ExtensionDash
io.github.tonic20/extensions-dashboardtonic20streamable-httpv1.0.0Scanned
Research extension listings and search results; track installs, keyword rankings, and competitors.
14 tools: 4 can delete or cancel things and 10 only read.
- Reads private data · 0
- Reads text others write · 5
- Can send data out · 0
- No findings
Tools listed without sign-in. Remote posture
Anlyon alternative
4 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
14 tools
Deletes or cancels 4Claude Code: deny
add_competitorStart tracking a competitor for an extension.Reads text others writeNo findings
Why it is in this group
- The name "add_competitor" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start tracking a competitor for an extension. Takes the store and id of a search_catalog row (as external_id), so a listing you just found can be promoted without looking anything up in between. Promoting a listing is what earns it a store fetch: its description, install count, rating and languages start being recorded, and its position is kept even on days it falls out of the results entirely. Where it ranks has been recorded all along, from the searches this account already runs — so a competitor added today arrives with history rather than starting from zero. The description is not available when this returns. Call list_competitors with the same extension_id until this competitor's status turns from "pending" to "scraped". At most 5 competitors per store on the Free plan and 20 on Premium, because each costs a fetch of that store on every refresh. The two stores are counted separately. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
- title: Add competitor
add_keywordStart tracking a search term for an extension.Reads text others writeNo findings
Why it is in this group
- The name "add_keyword" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start tracking a search term for an extension. The term is added once per store the extension is listed in, and a rank fetch is enqueued for each store that was not already tracking it. The position is not available when this returns. Call list_keywords with the same extension_id until this term's status turns from "pending" to "scanned", or list_scrape_runs to watch the fetch itself — a fetch that fails shows up there, rather than as a position that never arrives. A term is tracked per store language. Tracking "ad blocker" in en and again in de gives two independent keywords with their own positions. Call list_keywords for the languages an extension already tracks. An extension tracks at most 10 keywords on the Free plan and 50 on Premium, counted per language: "ad blocker" in en and de is two. Past that this returns a limit error and remove_keyword has to free a slot first. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
- title: Add keyword
remove_competitorStop tracking a competitor for an extension.No findings
Why it is in this group
- The name "remove_competitor" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Stop tracking a competitor for an extension. Stops the store fetches. The recorded history is kept, so adding the same competitor again later restores its charts rather than starting from zero — and its positions carry on being observed either way, because they come from searches this account already runs. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
- title: Remove competitor
remove_keywordStop tracking a search term for an extension, across every store it was tracked in.No findings
Why it is in this group
- The name "remove_keyword" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Stop tracking a search term for an extension, across every store it was tracked in. Positions already recorded are kept; only the tracking stops. Other extensions tracking the same term are unaffected, including ones that track the same store listing: every extension's keywords are its own. A term is tracked per store language. Tracking "ad blocker" in en and again in de gives two independent keywords with their own positions. Call list_keywords for the languages an extension already tracks. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
- title: Remove keyword
Only reads 10Show 10 read-only tools
get_extensionOne extension in full: every store listing's latest numbers plus its tracked keywords and their current positions.No findings
Why it is in this group
- The name "get_extension" says "get": a word for reading.
Description, as the server wrote it One extension in full: every store listing's latest numbers plus its tracked keywords and their current positions. locales lists every store language this extension tracks, with a keyword count each, so the keywords can be worked a language at a time. Use get_metrics_history or get_keyword_ranks for movement over time. This is the tracked view, built from what we have recorded. For an extension this account does not track, use get_listing instead. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get extension
get_keyword_ranksDaily search position history for an extension's tracked keywords, one series per term per store.No findings
Why it is in this group
- The name "get_keyword_ranks" says "get": a word for reading.
Description, as the server wrote it Daily search position history for an extension's tracked keywords, one series per term per store. Every point carries the depth it was scanned to, because a position only means something against the size of the pool it came from: #1 of 9 and #1 of 50 are different results. A null position means we searched that deep and this extension was not in the results. A term tracked in more than one store language comes back as one series per language — the same term is a different SERP in each. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get keyword ranks
get_keyword_serpThe search page for one of an extension's tracked keywords, as this account last recorded it — who was on it, in what order, and which way each of them moved over the past week.No findings
Why it is in this group
- The name "get_keyword_serp" says "get": a word for reading.
Description, as the server wrote it The search page for one of an extension's tracked keywords, as this account last recorded it — who was on it, in what order, and which way each of them moved over the past week. Read from recorded history, not from the store: no fetch, no waiting, no egress spent. Use this when you want movement, or the same page the dashboard is showing. Every row carries mine and competitor flags, so "who is above me and which of them am I already tracking" is one call. Positions always travel with depth_scanned, because #1 of 9 and #1 of 50 are different results. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get keyword serp
get_listingOne extension's full listing from the catalog -- any extension, tracked by this account or not: description, users, rating, reviews, version, languages, categories, permissions and…Reads text others writeNo findings
Why it is in this group
- The name "get_listing" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One extension's full listing from the catalog -- any extension, tracked by this account or not: description, users, rating, reviews, version, languages, categories, permissions and publisher. Pass the store and id of a search_catalog row as store and external_id. English copy, refreshed weekly from the store; refreshed_at says when. This never fetches, never answers "pending" and never starts tracking. users, rating and reviews are null when the store shows no number, which is not zero. For an extension this account tracks, get_metrics_history has its numbers over time. Shares search_catalog's 60 calls a minute per account. Works without an account too.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Get listing
get_metrics_historyDaily-or-sparser history of an extension's numbers: user count, rating and ratings count, each as a map of ISO date to value.No findings
Why it is in this group
- The name "get_metrics_history" says "get": a word for reading.
Description, as the server wrote it Daily-or-sparser history of an extension's numbers: user count, rating and ratings count, each as a map of ISO date to value. "listings" is this extension's own store listings; "competitors" is its roster from list_competitors. store and days filter both. A map holds only dates actually observed; an empty map means no measurement in range, never zero. If users_rounded_in_range is true the store published rounded counts somewhere in the window, so small movements there may be rounding. Competitors are captured every few days rather than daily, and not on a fixed schedule, so compare a rival against "listings" on dates present in both, never by position in the map. Join a competitor entry back to list_competitors on (store, external_id); name is a label, not an identifier. include_competitors adds every roster competitor's history. competitors narrows that to specific (store, external_id) pairs and implies include_competitors; a pair not on the roster fails the whole call rather than silently dropping it. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get metrics history
list_competitorsWho this extension competes with, measured across every keyword it tracks.No findings
Why it is in this group
- The name "list_competitors" says "list": a word for reading.
Description, as the server wrote it Who this extension competes with, measured across every keyword it tracks. Two sets. "competitors" is the roster you promoted with add_competitor: their descriptions, install counts and ratings are recorded, and their positions are kept even on days they fall out of the results. "candidates" — returned only with include_observed — is everyone else who has appeared in those searches, ranked by how often they beat you. Both are read from positions this account already recorded, not from the store: no fetch, no waiting, and each row carries the evidence behind it (how many of your terms, average position, first seen). This is the tool for deciding who is worth promoting. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List competitors
list_extensionsEvery extension this token's owner tracks, with each store listing's latest numbers: user count (and whether the store rounded it), the 7-day change, rating, ratings count and cate…No findings
Why it is in this group
- The name "list_extensions" says "list": a word for reading.
Description, as the server wrote it Every extension this token's owner tracks, with each store listing's latest numbers: user count (and whether the store rounded it), the 7-day change, rating, ratings count and category rank. Start here when this connection has an account: every tracking tool takes an extension_id from this list. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List extensions
list_keywordsEvery search term tracked for one extension, one row per term per store.No findings
Why it is in this group
- The name "list_keywords" says "list": a word for reading.
Description, as the server wrote it Every search term tracked for one extension, one row per term per store. status is "pending" until a fetch has landed since the term was tracked, and "scanned" once one has. A "scanned" row with a null position means we searched depth_scanned results and this extension was not among them — that is a real observation, not missing data. A "pending" row can still carry a position. Removing a keyword stops the tracking but keeps the history, so a term tracked before and added again arrives with its previous result already in place; captured_on says how old that is. Poll until the status reads "scanned" to know the number answers the current tracking. locale is the store language the term was searched in. The same term ranks differently under hl=de than under hl=en, so two rows sharing a term and a store are two different results. locales lists every store language this extension tracks, with a keyword count each — start there to work a language at a time. It always reports every language, including when the locale argument narrows the rows to one. search_volume is Google Ads' average monthly searches for the term in the row's store language: for English, in the United States or worldwide as the account's profile setting says (United States unless changed), and in one country for the others (Germany for de, Spain for es, Brazil for pt-BR, and so on). It is web search demand, not searches inside the store, and is the same for both stores. null means not fetched yet, Google has no data, or the term can't be looked up (symbols such as + or %, over 80 characters or 10 words, or a store language Google Ads has no country for, such as ru); search_volume_fetched_at says which. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List keywords
list_scrape_runsRecent scrape attempts against your own extensions, newest first, with their outcome and any error.Reads text others writeNo findings
Why it is in this group
- The name "list_scrape_runs" says "list": a word for reading.
What it can reach
- untrusted-inputThe name "list_scrape_runs" says "scrape": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "scrape": it reads web pages, which anyone can write.
Description, as the server wrote it Recent scrape attempts against your own extensions, newest first, with their outcome and any error. Covers both the listing fetches and the rank fetches for the search terms they track. Use this after add_keyword to watch the rank fetch: the run is targeted at the search term, and a failed fetch appears here as a failure rather than as a position that never arrives. Needs an ExtensionDash account: sign in from your app, e.g. `claude mcp login extensions-dashboard` or `codex mcp login extensions-dashboard`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List scrape runs
search_catalogSearch one store's catalog of extensions fetched so far, for market and niche research: store "chrome" (default) or "firefox", one per call -- Chrome users are a rounded weekly cou…Reads text others writeNo findings
Why it is in this group
- The name "search_catalog" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search one store's catalog of extensions fetched so far, for market and niche research: store "chrome" (default) or "firefox", one per call -- Chrome users are a rounded weekly count, Firefox's an exact daily average, so the two are never mixed. listed and known in each answer show how much of that store the catalog covers. Filter by name words (match "all" or "any"; case and punctuation are ignored, and an exact name comes first unless you sort), by one category of that store (a slug such as "productivity/developer" or "privacy-security"; an unknown one is refused with the store's list) and by inclusive ranges on users, rating, reviews, language count and description length; sort by any of those or by last update. This never fetches the store. users, rating and reviews are null when the store shows no number, which is not zero. Each row says whether it is one of yours or a competitor you track; pass its store and id to add_competitor to start tracking it. For one extension's full listing, call get_listing. Allows 60 calls a minute per account. Works without an account too.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Search catalog
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write5
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 15:06 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 4
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- not observed
- RFC 9728 protected resource metadata
- https://extensiondash.com/.well-known/oauth-protected-resource/mcp
- Authorization servers
- https://extensiondash.com
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- yes
- Client ID metadata documents
- no
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 4 tools that change things (4 destructive). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://extensiondash.com/mcp: tools/list returned 14 tools to an anonymous client, including add_keyword (destructive), remove_keyword (destructive), add_competitor (destructive), remove_competitor (destructive)
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http extensions-dashboard https://extensiondash.com/mcpclaude mcp add --transport http extensions-dashboard https://extensiondash.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__extensions-dashboard__list_extensions",
"mcp__extensions-dashboard__get_extension",
"mcp__extensions-dashboard__get_metrics_history",
"mcp__extensions-dashboard__list_keywords",
"mcp__extensions-dashboard__get_keyword_ranks",
"mcp__extensions-dashboard__list_competitors",
"mcp__extensions-dashboard__get_keyword_serp",
"mcp__extensions-dashboard__list_scrape_runs",
"mcp__extensions-dashboard__search_catalog",
"mcp__extensions-dashboard__get_listing"
],
"ask": [],
"deny": [
"mcp__extensions-dashboard__add_keyword",
"mcp__extensions-dashboard__remove_keyword",
"mcp__extensions-dashboard__add_competitor",
"mcp__extensions-dashboard__remove_competitor"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as extensions-dashboard. Review it before you use it.
Capability tags behind 5 rules
- mcp__extensions-dashboard__add_keyword untrusted-input
- mcp__extensions-dashboard__add_competitor untrusted-input
- mcp__extensions-dashboard__list_scrape_runs untrusted-input
- mcp__extensions-dashboard__search_catalog untrusted-input
- mcp__extensions-dashboard__get_listing untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.github.tonic20/extensions-dashboard/verify?hash=d7270f94c9e2bc10503dae2847747b20433182fe7ebb15a12140b833151e1b19" | jq -e '.changed == false'Pinned hash d7270f94c9e2, from Oct 21, 2026, 19:31 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.github.tonic20/extensions-dashboard/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.github.tonic20/extensions-dashboard)Source: MCP Registry. Synced Oct 21, 2026, 18:50 UTC.