@extension.dev/mcp 6.6.0 → 7.0.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "6.6.0",
+      "version": "7.0.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "6.6.0",
+  "version": "7.0.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",
@@ -9,7 +9,7 @@
   },
   "homepage": "https://github.com/extensiondev/mcp",
   "repository": "https://github.com/extensiondev/mcp",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "keywords": [
     "mcp",
     "browser-extension",

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 7.0.0
+
+`preview.extension.dev` is the only web door this package knows about. The
+inspect door predates it and had stopped being reachable.
+
+### Removed
+
+- **`extension_preview_web` no longer takes `surface` or `inspectUrl`.**
+  `surface:"inspect"` pointed a local build at `inspect.extension.dev` over the
+  `inspect://path` scheme, which is what the tool did before
+  `preview.extension.dev` existed. Only the inspect dev server ever answered it:
+  the deployed origin serves store listings and has no `/__inspect/fetch`, so
+  the door resolved on one machine and nowhere else. Every build now renders in
+  `preview.extension.dev`, which is also the surface that carries the
+  Emulated/Real lane toggle and the Trace tab. The response no longer carries a
+  `surface` field, and `hostUrl` is the only origin override.
+- **The carrier no longer allowlists `inspect.extension.dev`.** Pairing needs a
+  page that opens the bridge, and inspect never did: it traces the emulated lane
+  of the extension it fetched and has no lane toggle. `extension_dev`
+  `carrier: true` and the pairing notes now point at `preview.extension.dev`,
+  and the carrier's `externally_connectable` drops the origin that was never
+  going to connect.
+- **`extension_login` no longer falls back to the GitHub device flow.**
+  extension.dev hosts the device flow itself and federates GitHub server-side, so
+  the only authorization surface is `extension.dev/device` and no GitHub token
+  ever lands on the caller's machine. The legacy path is gone entirely: the
+  GitHub device-code client, the `provider` fork (which existed twice, once in the
+  tool and once in the `extension-mcp login` bin), the
+  `/api/cli/login/exchange` hop, and the `EXTENSION_DEV_GITHUB_CLIENT_ID`
+  override. Stored credentials record `provider: "extensiondev"` and
+  `extension_whoami` reports that instead of defaulting to `"github"`. Nothing
+  changes for a caller who was already on the branded flow, which is every caller
+  the platform has served since it went live; a self-hosted platform pinned to
+  the old exchange endpoint is no longer supported.
+
 ## 6.6.0
 
 A shared build belongs to the project that owns it, not to whoever happened to

package/README.md

@@ -5,11 +5,9 @@
 [discord-image]: https://img.shields.io/discord/1253608412890271755?label=Discord&logo=discord&style=flat&color=26FFB8
 [discord-url]: https://discord.gg/v9h2RgeTSN
 
-<img alt="@extension.dev/mcp" src="https://media.extension.land/brand/repos/mcp/github-banner.png" />
-
 # @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-> Give your AI agent hands for browser extension development. 35 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
+> Give your AI agent hands for browser extension development. 36 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
 <img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="20.7%" />
 
@@ -129,14 +127,16 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | browsers | `extension_uninstall_browser` | Remove a managed browser binary |
 | browsers | `extension_list_browsers` | List managed browsers |
 | browsers | `extension_detect_browsers` | Detect system browsers |
-| platform | `extension_login` | GitHub device-code login, stored token |
+| platform | `extension_login` | Device login at extension.dev, stored token |
 | platform | `extension_whoami` | Show the stored login (never the token) |
 | platform | `extension_logout` | Remove stored credentials |
 | platform | `extension_preview_web` | Render a build in the web emulator, and share it as a link |
 | platform | `extension_shares` | List every link you have shared, and revoke one permanently |
 | platform | `extension_publish` | Publish a shareable preview to extension.dev |
 | platform | `extension_release_promote` | Promote a build to a release channel, headless |
+| platform | `extension_release_list` | List release channels and recent builds, to pick a valid build sha |
 | platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores through extension.dev |
+| platform | `extension_store_status` | Read a submission's outcome, credential health, and review state |
 
 Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI, the project's own `node_modules/.bin/extension` when present, otherwise `npx extension@<pinned>` at the version this package is verified against; everything else runs in-process.
 
@@ -150,7 +150,7 @@ That is a different job from shipping. Use `share` for the build you are holding
 
 ## From preview to store
 
-The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build your project has already published into a shareable URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs extension.dev's own device flow (you approve the code at [extension.dev/device](https://extension.dev/device), and GitHub is federated server-side, so no GitHub token ever reaches your machine) and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build your project has already published into a shareable URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
 
 ## The extension.dev stack