev/skill/skills/extension-dev .claude/skills/
+```
 
 Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI since they require the full browser launcher infrastructure.
 
@@ -73,11 +92,22 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | 2    | `extension_manifest_validate`   | native                          | Cross-browser manifest validation |
 | 2    | `extension_inspect`             | native                          | Build output analysis             |
 | 2    | `extension_source_inspect`      | CDP WebSocket                   | Live DOM inspection               |
+| 2    | `extension_dom_inspect`         | agent bridge                    | CDP-free DOM snapshot             |
+| 2    | `extension_list_extensions`     | CDP WebSocket                   | List loaded extensions (Chromium) |
+| 2    | `extension_logs`                | agent bridge                    | Stream logs from every context    |
 | 2    | `extension_wait`                | native                          | Poll ready.json contract          |
 | 2    | `extension_add_feature`         | native                          | Add sidebar/popup/content script  |
+| act  | `extension_eval`                | agent bridge                    | Eval in a context (`--allow-eval`) |
+| act  | `extension_storage`             | agent bridge                    | Read/write `chrome.storage`       |
+| act  | `extension_reload`              | agent bridge                    | Reload extension or tab           |
+| act  | `extension_open`                | agent bridge                    | Open surface / trigger `action`,`command` |
 | 3    | `extension_install_browser`     | `extensionInstall()`            | Install managed browser           |
 | 3    | `extension_list_browsers`       | `getManagedBrowsersCacheRoot()` | List managed browsers             |
 | 3    | `extension_detect_browsers`     | native                          | System browser detection          |
+| auth | `extension_login`               | platform                        | GitHub device-code → stored token |
+| auth | `extension_whoami`              | native                          | Show stored login (no token)      |
+| auth | `extension_logout`              | native                          | Remove stored credentials         |
+| auth | `extension_publish`             | platform                        | Publish to extension.dev (token)  |
 
 ## Development
 
@@ -96,6 +126,18 @@ NPM_TOKEN=<token> pnpm publish
 
 Uses `prepublishOnly` to run tests and compile before publishing.
 
+## The extension.dev open source stack
+
+| Package | Use it to |
+| --- | --- |
+| [`@extension.dev/skill`](https://github.com/extensiondev/skill) | Teach agents the cross-browser rules and silent-failure gotchas |
+| [`@extension.dev/deploy`](https://github.com/extensiondev/deploy) | Ship to Chrome, Firefox, and Edge stores from CI |
+| [`@extension.dev/artifact-integrity`](https://github.com/extensiondev/artifact-integrity) | Gate releases on artifact verification |
+| [`@extension.dev/compiler`](https://github.com/extensiondev/compiler) | Build extensions in the browser with esbuild-wasm |
+| [`@extension.dev/core`](https://github.com/extensiondev/core) | Authenticate and publish to the extension.dev platform |
+
+All of it rides on [Extension.js](https://github.com/extension-js/extension.js), the open-source cross-browser extension framework.
+
 ## License
 
 MIT

package/bin/extension-mcp.js

@@ -1,3 +1,16 @@
 #!/usr/bin/env node
-import {startServer} from '../dist/module.js'
-startServer()
+import {startServer, runCli} from '../dist/module.js'
+
+const [, , cmd, ...rest] = process.argv
+
+if (cmd && ['login', 'logout', 'whoami'].includes(cmd)) {
+  runCli(cmd, rest)
+    .then((code) => process.exit(code))
+    .catch((err) => {
+      process.stderr.write(`${err?.message || String(err)}\n`)
+      process.exit(1)
+    })
+} else {
+  // No subcommand: run as the MCP stdio server (the default and primary mode).
+  startServer()
+}

package/claude/CLAUDE.md

@@ -242,6 +242,14 @@ npm run dev -- --logs info --log-url "example.com"
 - Use `--wait` flag to check if dev session is ready (outputs ready.json contract)
 - Use `npm run start` to test production builds (builds first, then launches)
 
+### Triggering events without clicking (requires `--allow-control`)
+
+- `extension open action` — fire the toolbar action (opens its popup, or replays `chrome.action.onClicked`).
+- `extension open command --name <cmd>` — replay a `chrome.commands.onCommand` keyboard shortcut.
+- `extension_list_extensions` (MCP tool; no CLI verb) — list extensions with a live context in the browser (Chromium, read-only).
+
+These replay your captured listeners, so they work on Chrome and Firefox — but carry **no user gesture**, so `activeTab` is not granted (the result reports `gesture: false`, plus a `warning` when the manifest declares `activeTab`). If you need a genuine-gesture click (activeTab granted), use [chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp)'s `trigger_extension_action` (Chromium only) alongside this server.
+
 ## Contributing templates to the examples repo
 
 If you create a new extension pattern worth sharing:

package/claude/commands/extension-debug.md

@@ -24,7 +24,17 @@ Debug the currently running extension dev session. The user said: $ARGUMENTS
    - Read `dist/extension-js/chrome/ready.json` to get the CDP port
    - Report the port and suggest Chrome DevTools inspection
 
-3. **Diagnose common issues**
+3. **Exercise event handlers (when the bug is in an action / command / shortcut)**
+   If the session was started with `--allow-control`, fire the events a user would, without clicking:
+   - `extension_open` with `surface: "action"` — triggers the toolbar action (opens its popup, or replays `chrome.action.onClicked`).
+   - `extension_open` with `surface: "command"` and `name: "<cmd>"` — replays a `chrome.commands.onCommand` keyboard shortcut.
+   - Then re-inspect or read `extension_logs` to see what the handler did.
+
+   **Caveat:** replay carries no user gesture, so `activeTab` is NOT granted. If the handler depends on `activeTab` (e.g. `chrome.scripting.executeScript` on the active tab, `captureVisibleTab`), the result includes `gesture: false` and a `warning`, and behavior differs from a real click. For a genuine-gesture click (activeTab granted), use chrome-devtools-mcp's `trigger_extension_action` (Chromium only) alongside this server.
+
+   To see what else is loaded in the browser (Chromium): `extension_list_extensions`.
+
+4. **Diagnose common issues**
    Based on what you find, check for:
    - **"It didn't load"**: Check extension root count. If 0, content scripts may not be injecting. Check manifest `content_scripts` matches patterns and the target URL.
    - **Console errors**: Report top errors. Common ones:
@@ -34,7 +44,7 @@ Debug the currently running extension dev session. The user said: $ARGUMENTS
    - **Wrong page**: Check if the content script `matches` pattern in manifest covers the target URL
    - **Shadow DOM empty**: Extension root exists but shadow content is empty — likely a CSS or framework mounting issue
 
-4. **Suggest fixes** based on the diagnosis
+5. **Suggest fixes** based on the diagnosis
 
 ## Examples
 

package/claude/rules/mcp-tools.md

@@ -719,8 +719,15 @@ The `similarTemplates` field lists templates from the catalog with similar surfa
 | `extension_manifest_validate`   | `programs/develop`   | `plugin-web-extension`                    | `templates-meta.json` for similar templates | Extract validation logic                   |
 | `extension_inspect`             | `programs/develop`   | `--source` flag logic                     | —                                           | Extract into callable API                  |
 | `extension_source_inspect`      | `programs/extension` | CDP client / RDP transport                | Live browser via debugging protocol         | Wire to running session                    |
+| `extension_list_extensions`     | MCP `lib/cdp`        | `Extensions.getExtensionInfo` (read-only) | Live browser via CDP (Chromium)             | MCP tool (no CLI verb)                      |
 | `extension_wait`                | `programs/extension` | `dev-wait.ts`                             | `ready.json` contract file                  | Thin wrapper (exists in CLI)               |
 | `extension_add_feature`         | New                  | `extension_get_template_source`           | examples repo patterns                      | Codegen from examples                      |
+| **Agent bridge — act / triggers** |                    |                                           |                                             |                                            |
+| `extension_eval`                | `programs/extension` | bridge control channel                    | Live extension context                      | Wraps `extension eval` (`--allow-eval`)     |
+| `extension_storage`             | `programs/extension` | bridge control channel                    | `chrome.storage`                            | Wraps `extension storage`                   |
+| `extension_reload`              | `programs/extension` | bridge control channel                    | Live extension                              | Wraps `extension reload`                    |
+| `extension_open`                | `programs/extension` | bridge control channel                    | Surfaces + `action`/`command` replay        | Wraps `extension open`                      |
+| `extension_logs`                | `programs/extension` | bridge log/control channel                | `logs.ndjson` + live channel                | Wraps `extension logs`                      |
 | **Tier 3 — Browser management** |                      |                                           |                                             |                                            |
 | `extension_install_browser`     | `programs/install`   | `extensionInstall()`                      | —                                           | Thin wrapper only                          |
 | `extension_list_browsers`       | `programs/install`   | `getManagedBrowsersCacheRoot()`           | —                                           | Thin wrapper only                          |

package/dist/module.d.ts

@@ -1 +1 @@
-export { startServer } from "./src/index";
+export { startServer, runCli } from "./src/index";

package/dist/module.js

@@ -78,12 +78,30 @@ __webpack_require__.d(list_browsers_namespaceObject, {
     handler: ()=>list_browsers_handler,
     schema: ()=>list_browsers_schema
 });
+var list_extensions_namespaceObject = {};
+__webpack_require__.r(list_extensions_namespaceObject);
+__webpack_require__.d(list_extensions_namespaceObject, {
+    handler: ()=>list_extensions_handler,
+    schema: ()=>list_extensions_schema
+});
 var list_templates_namespaceObject = {};
 __webpack_require__.r(list_templates_namespaceObject);
 __webpack_require__.d(list_templates_namespaceObject, {
     handler: ()=>list_templates_handler,
     schema: ()=>list_templates_schema
 });
+var login_namespaceObject = {};
+__webpack_require__.r(login_namespaceObject);
+__webpack_require__.d(login_namespaceObject, {
+    handler: ()=>login_handler,
+    schema: ()=>login_schema
+});
+var logout_namespaceObject = {};
+__webpack_require__.r(logout_namespaceObject);
+__webpack_require__.d(logout_namespaceObject, {
+    handler: ()=>logout_handler,
+    schema: ()=>logout_schema
+});
 var logs_namespaceObject = {};
 __webpack_require__.r(logs_namespaceObject);
 __webpack_require__.d(logs_namespaceObject, {
@@ -112,6 +130,7 @@ var publish_namespaceObject = {};
 __webpack_require__.r(publish_namespaceObject);
 __webpack_require__.d(publish_namespaceObject, {
     handler: ()=>publish_handler,
+    resolveToken: ()=>resolveToken,
     schema: ()=>publish_schema
 });
 var reload_namespaceObject = {};
@@ -144,6 +163,12 @@ __webpack_require__.d(wait_namespaceObject, {
     handler: ()=>wait_handler,
     schema: ()=>wait_schema
 });
+var whoami_namespaceObject = {};
+__webpack_require__.r(whoami_namespaceObject);
+__webpack_require__.d(whoami_namespaceObject, {
+    handler: ()=>whoami_handler,
+    schema: ()=>whoami_schema
+});
 const schema = {
     name: "extension_create",
     description: "Create a new browser extension project from a template in the extension.dev template catalog. Use extension_list_templates to see available options.",
@@ -1546,6 +1571,120 @@ async function source_inspect_handler(args) {
         cdp.disconnect();
     }
 }
+const list_extensions_schema = {
+    name: "extension_list_extensions",
+    description: "List the extensions with a live context in the running dev browser via Chrome DevTools Protocol. Returns each extension's id, name, version, and live contexts (service worker, page). Identity is read read-only via the Extensions domain — other extensions' contexts are never attached to or evaluated in. A dormant MV3 service worker with no open page may be absent until it wakes. Chromium only (Firefox uses RDP, not yet supported). Requires an active dev or start session.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            projectPath: {
+                type: "string",
+                description: "Path to the extension project root (must have an active dev session)"
+            },
+            browser: {
+                type: "string",
+                default: "chrome"
+            }
+        },
+        required: [
+            "projectPath"
+        ]
+    }
+};
+async function list_extensions_handler(args) {
+    const browser = args.browser ?? "chrome";
+    const isChromium = [
+        "chrome",
+        "edge",
+        "chromium-based"
+    ].includes(browser);
+    if (!isChromium) return JSON.stringify({
+        error: `Listing extensions for ${browser} uses RDP (Remote Debug Protocol). Currently only Chromium CDP is supported.`,
+        hint: "Use --browser=chrome."
+    });
+    const cdpPort = await list_extensions_findCdpPort(args.projectPath, browser);
+    if (!cdpPort) return JSON.stringify({
+        error: "No active dev session found. Cannot connect to Chrome DevTools Protocol.",
+        hint: "Start a dev session first with extension_dev, then use extension_wait to confirm it is ready."
+    });
+    const cdp = new CDPClient();
+    try {
+        const browserWsUrl = await CDPClient.discoverBrowserWsUrl(cdpPort);
+        await cdp.connect(browserWsUrl);
+        const targets = await cdp.getTargets();
+        const byId = new Map();
+        for (const t of targets){
+            const url = String(t.url ?? "");
+            if (!url.startsWith("chrome-extension://")) continue;
+            const id = url.slice(19).split("/")[0];
+            if (!id) continue;
+            const list = byId.get(id) ?? [];
+            list.push({
+                type: String(t.type ?? ""),
+                url
+            });
+            byId.set(id, list);
+        }
+        const extensions = [];
+        for (const [id, ctxTargets] of byId){
+            const entry = {
+                id,
+                contexts: ctxTargets.map((c)=>({
+                        type: c.type,
+                        url: c.url
+                    })),
+                source: "target-only"
+            };
+            try {
+                const info = await cdp.sendCommand("Extensions.getExtensionInfo", {
+                    extensionId: id
+                });
+                if (info?.extensionInfo) {
+                    entry.name = info.extensionInfo.name;
+                    entry.version = info.extensionInfo.version;
+                    entry.source = "extensions-domain";
+                }
+            } catch  {}
+            extensions.push(entry);
+        }
+        extensions.sort((a, b)=>(a.name ?? a.id).localeCompare(b.name ?? b.id));
+        return JSON.stringify({
+            cdpPort,
+            browser,
+            count: extensions.length,
+            extensions,
+            note: "Lists extensions that currently have at least one live context (service worker or open page). An MV3 service worker that has gone dormant with no open page may be absent until it wakes. Identity is read read-only via the Extensions domain; other extensions' contexts are never attached to or evaluated in."
+        });
+    } catch (error) {
+        return JSON.stringify({
+            error: `Failed to list extensions: ${error.message}`
+        });
+    } finally{
+        cdp.disconnect();
+    }
+}
+async function list_extensions_findCdpPort(projectPath, browser) {
+    const readyPath = node_path.resolve(projectPath, "dist", "extension-js", browser, "ready.json");
+    try {
+        const contract = JSON.parse(node_fs.readFileSync(readyPath, "utf8"));
+        if ("number" == typeof contract.cdpPort) return contract.cdpPort;
+    } catch  {}
+    const defaultPort = 9222;
+    return new Promise((resolve)=>{
+        const socket = new node_net.Socket();
+        socket.setTimeout(1000);
+        socket.on("connect", ()=>{
+            socket.destroy();
+            resolve(defaultPort);
+        });
+        socket.on("error", ()=>resolve(null));
+        socket.on("timeout", ()=>{
+            socket.destroy();
+            resolve(null);
+        });
+        socket.connect(defaultPort, "127.0.0.1");
+    });
+}
 const CONTROL_ENVELOPE_VERSION = 1;
 const CONTROL_WS_PATH = "/extjs-control";
 const DEFAULT_LIMIT = 200;
@@ -2046,7 +2185,7 @@ async function reload_handler(args) {
 }
 const open_schema = {
     name: "extension_open",
-    description: "Open an extension surface — popup, options, or sidebar — in a running session. Requires the dev session to be started with --allow-control. Wraps `extension open`.",
+    description: "Open an extension surface or replay an event in a running session. 'popup'/'options'/'sidebar' open UI surfaces. 'action' triggers the toolbar action: opens the action's popup, or (no popup) replays chrome.action.onClicked. 'command' replays a chrome.commands.onCommand keyboard shortcut (pass `name`). NOTE: action/command replay invokes your listener WITHOUT a user gesture, so the gesture-derived activeTab grant does not apply (the result includes gesture:false and a warning when activeTab is declared). Requires --allow-control. Wraps `extension open`.",
     inputSchema: {
         type: "object",
         properties: {
@@ -2059,9 +2198,15 @@ const open_schema = {
                 enum: [
                     "popup",
                     "options",
-                    "sidebar"
+                    "sidebar",
+                    "action",
+                    "command"
                 ],
-                description: "Which surface to open"
+                description: "Which surface to open or event to replay. 'action' triggers the toolbar action; 'command' replays a keyboard-shortcut command (requires `name`)."
+            },
+            name: {
+                type: "string",
+                description: "For surface 'command': the chrome.commands name to trigger."
             },
             browser: {
                 type: "string",
@@ -2084,6 +2229,7 @@ async function open_handler(args) {
         args.surface,
         args.projectPath
     ];
+    if ("command" === args.surface && args.name) cli.push("--name", args.name);
     if (args.browser) cli.push("--browser", args.browser);
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
@@ -2179,9 +2325,73 @@ async function dom_inspect_handler(args) {
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
 }
+function credentialsPath() {
+    if ("win32" === process.platform) {
+        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
+        return node_path.join(base, "extension-dev", "auth.json");
+    }
+    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
+    const base = xdg || node_path.join(node_os.homedir(), ".config");
+    return node_path.join(base, "extension-dev", "auth.json");
+}
+function readCredentials() {
+    try {
+        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
+        const data = JSON.parse(raw);
+        if (!data || "object" != typeof data) return null;
+        if (1 !== data.version) return null;
+        const token = String(data.token || "").trim();
+        if (!token) return null;
+        return {
+            version: 1,
+            token,
+            workspaceSlug: String(data.workspaceSlug || ""),
+            projectSlug: String(data.projectSlug || ""),
+            expiresAt: Number(data.expiresAt || 0),
+            api: String(data.api || "")
+        };
+    } catch  {
+        return null;
+    }
+}
+function writeCredentials(creds) {
+    const file = credentialsPath();
+    node_fs.mkdirSync(node_path.dirname(file), {
+        recursive: true
+    });
+    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
+        mode: 384
+    });
+    try {
+        node_fs.chmodSync(file, 384);
+    } catch  {}
+    return file;
+}
+function clearCredentials() {
+    const file = credentialsPath();
+    try {
+        node_fs.unlinkSync(file);
+        return {
+            cleared: true,
+            path: file
+        };
+    } catch  {
+        return {
+            cleared: false,
+            path: file
+        };
+    }
+}
+function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
+    const creds = readCredentials();
+    if (!creds) return null;
+    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
+    return creds;
+}
+const DEFAULT_API = "https://www.extension.dev";
 const publish_schema = {
     name: "extension_publish",
-    description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Wraps `extension publish` (which posts to the platform's CLI publish endpoint). This is the only tool that talks to the hosted platform rather than the local browser.",
+    description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Posts to the platform's CLI publish endpoint directly. This is the only tool that talks to the hosted platform rather than the local browser.",
     inputSchema: {
         type: "object",
         properties: {
@@ -2207,32 +2417,54 @@ const publish_schema = {
         ]
     }
 };
-async function publish_handler(args) {
-    const cli = [
-        "publish",
-        args.projectPath,
-        "--output",
-        "json"
-    ];
-    if (null != args.ttlHours) cli.push("--ttl", String(args.ttlHours));
-    if (args.buildSha) cli.push("--build-sha", args.buildSha);
-    if (args.api) cli.push("--api", args.api);
-    const { code, stdout, stderr } = await runExtensionCli(cli, {
-        cwd: args.projectPath
-    });
-    const out = stdout.trim();
-    if (out) try {
-        JSON.parse(out);
-        return out;
-    } catch  {}
+function resolveToken() {
+    const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
+    if (fromEnv) return fromEnv;
+    const creds = readValidCredentials();
+    return creds?.token ? String(creds.token).trim() : "";
+}
+function fail(name, message) {
     return JSON.stringify({
         ok: false,
         error: {
-            name: "PublishError",
-            message: stderr.trim() || `extension publish exited with code ${code}`
+            name,
+            message
         }
     });
 }
+async function publish_handler(args) {
+    const token = resolveToken();
+    if (!token) return fail("PublishAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).");
+    const base = String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API).replace(/\/+$/, "");
+    const url = `${base}/api/cli/publish`;
+    const body = {};
+    if (null != args.ttlHours) body.ttlHours = Number(args.ttlHours);
+    if (args.buildSha) body.buildSha = args.buildSha;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json"
+            },
+            body: JSON.stringify(body)
+        });
+    } catch (err) {
+        return fail("PublishNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+    }
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) return fail("PublishError", `publish failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    return JSON.stringify(data);
+}
 const wait_schema = {
     name: "extension_wait",
     description: "Wait for a running dev or start session to be ready. Polls the ready.json contract file and returns structured status.",
@@ -2528,6 +2760,303 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
+async function startDeviceCode(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/json"
+        },
+        body: JSON.stringify({
+            client_id: args.clientId,
+            scope: args.scope || "read:user"
+        })
+    });
+    const data = await res.json().catch(()=>({}));
+    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
+    return {
+        deviceCode: String(data.device_code || ""),
+        userCode: String(data.user_code || ""),
+        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
+        interval: Number(data.interval || 5),
+        expiresIn: Number(data.expires_in || 900)
+    };
+}
+async function pollForToken(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const sleep = args.sleepImpl ?? defaultSleep;
+    let intervalMs = 1000 * Math.max(1, args.interval);
+    const deadline = Date.now() + Math.max(0, args.budgetMs);
+    while(Date.now() < deadline){
+        await sleep(intervalMs);
+        const res = await doFetch(GITHUB_TOKEN_URL, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json"
+            },
+            body: JSON.stringify({
+                client_id: args.clientId,
+                device_code: args.deviceCode,
+                grant_type: DEVICE_GRANT_TYPE
+            })
+        });
+        const data = await res.json().catch(()=>({}));
+        const token = String(data.access_token || "").trim();
+        if (token) return {
+            ok: true,
+            githubToken: token
+        };
+        const error = String(data.error || "");
+        if ("authorization_pending" === error) continue;
+        if ("slow_down" === error) {
+            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
+            continue;
+        }
+        if ("expired_token" === error) return {
+            ok: false,
+            reason: "expired"
+        };
+        if ("access_denied" === error) return {
+            ok: false,
+            reason: "denied"
+        };
+    }
+    return {
+        ok: false,
+        reason: "pending"
+    };
+}
+const login_flow_DEFAULT_API = "https://www.extension.dev";
+function resolveApiBase(api) {
+    return String(api || process.env.EXTENSION_DEV_API_URL || login_flow_DEFAULT_API).replace(/\/+$/, "");
+}
+async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
+    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
+    if (override) return {
+        clientId: override,
+        scope: "read:user"
+    };
+    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
+        headers: {
+            accept: "application/json"
+        }
+    });
+    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
+    const data = await res.json().catch(()=>({}));
+    const clientId = String(data.githubClientId || "").trim();
+    if (!clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
+    return {
+        clientId,
+        scope: String(data.scope || "read:user")
+    };
+}
+async function exchangeAndPersist(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json"
+        },
+        body: JSON.stringify({
+            githubToken: args.githubToken,
+            project: args.project
+        })
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
+    const token = String(data.token || "").trim();
+    if (!token) throw new Error("Login exchange returned no token.");
+    const creds = {
+        version: 1,
+        token,
+        workspaceSlug: String(data.workspaceSlug || ""),
+        projectSlug: String(data.projectSlug || ""),
+        expiresAt: Number(data.expiresAt || 0),
+        api: args.apiBase
+    };
+    writeCredentials(creds);
+    return creds;
+}
+const login_schema = {
+    name: "extension_login",
+    description: "Authenticate to extension.dev via GitHub device-code and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            project: {
+                type: "string",
+                description: "Target project as '<workspace>/<project>' (the token is scoped to it)"
+            },
+            deviceCode: {
+                type: "string",
+                description: "Resume token from a prior call's `deviceCode`; omit on the first call"
+            },
+            api: {
+                type: "string",
+                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
+            }
+        },
+        required: [
+            "project"
+        ]
+    }
+};
+const FIRST_CALL_BUDGET_MS = 8000;
+const RESUME_BUDGET_MS = 22000;
+function login_fail(name, message) {
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name,
+            message
+        }
+    });
+}
+function success(creds) {
+    return JSON.stringify({
+        ok: true,
+        status: "logged-in",
+        workspaceSlug: creds.workspaceSlug,
+        projectSlug: creds.projectSlug,
+        expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
+        message: `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}. extension_publish can now use the stored token.`
+    });
+}
+function login_pending(start) {
+    return JSON.stringify({
+        ok: false,
+        status: "authorization_pending",
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        deviceCode: start.deviceCode,
+        message: `Open ${start.verificationUri} and enter code ${start.userCode}, then call extension_login again with this deviceCode (and the same project).`
+    });
+}
+async function login_handler(args) {
+    const project = String(args.project || "").trim();
+    if (!/^[^/]+\/[^/]+$/.test(project)) return login_fail("BadRequest", "project must be in the form '<workspace>/<project>'.");
+    const apiBase = resolveApiBase(args.api);
+    let config;
+    try {
+        config = await fetchLoginConfig(apiBase);
+    } catch (err) {
+        return login_fail("LoginConfigError", err?.message || "Could not load login config.");
+    }
+    if (args.deviceCode) {
+        const poll = await pollForToken({
+            clientId: config.clientId,
+            deviceCode: String(args.deviceCode),
+            interval: 5,
+            budgetMs: RESUME_BUDGET_MS
+        });
+        if (!poll.ok) {
+            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
+            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
+            return login_pending({
+                deviceCode: String(args.deviceCode),
+                userCode: "(see the previous response)",
+                verificationUri: "https://github.com/login/device"
+            });
+        }
+        try {
+            const creds = await exchangeAndPersist({
+                apiBase,
+                githubToken: poll.githubToken,
+                project
+            });
+            return success(creds);
+        } catch (err) {
+            return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
+        }
+    }
+    let start;
+    try {
+        start = await startDeviceCode({
+            clientId: config.clientId,
+            scope: config.scope
+        });
+    } catch (err) {
+        return login_fail("LoginStartError", err?.message || "Could not start device flow.");
+    }
+    const poll = await pollForToken({
+        clientId: config.clientId,
+        deviceCode: start.deviceCode,
+        interval: start.interval,
+        budgetMs: FIRST_CALL_BUDGET_MS
+    });
+    if (poll.ok) try {
+        const creds = await exchangeAndPersist({
+            apiBase,
+            githubToken: poll.githubToken,
+            project
+        });
+        return success(creds);
+    } catch (err) {
+        return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
+    }
+    if (!poll.ok && "denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
+    return login_pending(start);
+}
+const whoami_schema = {
+    name: "extension_whoami",
+    description: "Report the locally stored extension.dev login (workspace/project and token expiry) without revealing the token. Returns logged-out status when no credentials are stored.",
+    inputSchema: {
+        type: "object",
+        properties: {}
+    }
+};
+async function whoami_handler() {
+    const creds = readCredentials();
+    if (!creds) return JSON.stringify({
+        ok: true,
+        status: "logged-out",
+        message: "No stored credentials. Run extension_login to authenticate."
+    });
+    const now = Math.floor(Date.now() / 1000);
+    const expired = Boolean(creds.expiresAt && creds.expiresAt <= now);
+    return JSON.stringify({
+        ok: true,
+        status: expired ? "expired" : "logged-in",
+        workspaceSlug: creds.workspaceSlug,
+        projectSlug: creds.projectSlug,
+        api: creds.api,
+        expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
+        expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
+        expired,
+        message: expired ? "Stored token has expired. Run extension_login to refresh it." : `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}.`
+    });
+}
+const logout_schema = {
+    name: "extension_logout",
+    description: "Delete the locally stored extension.dev credentials. Does not revoke the token server-side (revoke from the dashboard if needed); only removes it from this machine.",
+    inputSchema: {
+        type: "object",
+        properties: {}
+    }
+};
+async function logout_handler() {
+    const result = clearCredentials();
+    return JSON.stringify({
+        ok: true,
+        cleared: result.cleared,
+        message: result.cleared ? "Local credentials removed." : "No stored credentials to remove."
+    });
+}
 const install_browser_schema = {
     name: "extension_install_browser",
     description: "Install a managed browser binary for extension testing. Useful in CI, Docker, or fresh environments where browsers are not pre-installed.",
@@ -2867,6 +3396,7 @@ const tools = [
     manifest_validate_namespaceObject,
     inspect_namespaceObject,
     source_inspect_namespaceObject,
+    list_extensions_namespaceObject,
     logs_namespaceObject,
     eval_namespaceObject,
     storage_namespaceObject,
@@ -2876,6 +3406,9 @@ const tools = [
     publish_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,
+    login_namespaceObject,
+    whoami_namespaceObject,
+    logout_namespaceObject,
     install_browser_namespaceObject,
     list_browsers_namespaceObject,
     detect_browsers_namespaceObject
@@ -2941,4 +3474,60 @@ async function startServer() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }
-export { startServer };
+async function runCli(cmd, args) {
+    const log = (msg)=>process.stderr.write(`${msg}\n`);
+    const flag = (name)=>{
+        const i = args.indexOf(`--${name}`);
+        return i >= 0 ? args[i + 1] : void 0;
+    };
+    if ("whoami" === cmd) {
+        log(await whoami_handler());
+        return 0;
+    }
+    if ("logout" === cmd) {
+        log(await logout_handler());
+        return 0;
+    }
+    if ("login" === cmd) {
+        const project = String(flag("project") || "").trim();
+        if (!/^[^/]+\/[^/]+$/.test(project)) {
+            log("Usage: extension-mcp login --project <workspace>/<project> [--api <url>]");
+            return 1;
+        }
+        const apiBase = resolveApiBase(flag("api"));
+        try {
+            const config = await fetchLoginConfig(apiBase);
+            const start = await startDeviceCode({
+                clientId: config.clientId,
+                scope: config.scope
+            });
+            log("");
+            log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
+            log("");
+            log("  Waiting for authorization...");
+            const poll = await pollForToken({
+                clientId: config.clientId,
+                deviceCode: start.deviceCode,
+                interval: start.interval,
+                budgetMs: 1000 * start.expiresIn
+            });
+            if (!poll.ok) {
+                log("denied" === poll.reason ? "Authorization was denied on GitHub." : "Timed out waiting for authorization. Run login again.");
+                return 1;
+            }
+            const creds = await exchangeAndPersist({
+                apiBase,
+                githubToken: poll.githubToken,
+                project
+            });
+            log(`Logged in to ${creds.workspaceSlug}/${creds.projectSlug}.`);
+            return 0;
+        } catch (err) {
+            log(err instanceof Error ? err.message : String(err));
+            return 1;
+        }
+    }
+    log(`Unknown command: ${cmd}. Expected one of: login, logout, whoami.`);
+    return 1;
+}
+export { runCli, startServer };

package/dist/src/index.d.ts

@@ -1 +1,9 @@
 export declare function startServer(): Promise<void>;
+/**
+ * Human-facing subcommands for `extension-mcp <cmd>`. Unlike the MCP tools
+ * (which must return promptly and so resume across calls), the bin blocks on
+ * the device flow because there is a person watching the terminal. Returns a
+ * process exit code. All console output goes to stderr so it never pollutes a
+ * machine-readable stdout if a script captures it.
+ */
+export declare function runCli(cmd: string, args: string[]): Promise<number>;

package/dist/src/lib/credentials.d.ts

@@ -0,0 +1,24 @@
+export interface StoredCredentials {
+    version: 1;
+    /** The HMAC access token the publish path sends as `Bearer`. */
+    token: string;
+    workspaceSlug: string;
+    projectSlug: string;
+    /** Token expiry as unix epoch seconds (0 if unknown). */
+    expiresAt: number;
+    /** Platform base URL the token was minted against. */
+    api: string;
+}
+export declare function credentialsPath(): string;
+export declare function readCredentials(): StoredCredentials | null;
+export declare function writeCredentials(creds: StoredCredentials): string;
+export declare function clearCredentials(): {
+    cleared: boolean;
+    path: string;
+};
+/**
+ * Return stored credentials only if the token has not expired. Used by the
+ * publish token resolution so an expired local token falls through cleanly to
+ * "no token" instead of producing a 401 from the platform.
+ */
+export declare function readValidCredentials(nowSeconds?: number): StoredCredentials | null;

package/dist/src/lib/github-device.d.ts

@@ -0,0 +1,40 @@
+export interface DeviceCodeStart {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    /** Minimum seconds to wait between polls. */
+    interval: number;
+    /** Seconds until the device code expires. */
+    expiresIn: number;
+}
+export type PollResult = {
+    ok: true;
+    githubToken: string;
+} | {
+    ok: false;
+    reason: "pending" | "expired" | "denied";
+    error?: string;
+};
+type FetchImpl = typeof fetch;
+type SleepImpl = (ms: number) => Promise<void>;
+export declare function startDeviceCode(args: {
+    clientId: string;
+    scope?: string;
+    fetchImpl?: FetchImpl;
+}): Promise<DeviceCodeStart>;
+/**
+ * Poll for the access token until the budget elapses. A budget shorter than
+ * the device-code lifetime lets a caller (e.g. an MCP tool that must return
+ * promptly) poll in bounded slices and report "pending" between calls; a long
+ * budget (a blocking CLI) waits the whole time. Returns `pending` only on
+ * budget exhaustion; `expired`/`denied` are terminal.
+ */
+export declare function pollForToken(args: {
+    clientId: string;
+    deviceCode: string;
+    interval: number;
+    budgetMs: number;
+    fetchImpl?: FetchImpl;
+    sleepImpl?: SleepImpl;
+}): Promise<PollResult>;
+export {};

package/dist/src/lib/login-flow.d.ts

@@ -0,0 +1,25 @@
+import { type StoredCredentials } from "./credentials";
+type FetchImpl = typeof fetch;
+export declare function resolveApiBase(api?: string): string;
+export interface LoginConfig {
+    clientId: string;
+    scope: string;
+}
+/**
+ * Resolve the GitHub OAuth client id the device flow authenticates against.
+ * EXTENSION_DEV_GITHUB_CLIENT_ID overrides (useful when pointing at a self-
+ * hosted platform); otherwise it comes from the platform's public config.
+ */
+export declare function fetchLoginConfig(apiBase: string, fetchImpl?: FetchImpl): Promise<LoginConfig>;
+/**
+ * Trade a verified GitHub user token for a project-scoped access token and
+ * write it to the local credentials file. Returns the stored credentials
+ * (token included for the caller's in-memory use; never logged).
+ */
+export declare function exchangeAndPersist(args: {
+    apiBase: string;
+    githubToken: string;
+    project: string;
+    fetchImpl?: FetchImpl;
+}): Promise<StoredCredentials>;
+export {};

package/dist/src/tools/list-extensions.d.ts

@@ -0,0 +1,22 @@
+export declare const schema: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            projectPath: {
+                type: string;
+                description: string;
+            };
+            browser: {
+                type: string;
+                default: string;
+            };
+        };
+        required: string[];
+    };
+};
+export declare function handler(args: {
+    projectPath: string;
+    browser?: string;
+}): Promise<string>;

package/dist/src/tools/login.d.ts

@@ -0,0 +1,27 @@
+export declare const schema: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            project: {
+                type: string;
+                description: string;
+            };
+            deviceCode: {
+                type: string;
+                description: string;
+            };
+            api: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export declare function handler(args: {
+    project: string;
+    deviceCode?: string;
+    api?: string;
+}): Promise<string>;

package/dist/src/tools/logout.d.ts

@@ -0,0 +1,9 @@
+export declare const schema: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {};
+    };
+};
+export declare function handler(): Promise<string>;

package/dist/src/tools/open.d.ts

@@ -14,6 +14,10 @@ export declare const schema: {
                 enum: string[];
                 description: string;
             };
+            name: {
+                type: string;
+                description: string;
+            };
             browser: {
                 type: string;
                 default: string;
@@ -28,4 +32,5 @@ export declare const schema: {
 };
 export declare function handler(args: ActArgs & {
     surface: string;
+    name?: string;
 }): Promise<string>;

package/dist/src/tools/publish.d.ts

@@ -24,6 +24,8 @@ export declare const schema: {
         required: string[];
     };
 };
+/** Resolve the access token: EXTENSION_DEV_TOKEN env first, then the login creds file. */
+export declare function resolveToken(): string;
 export declare function handler(args: {
     projectPath: string;
     ttlHours?: number;

package/dist/src/tools/whoami.d.ts

@@ -0,0 +1,9 @@
+export declare const schema: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {};
+    };
+};
+export declare function handler(): Promise<string>;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "3.17.0-canary.1779910200.ddcd9eb",
-  "description": "MCP server for building, debugging, and publishing cross-browser extensions. Gives AI assistants programmatic access to the extension.dev platform and template catalog.",
+  "version": "3.17.0",
+  "description": "MCP server that lets AI agents build, run, inspect, and publish browser extensions. 26 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, and Firefox.",
   "license": "MIT",
   "author": {
     "name": "Cezar Augusto",
@@ -11,15 +11,16 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/extensiondev/extension-dev.git"
+    "url": "git+https://github.com/extensiondev/mcp.git"
   },
   "bugs": {
-    "url": "https://github.com/extensiondev/extension-dev/issues"
+    "url": "https://github.com/extensiondev/mcp/issues"
   },
-  "homepage": "https://github.com/extensiondev/extension-dev#readme",
+  "homepage": "https://github.com/extensiondev/mcp#readme",
   "engines": {
     "node": ">=20.18"
   },
+  "packageManager": "pnpm@10.19.0",
   "exports": {
     ".": {
       "types": "./dist/module.d.ts",
@@ -39,6 +40,15 @@
     "CHANGELOG.md",
     "LICENSE"
   ],
+  "scripts": {
+    "clean": "rm -rf dist",
+    "watch": "rslib build --watch",
+    "compile": "rslib build",
+    "build": "pnpm run compile",
+    "start": "node bin/extension-mcp.js",
+    "test": "vitest run",
+    "prepublishOnly": "pnpm run test && pnpm run compile"
+  },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -46,15 +56,20 @@
   "keywords": [
     "mcp",
     "model-context-protocol",
-    "browser-extension",
-    "extension.dev",
-    "browser-extension-development",
-    "extension-dev",
+    "ai-agent",
+    "agents",
     "claude",
     "claude-code",
-    "ai-tools",
+    "claude-desktop",
+    "cursor",
+    "browser-extension",
+    "chrome-extension",
+    "firefox-addon",
+    "manifest-v3",
     "webextension",
-    "cross-browser"
+    "cross-browser",
+    "developer-tools",
+    "extension.dev"
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
@@ -68,14 +83,6 @@
     "@types/node": "^25.2.0",
     "@types/ws": "^8.18.1",
     "typescript": "6.0.2",
-    "vitest": "3.2.2"
-  },
-  "scripts": {
-    "clean": "rm -rf dist",
-    "watch": "rslib build --watch",
-    "compile": "rslib build",
-    "build": "pnpm run compile",
-    "start": "node bin/extension-mcp.js",
-    "test": "vitest run"
+    "vitest": "^4.1.3"
   }
-}
+}

package/dist/rslib.config.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("@rslib/core").RslibConfig;
-export default _default;

package/dist/vitest.config.d.ts

@@ -1,3 +0,0 @@
-import type { UserConfig } from "vitest/config";
-declare const config: UserConfig;
-export default config;