@extension.dev/mcp 4.3.0 → 4.5.0

package/dist/src/lib/browser-family.d.ts

@@ -1,4 +1,5 @@
 export declare const CHROMIUM_FAMILY: ReadonlySet<string>;
 export declare const GECKO_FAMILY: ReadonlySet<string>;
+export declare const WEBKIT_FAMILY: ReadonlySet<string>;
 export declare function isChromiumFamily(browser: string): boolean;
 export declare function isGeckoFamily(browser: string): boolean;

package/dist/src/lib/credentials.d.ts

@@ -0,0 +1,24 @@
+export interface StoredCredentials {
+    version: 1;
+    /** The HMAC access token the publish path sends as `Bearer`. */
+    token: string;
+    workspaceSlug: string;
+    projectSlug: string;
+    /** Token expiry as unix epoch seconds (0 if unknown). */
+    expiresAt: number;
+    /** Platform base URL the token was minted against. */
+    api: string;
+}
+export declare function credentialsPath(): string;
+export declare function readCredentials(): StoredCredentials | null;
+export declare function writeCredentials(creds: StoredCredentials): string;
+export declare function clearCredentials(): {
+    cleared: boolean;
+    path: string;
+};
+/**
+ * Return stored credentials only if the token has not expired. Used by the
+ * publish token resolution so an expired local token falls through cleanly to
+ * "no token" instead of producing a 401 from the platform.
+ */
+export declare function readValidCredentials(nowSeconds?: number): StoredCredentials | null;

package/dist/src/lib/github-device.d.ts

@@ -0,0 +1,40 @@
+export interface DeviceCodeStart {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    /** Minimum seconds to wait between polls. */
+    interval: number;
+    /** Seconds until the device code expires. */
+    expiresIn: number;
+}
+export type PollResult = {
+    ok: true;
+    githubToken: string;
+} | {
+    ok: false;
+    reason: "pending" | "expired" | "denied";
+    error?: string;
+};
+type FetchImpl = typeof fetch;
+type SleepImpl = (ms: number) => Promise<void>;
+export declare function startDeviceCode(args: {
+    clientId: string;
+    scope?: string;
+    fetchImpl?: FetchImpl;
+}): Promise<DeviceCodeStart>;
+/**
+ * Poll for the access token until the budget elapses. A budget shorter than
+ * the device-code lifetime lets a caller (e.g. an MCP tool that must return
+ * promptly) poll in bounded slices and report "pending" between calls; a long
+ * budget (a blocking CLI) waits the whole time. Returns `pending` only on
+ * budget exhaustion; `expired`/`denied` are terminal.
+ */
+export declare function pollForToken(args: {
+    clientId: string;
+    deviceCode: string;
+    interval: number;
+    budgetMs: number;
+    fetchImpl?: FetchImpl;
+    sleepImpl?: SleepImpl;
+}): Promise<PollResult>;
+export {};

package/dist/src/lib/launch-flags.d.ts

@@ -0,0 +1,43 @@
+export declare const LAUNCH_FLAG_SCHEMA: {
+    readonly profile: {
+        readonly type: "string";
+        readonly description: "Browser profile path, or \"false\" to reuse the default user profile. Omit for a fresh throwaway profile.";
+    };
+    readonly startingUrl: {
+        readonly type: "string";
+        readonly description: "URL the browser opens on launch";
+    };
+    readonly chromiumBinary: {
+        readonly type: "string";
+        readonly description: "Path to a custom Chromium-based binary (overrides browser)";
+    };
+    readonly geckoBinary: {
+        readonly type: "string";
+        readonly description: "Path to a custom Gecko/Firefox binary (overrides browser)";
+    };
+    readonly host: {
+        readonly type: "string";
+        readonly description: "Dev server bind host. Use 0.0.0.0 for Docker or devcontainers. Defaults to 127.0.0.1";
+    };
+    readonly publicHost: {
+        readonly type: "string";
+        readonly description: "Connectable host the browser dials for HMR and reload when it differs from the bind host";
+    };
+    readonly extensions: {
+        readonly type: "array";
+        readonly items: {
+            readonly type: "string";
+        };
+        readonly description: "Companion extension paths or store URLs to load alongside the project";
+    };
+};
+export interface LaunchFlagArgs {
+    profile?: string;
+    startingUrl?: string;
+    chromiumBinary?: string;
+    geckoBinary?: string;
+    host?: string;
+    publicHost?: string;
+    extensions?: string[];
+}
+export declare function launchFlagArgs(args: LaunchFlagArgs): string[];

package/dist/src/lib/login-flow.d.ts

@@ -0,0 +1,40 @@
+import { type StoredCredentials } from "./credentials";
+type FetchImpl = typeof fetch;
+export declare function resolveApiBase(api?: string): string;
+/**
+ * Validate the platform base URL BEFORE we attach a bearer token to a request to
+ * it. SECURITY: the `api` arg / EXTENSION_DEV_API_URL is operator-supplied, but a
+ * hostile value (e.g. via prompt-injection in the client) could redirect the
+ * token to an attacker. The access token must never leave over plaintext or go to
+ * an arbitrary scheme, so we require https -- allowing http only for localhost
+ * dev. Returns the normalized base (no trailing slash) or an error message.
+ */
+export declare function safeApiBase(raw: string): {
+    ok: true;
+    base: string;
+} | {
+    ok: false;
+    message: string;
+};
+export interface LoginConfig {
+    clientId: string;
+    scope: string;
+}
+/**
+ * Resolve the GitHub OAuth client id the device flow authenticates against.
+ * EXTENSION_DEV_GITHUB_CLIENT_ID overrides (useful when pointing at a self-
+ * hosted platform); otherwise it comes from the platform's public config.
+ */
+export declare function fetchLoginConfig(apiBase: string, fetchImpl?: FetchImpl): Promise<LoginConfig>;
+/**
+ * Trade a verified GitHub user token for a project-scoped access token and
+ * write it to the local credentials file. Returns the stored credentials
+ * (token included for the caller's in-memory use; never logged).
+ */
+export declare function exchangeAndPersist(args: {
+    apiBase: string;
+    githubToken: string;
+    project: string;
+    fetchImpl?: FetchImpl;
+}): Promise<StoredCredentials>;
+export {};

package/dist/src/lib/publish.d.ts

@@ -0,0 +1,31 @@
+type FetchImpl = typeof fetch;
+/** Resolve the access token: EXTENSION_DEV_TOKEN env first, then the login creds file. */
+export declare function resolveToken(): string;
+export interface PublishOptions {
+    /** Share-link lifetime in hours (1-168, platform default 24). */
+    ttlHours?: number;
+    /** Pin the share URL to a specific build sha. */
+    buildSha?: string;
+    /** Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL). */
+    api?: string;
+    /** Explicit token; defaults to resolveToken(). */
+    token?: string;
+    fetchImpl?: FetchImpl;
+}
+export type PublishResult = {
+    ok: true;
+    data: Record<string, unknown>;
+} | {
+    ok: false;
+    error: {
+        name: string;
+        message: string;
+    };
+};
+/**
+ * Publish the project the token is scoped to and return the platform
+ * response (shareUrl, visibility, ...). The publish target is identified by
+ * the token's claims (workspaceSlug/projectSlug), so no project path is sent.
+ */
+export declare function publish(options?: PublishOptions): Promise<PublishResult>;
+export {};

package/dist/src/tools/build.d.ts

@@ -24,6 +24,26 @@ export declare const schema: {
                 default: boolean;
                 description: string;
             };
+            zipFilename: {
+                type: string;
+                description: string;
+            };
+            polyfill: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            silent: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            mode: {
+                type: string;
+                enum: string[];
+                default: string;
+                description: string;
+            };
         };
         required: string[];
     };
@@ -33,4 +53,8 @@ export declare function handler(args: {
     browser?: string;
     zip?: boolean;
     zipSource?: boolean;
+    zipFilename?: string;
+    polyfill?: boolean;
+    silent?: boolean;
+    mode?: "development" | "production" | "none";
 }): Promise<string>;

package/dist/src/tools/dev.d.ts

@@ -1,9 +1,51 @@
+import { type LaunchFlagArgs } from "../lib/launch-flags";
 export declare const schema: {
     name: string;
     description: string;
     inputSchema: {
         type: "object";
         properties: {
+            allowControl: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            allowEval: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            profile: {
+                readonly type: "string";
+                readonly description: "Browser profile path, or \"false\" to reuse the default user profile. Omit for a fresh throwaway profile.";
+            };
+            startingUrl: {
+                readonly type: "string";
+                readonly description: "URL the browser opens on launch";
+            };
+            chromiumBinary: {
+                readonly type: "string";
+                readonly description: "Path to a custom Chromium-based binary (overrides browser)";
+            };
+            geckoBinary: {
+                readonly type: "string";
+                readonly description: "Path to a custom Gecko/Firefox binary (overrides browser)";
+            };
+            host: {
+                readonly type: "string";
+                readonly description: "Dev server bind host. Use 0.0.0.0 for Docker or devcontainers. Defaults to 127.0.0.1";
+            };
+            publicHost: {
+                readonly type: "string";
+                readonly description: "Connectable host the browser dials for HMR and reload when it differs from the bind host";
+            };
+            extensions: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Companion extension paths or store URLs to load alongside the project";
+            };
             projectPath: {
                 type: string;
                 description: string;
@@ -22,12 +64,7 @@ export declare const schema: {
                 default: boolean;
                 description: string;
             };
-            allowControl: {
-                type: string;
-                default: boolean;
-                description: string;
-            };
-            allowEval: {
+            polyfill: {
                 type: string;
                 default: boolean;
                 description: string;
@@ -41,6 +78,7 @@ export declare function handler(args: {
     browser?: string;
     port?: number;
     noBrowser?: boolean;
+    polyfill?: boolean;
     allowControl?: boolean;
     allowEval?: boolean;
-}): Promise<string>;
+} & LaunchFlagArgs): Promise<string>;

package/dist/src/tools/preview.d.ts

@@ -1,9 +1,41 @@
+import { type LaunchFlagArgs } from "../lib/launch-flags";
 export declare const schema: {
     name: string;
     description: string;
     inputSchema: {
         type: "object";
         properties: {
+            profile: {
+                readonly type: "string";
+                readonly description: "Browser profile path, or \"false\" to reuse the default user profile. Omit for a fresh throwaway profile.";
+            };
+            startingUrl: {
+                readonly type: "string";
+                readonly description: "URL the browser opens on launch";
+            };
+            chromiumBinary: {
+                readonly type: "string";
+                readonly description: "Path to a custom Chromium-based binary (overrides browser)";
+            };
+            geckoBinary: {
+                readonly type: "string";
+                readonly description: "Path to a custom Gecko/Firefox binary (overrides browser)";
+            };
+            host: {
+                readonly type: "string";
+                readonly description: "Dev server bind host. Use 0.0.0.0 for Docker or devcontainers. Defaults to 127.0.0.1";
+            };
+            publicHost: {
+                readonly type: "string";
+                readonly description: "Connectable host the browser dials for HMR and reload when it differs from the bind host";
+            };
+            extensions: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Companion extension paths or store URLs to load alongside the project";
+            };
             projectPath: {
                 type: string;
                 description: string;
@@ -13,6 +45,15 @@ export declare const schema: {
                 enum: string[];
                 default: string;
             };
+            port: {
+                type: string;
+                description: string;
+            };
+            noBrowser: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
         };
         required: string[];
     };
@@ -20,4 +61,6 @@ export declare const schema: {
 export declare function handler(args: {
     projectPath: string;
     browser?: string;
-}): Promise<string>;
+    port?: number;
+    noBrowser?: boolean;
+} & LaunchFlagArgs): Promise<string>;

package/dist/src/tools/start.d.ts

@@ -1,9 +1,41 @@
+import { type LaunchFlagArgs } from "../lib/launch-flags";
 export declare const schema: {
     name: string;
     description: string;
     inputSchema: {
         type: "object";
         properties: {
+            profile: {
+                readonly type: "string";
+                readonly description: "Browser profile path, or \"false\" to reuse the default user profile. Omit for a fresh throwaway profile.";
+            };
+            startingUrl: {
+                readonly type: "string";
+                readonly description: "URL the browser opens on launch";
+            };
+            chromiumBinary: {
+                readonly type: "string";
+                readonly description: "Path to a custom Chromium-based binary (overrides browser)";
+            };
+            geckoBinary: {
+                readonly type: "string";
+                readonly description: "Path to a custom Gecko/Firefox binary (overrides browser)";
+            };
+            host: {
+                readonly type: "string";
+                readonly description: "Dev server bind host. Use 0.0.0.0 for Docker or devcontainers. Defaults to 127.0.0.1";
+            };
+            publicHost: {
+                readonly type: "string";
+                readonly description: "Connectable host the browser dials for HMR and reload when it differs from the bind host";
+            };
+            extensions: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Companion extension paths or store URLs to load alongside the project";
+            };
             projectPath: {
                 type: string;
                 description: string;
@@ -18,6 +50,15 @@ export declare const schema: {
                 default: boolean;
                 description: string;
             };
+            port: {
+                type: string;
+                description: string;
+            };
+            noBrowser: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
         };
         required: string[];
     };
@@ -26,4 +67,6 @@ export declare function handler(args: {
     projectPath: string;
     browser?: string;
     polyfill?: boolean;
-}): Promise<string>;
+    port?: number;
+    noBrowser?: boolean;
+} & LaunchFlagArgs): Promise<string>;

package/dist/src/tools/uninstall-browser.d.ts

@@ -0,0 +1,24 @@
+export declare const schema: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            browser: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            all: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+        };
+        required: never[];
+    };
+};
+export declare function handler(args: {
+    browser?: string;
+    all?: boolean;
+}): Promise<string>;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "4.3.0",
-  "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 29 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, and Firefox. Powered by extension.dev and Extension.js.",
+  "version": "4.5.0",
+  "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 30 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "MIT",
   "author": {
@@ -21,6 +21,7 @@
   "engines": {
     "node": ">=20.18"
   },
+  "packageManager": "pnpm@10.19.0",
   "exports": {
     ".": {
       "types": "./dist/module.d.ts",
@@ -42,8 +43,20 @@
     "CHANGELOG.md",
     "LICENSE"
   ],
+  "scripts": {
+    "clean": "rm -rf dist",
+    "watch": "rslib build --watch",
+    "compile": "rslib build",
+    "build": "pnpm run compile",
+    "start": "node bin/extension-mcp.js",
+    "test": "vitest run",
+    "prepack": "node scripts/readme-logo-width.mjs npm",
+    "postpack": "node scripts/readme-logo-width.mjs github",
+    "prepublishOnly": "pnpm run test && pnpm run compile"
+  },
   "publishConfig": {
     "access": "public",
+    "provenance": true,
     "registry": "https://registry.npmjs.org"
   },
   "keywords": [
@@ -62,6 +75,7 @@
     "chrome-extension",
     "firefox-addon",
     "edge-extension",
+    "safari-web-extension",
     "manifest-v3",
     "webextension",
     "cross-browser",
@@ -70,13 +84,12 @@
     "extension.js"
   ],
   "dependencies": {
-    "@extension.dev/core": "^0.2.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "browser-extension-manifest-fields": "^2.2.9",
     "cross-spawn": "^7.0.6",
-    "extension-create": "^4.0.8",
-    "extension-develop": "^4.0.8",
-    "extension-install": "^4.0.8",
+    "extension-create": "^4.0.11",
+    "extension-develop": "^4.0.11",
+    "extension-install": "^4.0.11",
     "ws": "^8.20.0"
   },
   "devDependencies": {
@@ -85,13 +98,5 @@
     "@types/ws": "^8.18.1",
     "typescript": "6.0.2",
     "vitest": "^4.1.3"
-  },
-  "scripts": {
-    "clean": "rm -rf dist",
-    "watch": "rslib build --watch",
-    "compile": "rslib build",
-    "build": "pnpm run compile",
-    "start": "node bin/extension-mcp.js",
-    "test": "vitest run"
   }
-}
+}

package/server.json

@@ -1,19 +1,19 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
   "name": "io.github.extensiondev/mcp",
-  "description": "Build, run, inspect, and publish browser extensions from any MCP client. 29 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, and Firefox.",
+  "description": "Build, run, inspect, and publish browser extensions from any MCP client. 30 tools, 11 browsers.",
   "repository": {
     "url": "https://github.com/extensiondev/mcp",
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "4.3.0",
+  "version": "4.5.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "4.3.0",
+      "version": "4.5.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"