@extension.dev/mcp 4.4.0 → 4.6.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "4.4.0",
+      "version": "4.6.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "4.4.0",
+  "version": "4.6.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "boss@cezaraugusto.net",

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 4.6.0
+
+New `extension_deploy` tool (31 tools total): submit a built extension to the
+Chrome Web Store, Firefox AMO, and Edge Add-ons by driving the standalone
+`@extension.dev/deploy` CLI. Store targets are inferred from the `.zip` paths
+you pass. It defaults to a dry run, and store credentials are read from the
+environment or a `.env.submit` file, never from tool arguments, so secrets
+never enter the agent transcript.
+
+## 4.5.0
+
+The platform client (GitHub device-code login, the credential store, and the
+publish flow) is now vendored directly in this package instead of the
+separate `@extension.dev/core` dependency. No behavior change: the tool
+schemas, the credential file, token resolution, and the publish error
+envelopes are all unchanged. This drops a runtime dependency and the
+two-package release step.
+
 ## 4.4.0
 
 Browser-matrix parity release: the tool surface now mirrors the engine

package/README.md

@@ -121,12 +121,13 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | platform | `extension_logout` | Remove stored credentials |
 | platform | `extension_publish` | Publish a shareable preview to extension.dev |
 | platform | `extension_release_promote` | Promote a build to a release channel, headless |
+| platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores (wraps `@extension.dev/deploy`) |
 
 Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI — the project's own `node_modules/.bin/extension` when present, otherwise `npx extension@<pinned>` at the version this package is verified against; everything else runs in-process.
 
 ## From preview to store
 
-The four platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. To automate store submission itself (Chrome Web Store, Edge Add-ons, Firefox AMO), pair with [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy).
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits the built `.zip` to the Chrome Web Store, Edge Add-ons, and Firefox AMO by driving the standalone [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) CLI — it defaults to a dry run and reads store credentials from the environment or a `.env.submit` file, never from tool arguments.
 
 ## The extension.dev stack
 
@@ -134,7 +135,6 @@ The four platform tools connect agents to [extension.dev](https://extension.dev)
 | --- | --- |
 | [`@extension.dev/skill`](https://www.npmjs.com/package/@extension.dev/skill) | Teach AI agents the judgment half: cross-browser rules, gotchas, playbooks |
 | [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) | Ship to Chrome, Firefox, and Edge stores from CI |
-| [`@extension.dev/core`](https://www.npmjs.com/package/@extension.dev/core) | Authenticate and publish to the extension.dev platform |
 
 All of it rides on [Extension.js](https://github.com/extension-js/extension.js), the open-source cross-browser extension framework.
 

package/dist/module.js

@@ -11,7 +11,6 @@ import cross_spawn from "cross-spawn";
 import { filterKeysForThisBrowser } from "browser-extension-manifest-fields";
 import ws from "ws";
 import node_http from "node:http";
-import { clearCredentials, exchangeAndPersist, fetchLoginConfig, pollForToken, publish, readCredentials, resolveApiBase, resolveToken, safeApiBase, startDeviceCode } from "@extension.dev/core";
 import { extensionInstall, extensionUninstall, getManagedBrowsersCacheRoot } from "extension-install";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -33,6 +32,13 @@ __webpack_require__.d(create_namespaceObject, {
     handler: ()=>create_handler,
     schema: ()=>create_schema
 });
+var deploy_namespaceObject = {};
+__webpack_require__.r(deploy_namespaceObject);
+__webpack_require__.d(deploy_namespaceObject, {
+    buildDeployArgs: ()=>buildDeployArgs,
+    handler: ()=>deploy_handler,
+    schema: ()=>deploy_schema
+});
 var detect_browsers_namespaceObject = {};
 __webpack_require__.r(detect_browsers_namespaceObject);
 __webpack_require__.d(detect_browsers_namespaceObject, {
@@ -135,9 +141,9 @@ __webpack_require__.d(preview_namespaceObject, {
     handler: ()=>preview_handler,
     schema: ()=>preview_schema
 });
-var publish_namespaceObject = {};
-__webpack_require__.r(publish_namespaceObject);
-__webpack_require__.d(publish_namespaceObject, {
+var tools_publish_namespaceObject = {};
+__webpack_require__.r(tools_publish_namespaceObject);
+__webpack_require__.d(tools_publish_namespaceObject, {
     handler: ()=>publish_handler,
     schema: ()=>publish_schema
 });
@@ -195,7 +201,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"4.4.0","El":{"OP":"^4.0.11"}}');
+var package_namespaceObject = JSON.parse('{"rE":"4.5.0","El":{"OP":"^4.0.11"}}');
 const create_schema = {
     name: "extension_create",
     description: "Create a new browser extension project from a template in the extension.dev template catalog. Use extension_list_templates to see available options.",
@@ -2790,6 +2796,222 @@ async function dom_inspect_handler(args) {
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
 }
+function credentialsPath() {
+    if ("win32" === process.platform) {
+        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
+        return node_path.join(base, "extension-dev", "auth.json");
+    }
+    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
+    const base = xdg || node_path.join(node_os.homedir(), ".config");
+    return node_path.join(base, "extension-dev", "auth.json");
+}
+function readCredentials() {
+    try {
+        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
+        const data = JSON.parse(raw);
+        if (!data || "object" != typeof data) return null;
+        if (1 !== data.version) return null;
+        const token = String(data.token || "").trim();
+        if (!token) return null;
+        return {
+            version: 1,
+            token,
+            workspaceSlug: String(data.workspaceSlug || ""),
+            projectSlug: String(data.projectSlug || ""),
+            expiresAt: Number(data.expiresAt || 0),
+            api: String(data.api || "")
+        };
+    } catch  {
+        return null;
+    }
+}
+function writeCredentials(creds) {
+    const file = credentialsPath();
+    const dir = node_path.dirname(file);
+    node_fs.mkdirSync(dir, {
+        recursive: true,
+        mode: 448
+    });
+    try {
+        node_fs.chmodSync(dir, 448);
+    } catch  {}
+    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
+        mode: 384
+    });
+    try {
+        node_fs.chmodSync(file, 384);
+    } catch  {}
+    return file;
+}
+function clearCredentials() {
+    const file = credentialsPath();
+    try {
+        node_fs.unlinkSync(file);
+        return {
+            cleared: true,
+            path: file
+        };
+    } catch  {
+        return {
+            cleared: false,
+            path: file
+        };
+    }
+}
+function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
+    const creds = readCredentials();
+    if (!creds) return null;
+    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
+    return creds;
+}
+const DEFAULT_API = "https://www.extension.dev";
+function resolveApiBase(api) {
+    return String(api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API).replace(/\/+$/, "");
+}
+function safeApiBase(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    } catch  {
+        return {
+            ok: false,
+            message: `Invalid platform URL: ${raw}`
+        };
+    }
+    const isLocalhost = "localhost" === parsed.hostname || "127.0.0.1" === parsed.hostname || "[::1]" === parsed.hostname || "::1" === parsed.hostname;
+    if ("https:" !== parsed.protocol && !("http:" === parsed.protocol && isLocalhost)) return {
+        ok: false,
+        message: `Refusing to send the access token to ${raw}: use https (http is allowed only for localhost).`
+    };
+    return {
+        ok: true,
+        base: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "")
+    };
+}
+async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
+    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
+    if (override) return {
+        clientId: override,
+        scope: "read:user"
+    };
+    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
+        headers: {
+            accept: "application/json"
+        }
+    });
+    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
+    const data = await res.json().catch(()=>({}));
+    const clientId = String(data.githubClientId || "").trim();
+    if (!clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
+    return {
+        clientId,
+        scope: String(data.scope || "read:user")
+    };
+}
+async function exchangeAndPersist(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json"
+        },
+        body: JSON.stringify({
+            githubToken: args.githubToken,
+            project: args.project
+        })
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
+    const token = String(data.token || "").trim();
+    if (!token) throw new Error("Login exchange returned no token.");
+    const creds = {
+        version: 1,
+        token,
+        workspaceSlug: String(data.workspaceSlug || ""),
+        projectSlug: String(data.projectSlug || ""),
+        expiresAt: Number(data.expiresAt || 0),
+        api: args.apiBase
+    };
+    writeCredentials(creds);
+    return creds;
+}
+function resolveToken() {
+    const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
+    if (fromEnv) return fromEnv;
+    const creds = readValidCredentials();
+    return creds?.token ? String(creds.token).trim() : "";
+}
+async function publish(options = {}) {
+    const token = options.token ?? resolveToken();
+    if (!token) return {
+        ok: false,
+        error: {
+            name: "PublishAuthError",
+            message: "No token. Run login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
+        }
+    };
+    const doFetch = options.fetchImpl ?? fetch;
+    const apiCheck = safeApiBase(resolveApiBase(options.api));
+    if (!apiCheck.ok) return {
+        ok: false,
+        error: {
+            name: "PublishConfigError",
+            message: apiCheck.message
+        }
+    };
+    const url = `${apiCheck.base}/api/cli/publish`;
+    const body = {};
+    if (null != options.ttlHours) body.ttlHours = Number(options.ttlHours);
+    if (options.buildSha) body.buildSha = options.buildSha;
+    let res;
+    try {
+        res = await doFetch(url, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json"
+            },
+            body: JSON.stringify(body)
+        });
+    } catch (err) {
+        return {
+            ok: false,
+            error: {
+                name: "PublishNetworkError",
+                message: `Could not reach ${url}: ${err?.message || err}`
+            }
+        };
+    }
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) return {
+        ok: false,
+        error: {
+            name: "PublishError",
+            message: `publish failed (${res.status}): ${data?.message || text || "unknown error"}`
+        }
+    };
+    return {
+        ok: true,
+        data
+    };
+}
 const publish_schema = {
     name: "extension_publish",
     description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Posts to the platform's CLI publish endpoint directly. This is the only tool that talks to the hosted platform rather than the local browser.",
@@ -2835,7 +3057,7 @@ async function publish_handler(args) {
     });
     return result.ok ? JSON.stringify(result.data) : JSON.stringify(result);
 }
-const DEFAULT_API = "https://www.extension.dev";
+const release_promote_DEFAULT_API = "https://www.extension.dev";
 const release_promote_schema = {
     name: "extension_release_promote",
     description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: requires a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
@@ -2895,7 +3117,7 @@ async function release_promote_handler(args) {
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
     if (!buildId || !channel) return fail("ReleaseInputError", "buildId and channel are required.");
-    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API));
+    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || release_promote_DEFAULT_API));
     if (!apiCheck.ok) return fail("ReleaseConfigError", apiCheck.message);
     const url = `${apiCheck.base}/api/cli/release/promote`;
     const body = {
@@ -2931,6 +3153,169 @@ async function release_promote_handler(args) {
     if (!res.ok) return fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
     return JSON.stringify(data);
 }
+const DEFAULT_DEPLOY_VERSION = "1.2.1";
+function pinnedDeployVersion() {
+    return String(process.env.EXTENSION_DEPLOY_VERSION || "").trim() || DEFAULT_DEPLOY_VERSION;
+}
+function buildDeployArgs(args) {
+    const argv = [];
+    const pushValue = (flag, value)=>{
+        if (void 0 === value || "" === value) return;
+        argv.push(flag, String(value));
+    };
+    if (false !== args.dryRun) argv.push("--dry-run");
+    pushValue("--chrome-zip", args.chromeZip);
+    pushValue("--chrome-extension-id", args.chromeExtensionId);
+    pushValue("--chrome-publisher-id", args.chromePublisherId);
+    if (args.stagedPublish) argv.push("--chrome-staged-publish");
+    pushValue("--chrome-deploy-percentage", args.chromeDeployPercentage);
+    if (args.chromeSkipSubmitReview) argv.push("--chrome-skip-submit-review");
+    pushValue("--firefox-zip", args.firefoxZip);
+    pushValue("--firefox-sources-zip", args.firefoxSourcesZip);
+    pushValue("--firefox-extension-id", args.firefoxExtensionId);
+    pushValue("--firefox-channel", args.firefoxChannel);
+    pushValue("--edge-zip", args.edgeZip);
+    pushValue("--edge-product-id", args.edgeProductId);
+    if (args.edgeSkipSubmitReview) argv.push("--edge-skip-submit-review");
+    pushValue("--output-json", args.outputJson);
+    return argv;
+}
+const deploy_schema = {
+    name: "extension_deploy",
+    description: "Submit a built extension to the Chrome Web Store, Firefox AMO, and/or Edge Add-ons by driving the standalone @extension.dev/deploy CLI. Provide the built .zip path(s); the target stores are inferred from which zips you pass. DEFAULTS TO A DRY RUN (verifies auth and inputs, uploads nothing) - pass dryRun:false to actually submit, which is irreversible and enters store review. Store CREDENTIALS are NOT arguments: set them in the environment or a .env.submit file in projectPath (CHROME_CLIENT_ID/CHROME_CLIENT_SECRET/CHROME_REFRESH_TOKEN or CHROME_SERVICE_ACCOUNT_JSON; FIREFOX_JWT_ISSUER/FIREFOX_JWT_SECRET; EDGE_CLIENT_ID/EDGE_API_KEY). Runs `npx @extension.dev/deploy`.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            projectPath: {
+                type: "string",
+                description: "Working directory. Relative zip paths and a .env.submit credential file are resolved from here."
+            },
+            chromeZip: {
+                type: "string",
+                description: "Path to the built Chrome extension .zip"
+            },
+            chromeExtensionId: {
+                type: "string",
+                description: "Chrome extension ID (or set CHROME_EXTENSION_ID)"
+            },
+            chromePublisherId: {
+                type: "string",
+                description: "Chrome publisher UUID (or set CHROME_PUBLISHER_ID)"
+            },
+            firefoxZip: {
+                type: "string",
+                description: "Path to the built Firefox extension .zip"
+            },
+            firefoxSourcesZip: {
+                type: "string",
+                description: "Path to the Firefox sources .zip (optional)"
+            },
+            firefoxExtensionId: {
+                type: "string",
+                description: "Firefox add-on GUID or email-style ID"
+            },
+            firefoxChannel: {
+                type: "string",
+                enum: [
+                    "listed",
+                    "unlisted"
+                ],
+                description: "Firefox channel (unlisted is required for a first submission)"
+            },
+            edgeZip: {
+                type: "string",
+                description: "Path to the built Edge extension .zip"
+            },
+            edgeProductId: {
+                type: "string",
+                description: "Edge Partner Center product ID (or set EDGE_PRODUCT_ID)"
+            },
+            dryRun: {
+                type: "boolean",
+                default: true,
+                description: "Verify auth and inputs without uploading or publishing. Pass false to actually submit (irreversible)."
+            },
+            stagedPublish: {
+                type: "boolean",
+                default: false,
+                description: "Chrome: publish as STAGED_PUBLISH so the rollout can be raised review-free later."
+            },
+            chromeDeployPercentage: {
+                type: "number",
+                description: "Chrome staged rollout percentage (1-100)."
+            },
+            chromeSkipSubmitReview: {
+                type: "boolean",
+                default: false,
+                description: "Chrome: upload only, skip the publish/submit-for-review step."
+            },
+            edgeSkipSubmitReview: {
+                type: "boolean",
+                default: false,
+                description: "Edge: upload only, skip the publish/submit-for-review step."
+            },
+            outputJson: {
+                type: "string",
+                description: "Write the machine-readable DeployResult JSON to this path."
+            }
+        },
+        required: [
+            "projectPath"
+        ]
+    }
+};
+async function deploy_handler(args) {
+    if (!args.chromeZip && !args.firefoxZip && !args.edgeZip) return JSON.stringify({
+        ok: false,
+        error: {
+            name: "DeployInputError",
+            message: "No store targets. Provide at least one of chromeZip, firefoxZip, or edgeZip."
+        }
+    });
+    const version = pinnedDeployVersion();
+    const argv = [
+        "--yes",
+        `@extension.dev/deploy@${version}`,
+        ...buildDeployArgs(args)
+    ];
+    return new Promise((resolve)=>{
+        const child = cross_spawn("npx", argv, {
+            cwd: args.projectPath,
+            stdio: [
+                "ignore",
+                "pipe",
+                "pipe"
+            ],
+            env: {
+                ...process.env,
+                FORCE_COLOR: "0",
+                NO_COLOR: "1"
+            }
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (d)=>stdout += d.toString());
+        child.stderr?.on("data", (d)=>stderr += d.toString());
+        child.on("close", (code)=>{
+            resolve(JSON.stringify({
+                ok: 0 === code,
+                dryRun: false !== args.dryRun,
+                code,
+                stdout: stdout.trim(),
+                stderr: stderr.trim()
+            }));
+        });
+        child.on("error", (err)=>{
+            resolve(JSON.stringify({
+                ok: false,
+                error: {
+                    name: "DeploySpawnError",
+                    message: `Could not run extension-deploy: ${err instanceof Error ? err.message : String(err)}`
+                }
+            }));
+        });
+    });
+}
 const wait_schema = {
     name: "extension_wait",
     description: "Wait for a running dev or start session to be ready. Polls the ready.json contract file and returns structured status.",
@@ -3225,6 +3610,78 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
+async function startDeviceCode(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/json"
+        },
+        body: JSON.stringify({
+            client_id: args.clientId,
+            scope: args.scope || "read:user"
+        })
+    });
+    const data = await res.json().catch(()=>({}));
+    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
+    return {
+        deviceCode: String(data.device_code || ""),
+        userCode: String(data.user_code || ""),
+        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
+        interval: Number(data.interval || 5),
+        expiresIn: Number(data.expires_in || 900)
+    };
+}
+async function pollForToken(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const sleep = args.sleepImpl ?? defaultSleep;
+    let intervalMs = 1000 * Math.max(1, args.interval);
+    const deadline = Date.now() + Math.max(0, args.budgetMs);
+    while(Date.now() < deadline){
+        await sleep(intervalMs);
+        const res = await doFetch(GITHUB_TOKEN_URL, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json"
+            },
+            body: JSON.stringify({
+                client_id: args.clientId,
+                device_code: args.deviceCode,
+                grant_type: DEVICE_GRANT_TYPE
+            })
+        });
+        const data = await res.json().catch(()=>({}));
+        const token = String(data.access_token || "").trim();
+        if (token) return {
+            ok: true,
+            githubToken: token
+        };
+        const error = String(data.error || "");
+        if ("authorization_pending" === error) continue;
+        if ("slow_down" === error) {
+            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
+            continue;
+        }
+        if ("expired_token" === error) return {
+            ok: false,
+            reason: "expired"
+        };
+        if ("access_denied" === error) return {
+            ok: false,
+            reason: "denied"
+        };
+    }
+    return {
+        ok: false,
+        reason: "pending"
+    };
+}
 const login_schema = {
     name: "extension_login",
     description: "Authenticate to extension.dev via GitHub device-code and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
@@ -4006,8 +4463,9 @@ const tools = [
     reload_namespaceObject,
     open_namespaceObject,
     dom_inspect_namespaceObject,
-    publish_namespaceObject,
+    tools_publish_namespaceObject,
     release_promote_namespaceObject,
+    deploy_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,
     login_namespaceObject,

package/dist/src/lib/credentials.d.ts

@@ -0,0 +1,24 @@
+export interface StoredCredentials {
+    version: 1;
+    /** The HMAC access token the publish path sends as `Bearer`. */
+    token: string;
+    workspaceSlug: string;
+    projectSlug: string;
+    /** Token expiry as unix epoch seconds (0 if unknown). */
+    expiresAt: number;
+    /** Platform base URL the token was minted against. */
+    api: string;
+}
+export declare function credentialsPath(): string;
+export declare function readCredentials(): StoredCredentials | null;
+export declare function writeCredentials(creds: StoredCredentials): string;
+export declare function clearCredentials(): {
+    cleared: boolean;
+    path: string;
+};
+/**
+ * Return stored credentials only if the token has not expired. Used by the
+ * publish token resolution so an expired local token falls through cleanly to
+ * "no token" instead of producing a 401 from the platform.
+ */
+export declare function readValidCredentials(nowSeconds?: number): StoredCredentials | null;

package/dist/src/lib/github-device.d.ts

@@ -0,0 +1,40 @@
+export interface DeviceCodeStart {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    /** Minimum seconds to wait between polls. */
+    interval: number;
+    /** Seconds until the device code expires. */
+    expiresIn: number;
+}
+export type PollResult = {
+    ok: true;
+    githubToken: string;
+} | {
+    ok: false;
+    reason: "pending" | "expired" | "denied";
+    error?: string;
+};
+type FetchImpl = typeof fetch;
+type SleepImpl = (ms: number) => Promise<void>;
+export declare function startDeviceCode(args: {
+    clientId: string;
+    scope?: string;
+    fetchImpl?: FetchImpl;
+}): Promise<DeviceCodeStart>;
+/**
+ * Poll for the access token until the budget elapses. A budget shorter than
+ * the device-code lifetime lets a caller (e.g. an MCP tool that must return
+ * promptly) poll in bounded slices and report "pending" between calls; a long
+ * budget (a blocking CLI) waits the whole time. Returns `pending` only on
+ * budget exhaustion; `expired`/`denied` are terminal.
+ */
+export declare function pollForToken(args: {
+    clientId: string;
+    deviceCode: string;
+    interval: number;
+    budgetMs: number;
+    fetchImpl?: FetchImpl;
+    sleepImpl?: SleepImpl;
+}): Promise<PollResult>;
+export {};

package/dist/src/lib/login-flow.d.ts

@@ -0,0 +1,40 @@
+import { type StoredCredentials } from "./credentials";
+type FetchImpl = typeof fetch;
+export declare function resolveApiBase(api?: string): string;
+/**
+ * Validate the platform base URL BEFORE we attach a bearer token to a request to
+ * it. SECURITY: the `api` arg / EXTENSION_DEV_API_URL is operator-supplied, but a
+ * hostile value (e.g. via prompt-injection in the client) could redirect the
+ * token to an attacker. The access token must never leave over plaintext or go to
+ * an arbitrary scheme, so we require https -- allowing http only for localhost
+ * dev. Returns the normalized base (no trailing slash) or an error message.
+ */
+export declare function safeApiBase(raw: string): {
+    ok: true;
+    base: string;
+} | {
+    ok: false;
+    message: string;
+};
+export interface LoginConfig {
+    clientId: string;
+    scope: string;
+}
+/**
+ * Resolve the GitHub OAuth client id the device flow authenticates against.
+ * EXTENSION_DEV_GITHUB_CLIENT_ID overrides (useful when pointing at a self-
+ * hosted platform); otherwise it comes from the platform's public config.
+ */
+export declare function fetchLoginConfig(apiBase: string, fetchImpl?: FetchImpl): Promise<LoginConfig>;
+/**
+ * Trade a verified GitHub user token for a project-scoped access token and
+ * write it to the local credentials file. Returns the stored credentials
+ * (token included for the caller's in-memory use; never logged).
+ */
+export declare function exchangeAndPersist(args: {
+    apiBase: string;
+    githubToken: string;
+    project: string;
+    fetchImpl?: FetchImpl;
+}): Promise<StoredCredentials>;
+export {};

package/dist/src/lib/publish.d.ts

@@ -0,0 +1,31 @@
+type FetchImpl = typeof fetch;
+/** Resolve the access token: EXTENSION_DEV_TOKEN env first, then the login creds file. */
+export declare function resolveToken(): string;
+export interface PublishOptions {
+    /** Share-link lifetime in hours (1-168, platform default 24). */
+    ttlHours?: number;
+    /** Pin the share URL to a specific build sha. */
+    buildSha?: string;
+    /** Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL). */
+    api?: string;
+    /** Explicit token; defaults to resolveToken(). */
+    token?: string;
+    fetchImpl?: FetchImpl;
+}
+export type PublishResult = {
+    ok: true;
+    data: Record<string, unknown>;
+} | {
+    ok: false;
+    error: {
+        name: string;
+        message: string;
+    };
+};
+/**
+ * Publish the project the token is scoped to and return the platform
+ * response (shareUrl, visibility, ...). The publish target is identified by
+ * the token's claims (workspaceSlug/projectSlug), so no project path is sent.
+ */
+export declare function publish(options?: PublishOptions): Promise<PublishResult>;
+export {};

package/dist/src/tools/deploy.d.ts

@@ -0,0 +1,104 @@
+export interface DeployToolArgs {
+    projectPath: string;
+    chromeZip?: string;
+    chromeExtensionId?: string;
+    chromePublisherId?: string;
+    firefoxZip?: string;
+    firefoxSourcesZip?: string;
+    firefoxExtensionId?: string;
+    firefoxChannel?: "listed" | "unlisted";
+    edgeZip?: string;
+    edgeProductId?: string;
+    dryRun?: boolean;
+    stagedPublish?: boolean;
+    chromeDeployPercentage?: number;
+    chromeSkipSubmitReview?: boolean;
+    edgeSkipSubmitReview?: boolean;
+    outputJson?: string;
+}
+/**
+ * Build the extension-deploy argv from tool arguments. Pure and exported so the
+ * flag mapping is unit-tested without spawning a process. Never emits a
+ * credential flag - secrets come from the environment / .env.submit.
+ */
+export declare function buildDeployArgs(args: DeployToolArgs): string[];
+export declare const schema: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            projectPath: {
+                type: string;
+                description: string;
+            };
+            chromeZip: {
+                type: string;
+                description: string;
+            };
+            chromeExtensionId: {
+                type: string;
+                description: string;
+            };
+            chromePublisherId: {
+                type: string;
+                description: string;
+            };
+            firefoxZip: {
+                type: string;
+                description: string;
+            };
+            firefoxSourcesZip: {
+                type: string;
+                description: string;
+            };
+            firefoxExtensionId: {
+                type: string;
+                description: string;
+            };
+            firefoxChannel: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            edgeZip: {
+                type: string;
+                description: string;
+            };
+            edgeProductId: {
+                type: string;
+                description: string;
+            };
+            dryRun: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            stagedPublish: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            chromeDeployPercentage: {
+                type: string;
+                description: string;
+            };
+            chromeSkipSubmitReview: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            edgeSkipSubmitReview: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            outputJson: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export declare function handler(args: DeployToolArgs): Promise<string>;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "4.4.0",
-  "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 30 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
+  "version": "4.6.0",
+  "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 31 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "MIT",
   "author": {
@@ -84,7 +84,6 @@
     "extension.js"
   ],
   "dependencies": {
-    "@extension.dev/core": "^0.2.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "browser-extension-manifest-fields": "^2.2.9",
     "cross-spawn": "^7.0.6",

package/server.json

@@ -1,19 +1,19 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
   "name": "io.github.extensiondev/mcp",
-  "description": "Build, run, inspect, and publish browser extensions from any MCP client. 30 tools, 11 browsers.",
+  "description": "Build, run, inspect, and publish browser extensions from any MCP client. 31 tools, 11 browsers.",
   "repository": {
     "url": "https://github.com/extensiondev/mcp",
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "4.4.0",
+  "version": "4.6.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "4.4.0",
+      "version": "4.6.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"