@extension.dev/mcp 4.6.0 → 4.7.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "4.6.0",
+      "version": "4.7.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "4.6.0",
+  "version": "4.7.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "boss@cezaraugusto.net",

package/CHANGELOG.md

@@ -1,10 +1,24 @@
 # Changelog
 
+## 4.7.0
+
+`extension_deploy` now submits **through** extension.dev instead of driving a
+local CLI. Pass `browsers` + `buildSha` and the submission is routed to the
+platform, which holds your store credentials and dispatches the release from
+your project's mirror CI; authentication is your `extension_login` session or a
+release token in `EXTENSION_DEV_TOKEN`, and it defaults to a dry run. The tool
+is now a thin authenticated client of the platform's store-submission endpoint,
+exactly like `extension_publish` and `extension_release_promote`, with no
+external CLI dependency. This replaces the previous mode that shelled out to a
+standalone local CLI. Direct zip-based submission with store credentials in the
+environment is no longer exposed through the MCP; use your own CI pipeline for
+that.
+
 ## 4.6.0
 
 New `extension_deploy` tool (31 tools total): submit a built extension to the
-Chrome Web Store, Firefox AMO, and Edge Add-ons by driving the standalone
-`@extension.dev/deploy` CLI. Store targets are inferred from the `.zip` paths
+Chrome Web Store, Firefox AMO, and Edge Add-ons by driving a standalone
+deploy CLI. Store targets are inferred from the `.zip` paths
 you pass. It defaults to a dry run, and store credentials are read from the
 environment or a `.env.submit` file, never from tool arguments, so secrets
 never enter the agent transcript.

package/README.md

@@ -121,20 +121,20 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | platform | `extension_logout` | Remove stored credentials |
 | platform | `extension_publish` | Publish a shareable preview to extension.dev |
 | platform | `extension_release_promote` | Promote a build to a release channel, headless |
-| platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores (wraps `@extension.dev/deploy`) |
+| platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores through extension.dev |
 
 Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI — the project's own `node_modules/.bin/extension` when present, otherwise `npx extension@<pinned>` at the version this package is verified against; everything else runs in-process.
 
 ## From preview to store
 
-The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits the built `.zip` to the Chrome Web Store, Edge Add-ons, and Firefox AMO by driving the standalone [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) CLI — it defaults to a dry run and reads store credentials from the environment or a `.env.submit` file, never from tool arguments.
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI — it defaults to a dry run and store credentials are never tool arguments.
 
 ## The extension.dev stack
 
 | Package | Use it to |
 | --- | --- |
 | [`@extension.dev/skill`](https://www.npmjs.com/package/@extension.dev/skill) | Teach AI agents the judgment half: cross-browser rules, gotchas, playbooks |
-| [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) | Ship to Chrome, Firefox, and Edge stores from CI |
+| [`@extension.dev/artifact-integrity`](https://www.npmjs.com/package/@extension.dev/artifact-integrity) | Verify extension artifacts and gate CI on tampered bytes before they ship |
 
 All of it rides on [Extension.js](https://github.com/extension-js/extension.js), the open-source cross-browser extension framework.