@extension.dev/mcp 4.3.0 → 4.5.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "4.3.0",
+      "version": "4.5.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "4.3.0",
+  "version": "4.5.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "boss@cezaraugusto.net",
@@ -24,7 +24,10 @@
   "mcpServers": {
     "extension-dev": {
       "command": "npx",
-      "args": ["-y", "@extension.dev/mcp"]
+      "args": [
+        "-y",
+        "@extension.dev/mcp"
+      ]
     }
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 4.5.0
+
+The platform client (GitHub device-code login, the credential store, and the
+publish flow) is now vendored directly in this package instead of the
+separate `@extension.dev/core` dependency. No behavior change: the tool
+schemas, the credential file, token resolution, and the publish error
+envelopes are all unchanged. This drops a runtime dependency and the
+two-package release step.
+
+## 4.4.0
+
+Browser-matrix parity release: the tool surface now mirrors the engine
+CLI flag for flag, and a 30th tool cleans up the managed browser cache.
+
+- New tool `extension_uninstall_browser`. Removes a managed browser
+  binary from the Extension.js cache (or every one with `all: true`).
+  Only touches the managed cache, never system-installed browsers.
+- Full Extension.js browser matrix in `extension_detect_browsers`: all
+  eleven supported browsers (chrome, chromium, edge, brave, opera,
+  vivaldi, yandex, firefox, waterfox, librewolf, safari) are probed,
+  each reported with its engine family and whether the managed
+  installer can provision it.
+- Shared browser-launch flags on `extension_dev`, `extension_start`,
+  and `extension_preview`: `profile` (path, or `"false"` to reuse the
+  default user profile), `startingUrl`, `chromiumBinary` /
+  `geckoBinary` custom binaries, `host` / `publicHost` for Docker and
+  devcontainer splits, and companion `extensions` loaded alongside the
+  project.
+- `extension_build` closes its gaps against the engine CLI:
+  `zipFilename`, `polyfill`, `silent`, and `mode`
+  (development/production/none, also sets NODE_ENV).
+- Engine dependencies bumped to ^4.0.11.
+- The shipped debugging docs are rewritten around the live inspect
+  surface.
+- Release plumbing: npm publishes now carry provenance from a
+  changelog-backed GitHub workflow, the npm README renders the logo at
+  the right width via pack hooks, and the Safari web extension keyword
+  aids npm discovery.
+
 ## 4.3.0
 
 Diagnosis + version-skew release: a 29th tool that turns "an act tool

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Extension Dev
+Copyright (c) Cezar Augusto and the extension.dev collaborators
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,15 +1,15 @@
-[npm-version-image]: https://img.shields.io/npm/v/%40extension.dev%2Fmcp.svg?color=0971fe
+[npm-version-image]: https://img.shields.io/npm/v/%40extension.dev%2Fmcp.svg?color=26FFB8
 [npm-version-url]: https://www.npmjs.com/package/@extension.dev/mcp
-[npm-downloads-image]: https://img.shields.io/npm/dm/%40extension.dev%2Fmcp.svg?color=0971fe
+[npm-downloads-image]: https://img.shields.io/npm/dm/%40extension.dev%2Fmcp.svg?color=26FFB8
 [npm-downloads-url]: https://www.npmjs.com/package/@extension.dev/mcp
-[discord-image]: https://img.shields.io/discord/1253608412890271755?label=Discord&logo=discord&style=flat&color=0971fe
+[discord-image]: https://img.shields.io/discord/1253608412890271755?label=Discord&logo=discord&style=flat&color=26FFB8
 [discord-url]: https://discord.gg/v9h2RgeTSN
 
 # @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-> Give your AI agent hands for browser extension development. 29 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
+> Give your AI agent hands for browser extension development. 30 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
-<img alt="Logo" align="right" src="https://avatars.githubusercontent.com/u/106714027" width="20%" />
+<img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="15.5%" />
 
 ```bash
 claude mcp add extension-dev npx @extension.dev/mcp
@@ -26,7 +26,7 @@ Extensions fail silently: content scripts that never inject, panels that never o
 These tools give agents eyes on the live browser, so they debug from evidence instead of guessing:
 
 - **Scaffold** from the 60+ template catalog behind [templates.extension.dev](https://templates.extension.dev), or add a popup, sidebar, or content script to an existing project
-- **Run** the dev server with HMR in Chrome, Edge, Firefox, or any managed browser binary, no build config
+- **Run** the dev server with HMR in Chrome, Edge, Firefox, Safari, Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf, or any Chromium- or Gecko-based binary, no build config
 - **See** the live DOM, unified logs from every extension context, `chrome.storage` contents, and the loaded-extension list
 - **Act**: evaluate code in any context, trigger the action button and commands, reload the extension, replay events
 - **Ship**: validate the manifest cross-browser, build for production, publish a shareable preview, and promote builds to release channels headlessly
@@ -113,6 +113,7 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | act | `extension_reload` | Reload extension or tab |
 | act | `extension_open` | Open a surface / trigger `action`, `command` |
 | browsers | `extension_install_browser` | Install a managed browser binary |
+| browsers | `extension_uninstall_browser` | Remove a managed browser binary |
 | browsers | `extension_list_browsers` | List managed browsers |
 | browsers | `extension_detect_browsers` | Detect system browsers |
 | platform | `extension_login` | GitHub device-code login, stored token |
@@ -133,7 +134,6 @@ The four platform tools connect agents to [extension.dev](https://extension.dev)
 | --- | --- |
 | [`@extension.dev/skill`](https://www.npmjs.com/package/@extension.dev/skill) | Teach AI agents the judgment half: cross-browser rules, gotchas, playbooks |
 | [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) | Ship to Chrome, Firefox, and Edge stores from CI |
-| [`@extension.dev/core`](https://www.npmjs.com/package/@extension.dev/core) | Authenticate and publish to the extension.dev platform |
 
 All of it rides on [Extension.js](https://github.com/extension-js/extension.js), the open-source cross-browser extension framework.
 
@@ -145,4 +145,4 @@ All of it rides on [Extension.js](https://github.com/extension-js/extension.js),
 
 ## License
 
-MIT (c) Cezar Augusto and the Extension.js authors.
+MIT (c) Cezar Augusto and the extension.dev collaborators

package/bin/extension-mcp.js

@@ -1,4 +1,11 @@
 #!/usr/bin/env node
+// ███╗   ███╗ ██████╗██████╗
+// ████╗ ████║██╔════╝██╔══██╗
+// ██╔████╔██║██║     ██████╔╝
+// ██║╚██╔╝██║██║     ██╔═══╝
+// ██║ ╚═╝ ██║╚██████╗██║
+// ╚═╝     ╚═╝ ╚═════╝╚═╝
+// MIT License (c) Cezar Augusto and the extension.dev collaborators
 import {startServer, runCli} from '../dist/module.js'
 
 const [, , cmd, ...rest] = process.argv

package/claude/CLAUDE.md

@@ -170,52 +170,42 @@ https://github.com/extension-js/examples/tree/main/examples/<slug>/src
 
 ## When debugging
 
-### Source inspection (`--source`)
+### Live DOM inspection (`extension inspect` / MCP inspect tools)
 
-The `--source` flag on `dev` gives live DOM inspection of a running extension:
+Two ways to see inside a running extension. Both need an active dev session.
 
-```bash
-# Basic: see injected HTML after content scripts run
-npm run dev -- --source https://example.com
+**Agent bridge (CDP-free, localhost): `extension inspect`.** Requires the session to be started with `--allow-control` (or `allowControl: true` on the `extension_dev` MCP tool). Sees open shadow roots but not closed ones.
 
-# Structured JSON output (best for programmatic use)
-npm run dev -- --source https://example.com --source-format json
+```bash
+# Structured summary of the content-script DOM in a tab
+extension inspect --tab 1
 
-# Probe specific selectors
-npm run dev -- --source https://example.com --source-probe "#my-root,.sidebar"
+# Inspect an open extension surface instead of a tab
+extension inspect --context popup
 
-# Full inspection: DOM snapshots, console summary, diffs on rebuild
-npm run dev -- --source https://example.com --source-dom --source-console --source-diff
+# Include byte-capped HTML plus the last 20 console lines
+extension inspect --tab 1 --include summary,html --with-console 20
 ```
 
-**Available --source sub-flags:**
-
-| Flag                         | Default   | Purpose                                           |
-| ---------------------------- | --------- | ------------------------------------------------- |
-| `--source [url]`             | —         | Open URL and print live HTML after injection      |
-| `--watch-source`             | true      | Re-print on rebuilds                              |
-| `--source-format`            | json      | Output format: `pretty`, `json`, `ndjson`         |
-| `--source-summary`           | auto      | Compact stats instead of full HTML                |
-| `--source-meta`              | auto      | Page metadata: readyState, viewport, frames       |
-| `--source-probe <selectors>` | —         | CSS selectors to query (comma-separated)          |
-| `--source-tree`              | off       | Extension root DOM tree: `off`, `root-only`       |
-| `--source-console`           | auto      | Console counts: error/warn/info/log/debug         |
-| `--source-dom`               | auto      | DOM snapshots and structural diffs                |
-| `--source-max-bytes`         | 256KB     | Truncate HTML output (0 = unlimited)              |
-| `--source-redact`            | safe      | Redact sensitive content: `off`, `safe`, `strict` |
-| `--source-include-shadow`    | open-only | Shadow DOM: `off`, `open-only`, `all`             |
-| `--source-diff`              | auto      | Include diff metadata on watch updates            |
-
-**Output event types** (in JSON/NDJSON format):
-
-- `page_html` — full injected HTML
-- `page_html_summary` — root/script/style/link counts
-- `page_meta` — readyState, viewport, frame count
-- `dom_snapshot` — structured tree (tag, id, classes, role, max 500 nodes)
-- `dom_diff` — added/removed/changed between rebuilds
-- `console_summary` — error/warn counts + top 5 unique messages
-- `selector_probe` — per-selector element counts and samples
-- `extension_root_tree` — extension root elements with reinject generations
+| Flag                 | Default | Purpose                                                                                        |
+| -------------------- | ------- | ---------------------------------------------------------------------------------------------- |
+| `--context <name>`   | content | `content`/`page` (needs `--tab`) or an open surface: `popup`, `options`, `sidebar`, `devtools` |
+| `--tab <id>`         | -       | Tab id to inspect (required for content/page)                                                  |
+| `--include <list>`   | summary | Comma-separated: `summary`, `html` (html is byte-capped)                                       |
+| `--max-bytes <n>`    | 262144  | Cap on returned HTML bytes                                                                     |
+| `--with-console [n]` | 20      | Also include the last n console lines for the target                                           |
+
+The `extension_dom_inspect` MCP tool wraps this verb one-to-one.
+
+**Debugging protocol (Chromium CDP): `extension_source_inspect` MCP tool.** Connects directly to the running session's debug port. Use it when the bridge is not enough: closed shadow roots (`deepDom`), selector probes, DOM snapshots, console summaries, or navigating the tab to a URL before inspecting. Returns structured events:
+
+- `page_html` - full injected HTML (after content scripts run)
+- `page_html_summary` - root/script/style/link counts
+- `page_meta` - readyState, viewport, frame count
+- `dom_snapshot` - structured tree (tag, id, classes, role, max 500 nodes)
+- `console_summary` - error/warn counts + top 5 unique messages
+- `selector_probe` - per-selector element counts and samples
+- `extension_root_tree` - extension root elements with reinject generations
 
 ### Unified logging (`--logs`)
 

package/claude/commands/extension-debug.md

@@ -20,9 +20,8 @@ Debug the currently running extension dev session. The user said: $ARGUMENTS
    - Report the results in a structured way
 
    If MCP is not available:
-   - Suggest the CLI equivalent: `npx extension dev --source <url> --source-format json --source-console`
-   - Read `dist/extension-js/chrome/ready.json` to get the CDP port
-   - Report the port and suggest Chrome DevTools inspection
+   - If the session was started with `--allow-control`, suggest the CLI equivalent: `npx extension inspect --tab <id> --include summary,html --with-console 20`
+   - Otherwise read `dist/extension-js/chrome/ready.json` to get the CDP port and suggest Chrome DevTools inspection
 
 3. **Exercise event handlers (when the bug is in an action / command / shortcut)**
    If the session was started with `--allow-control`, fire the events a user would, without clicking:

package/claude/rules/mcp-tools.md

@@ -164,7 +164,7 @@ These map directly to existing programmatic APIs and provide immediate value.
       },
       "browser": {
         "type": "string",
-        "enum": ["chrome", "edge", "firefox", "chromium-based", "gecko-based"],
+        "enum": ["chrome", "chromium", "edge", "brave", "opera", "vivaldi", "yandex", "firefox", "waterfox", "librewolf", "safari", "chromium-based", "gecko-based", "firefox-based", "webkit-based"],
         "default": "chrome",
         "description": "Target browser"
       },
@@ -186,6 +186,8 @@ These map directly to existing programmatic APIs and provide immediate value.
 
 **Returns:** `{ outputPath, duration, zipPath?, warnings[] }`
 
+`extension_build` also accepts `zipFilename` (string), `polyfill` (boolean, default false), `silent` (boolean), and `mode` (`development` | `production` | `none`, default `production`).
+
 ---
 
 #### `extension_dev`
@@ -207,7 +209,7 @@ These map directly to existing programmatic APIs and provide immediate value.
       },
       "browser": {
         "type": "string",
-        "enum": ["chrome", "edge", "firefox", "chromium-based", "gecko-based"],
+        "enum": ["chrome", "chromium", "edge", "brave", "opera", "vivaldi", "yandex", "firefox", "waterfox", "librewolf", "safari", "chromium-based", "gecko-based", "firefox-based", "webkit-based"],
         "default": "chrome"
       },
       "port": {
@@ -218,7 +220,21 @@ These map directly to existing programmatic APIs and provide immediate value.
         "type": "boolean",
         "default": false,
         "description": "Start dev server without launching browser"
-      }
+      },
+      "polyfill": {
+        "type": "boolean",
+        "default": true,
+        "description": "Apply cross-browser polyfill"
+      },
+      "profile": { "type": "string", "description": "Browser profile path, or \"false\" for the default user profile" },
+      "startingUrl": { "type": "string", "description": "URL the browser opens on launch" },
+      "chromiumBinary": { "type": "string", "description": "Custom Chromium-based binary path" },
+      "geckoBinary": { "type": "string", "description": "Custom Gecko/Firefox binary path" },
+      "host": { "type": "string", "description": "Bind host (0.0.0.0 for Docker); default 127.0.0.1" },
+      "publicHost": { "type": "string", "description": "Connectable host for HMR/reload when it differs from the bind host" },
+      "extensions": { "type": "array", "items": { "type": "string" }, "description": "Companion extension paths or store URLs" },
+      "allowControl": { "type": "boolean", "default": false, "description": "Enable the agent-bridge control channel" },
+      "allowEval": { "type": "boolean", "default": false, "description": "Additionally enable extension_eval" }
     },
     "required": ["projectPath"]
   }
@@ -248,7 +264,7 @@ These map directly to existing programmatic APIs and provide immediate value.
       },
       "browser": {
         "type": "string",
-        "enum": ["chrome", "edge", "firefox", "chromium-based", "gecko-based"],
+        "enum": ["chrome", "chromium", "edge", "brave", "opera", "vivaldi", "yandex", "firefox", "waterfox", "librewolf", "safari", "chromium-based", "gecko-based", "firefox-based", "webkit-based"],
         "default": "chrome"
       },
       "polyfill": {
@@ -274,6 +290,8 @@ These map directly to existing programmatic APIs and provide immediate value.
 
 **Returns:** When `wait: true`, returns the `ready.json` contract: `{ status, browser, port, pid, distPath, manifestPath, compiledAt }`. Otherwise returns `{ pid, browser }`.
 
+Both `extension_start` and `extension_preview` also accept `port`, `noBrowser`, and the shared launch flags: `profile`, `startingUrl`, `chromiumBinary`, `geckoBinary`, `host`, `publicHost`, `extensions` (same shapes as on `extension_dev`).
+
 **Why this is distinct from dev:** `dev` uses HMR and watches files. `start` builds once in production mode and launches — what you'd use to verify a production build works before publishing.
 
 ---
@@ -297,7 +315,7 @@ These map directly to existing programmatic APIs and provide immediate value.
       },
       "browser": {
         "type": "string",
-        "enum": ["chrome", "edge", "firefox", "chromium-based", "gecko-based"],
+        "enum": ["chrome", "chromium", "edge", "brave", "opera", "vivaldi", "yandex", "firefox", "waterfox", "librewolf", "safari", "chromium-based", "gecko-based", "firefox-based", "webkit-based"],
         "default": "chrome"
       }
     },
@@ -390,7 +408,7 @@ The `similarTemplates` field lists templates from the catalog with similar surfa
 
 #### `extension_inspect`
 
-**Source:** New tool — wraps `--source` inspection from `programs/develop`
+**Source:** New tool; static analysis of the built `dist/` output
 
 **Purpose:** Analyze a built extension's structure, size, and entry points.
 
@@ -474,7 +492,7 @@ The `similarTemplates` field lists templates from the catalog with similar surfa
 
 **Source:** `programs/extension/browsers/` → CDP/RDP source inspection system
 
-**Purpose:** Live-inspect a running extension's DOM, console, and content script injection state. This is the `--source` system exposed as an MCP tool — it gives Claude _eyes_ into the running extension.
+**Purpose:** Live-inspect a running extension's DOM, console, and content script injection state over the debugging protocol. It gives Claude _eyes_ into the running extension. (This grew out of the engine's old `dev --source` CLI flags, which are no longer registered; the MCP connects to the CDP port directly.)
 
 ```json
 {
@@ -500,7 +518,7 @@ The `similarTemplates` field lists templates from the catalog with similar surfa
         "type": "array",
         "items": {
           "type": "string",
-          "enum": ["html", "summary", "meta", "dom_snapshot", "console", "tree"]
+          "enum": ["html", "summary", "meta", "dom_snapshot", "console", "extension_roots"]
         },
         "default": ["summary", "meta", "console"],
         "description": "What data to return"
@@ -537,17 +555,17 @@ The `similarTemplates` field lists templates from the catalog with similar surfa
 }
 ```
 
-**Returns:** Structured NDJSON events based on `include` selection:
+**Returns:** One JSON object; keys appear based on `include` selection:
 
-| Event type            | What it contains                                                                           |
-| --------------------- | ------------------------------------------------------------------------------------------ |
-| `page_html`           | Full injected HTML (after content scripts run)                                             |
-| `page_html_summary`   | Compact stats: root/script/style/link counts                                               |
-| `page_meta`           | readyState, viewport dimensions, frame count                                               |
-| `dom_snapshot`        | Structured tree: tag, id, classes, role, text length, child count (max 500 nodes, depth 6) |
-| `console_summary`     | error/warn/info/log/debug counts + top 5 unique messages                                   |
-| `extension_root_tree` | Extension root elements with reinject generations                                          |
-| `selector_probe`      | Per-selector: count + element samples                                                      |
+| Key              | What it contains                                                                           |
+| ---------------- | ------------------------------------------------------------------------------------------ |
+| `html`           | Full injected HTML (after content scripts run), `htmlTruncated` flag when capped           |
+| `summary`        | Compact stats: html length, script/style/link counts, extension root + body child counts   |
+| `meta`           | readyState, viewport dimensions, frame count                                               |
+| `domSnapshot`    | Structured tree: tag, id, classes, role, text length, child count (max 500 nodes, depth 6) |
+| `console`        | error/warn/info/log/debug counts + top 5 unique messages                                   |
+| `extensionRoots` | Extension root elements with reinject generations                                          |
+| `probes`         | Per-selector: count + element samples (when `probe` selectors are passed)                  |
 
 **Implementation:**
 
@@ -744,6 +762,38 @@ The `similarTemplates` field lists templates from the catalog with similar surfa
 
 ---
 
+#### `extension_uninstall_browser`
+
+**Source:** `extension-install` → `extensionUninstall()`
+
+**Purpose:** Remove a managed browser binary from the Extension.js cache (never system-installed browsers).
+
+```json
+{
+  "name": "extension_uninstall_browser",
+  "inputSchema": {
+    "type": "object",
+    "properties": {
+      "browser": {
+        "type": "string",
+        "enum": ["chrome", "chromium", "edge", "firefox"],
+        "description": "Managed browser to remove"
+      },
+      "all": {
+        "type": "boolean",
+        "default": false,
+        "description": "Remove every managed browser binary"
+      }
+    },
+    "required": []
+  }
+}
+```
+
+**Returns:** `{ status, target, duration }`
+
+---
+
 ## Where each tool lives in the codebase
 
 | MCP Tool                        | Program              | Source API                                | Data source                                 | Needs new code?                            |