one.
by zovo.one · remote · no sign-in to list tools · v1.0.0 · published by one.zovo
Score the privilege a Chrome MV3 extension takes from its manifest, and diff permission sets.
3 tools: 3 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things0Claude Code: ask
- Only reads3Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http crx-permission-risk https://crx-permission-risk-mcp.lipmichal.workers.dev/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
3 tools
Only reads 3Claude Code: allow
analyze_manifestStatic privilege analysis of a Chrome MV3 manifest.json.No findings
Why it is in this group
- The name "analyze_manifest" says "analyze": a word for reading.
Description, as the server wrote it Static privilege analysis of a Chrome MV3 manifest.json. Returns a 0-100 risk score, the permissions and host patterns that drive it, dangerous permission combinations, and MV3 policy problems (remote code, unsafe-eval, <all_urls> web_accessible_resources). Content-script matches are counted as host access even when host_permissions is empty.
compare_permission_setsCompares the permissions and host patterns of two versions of an extension.No findings
Why it is in this group
- The name "compare_permission_sets" says "compare": a word for reading.
Description, as the server wrote it Compares the permissions and host patterns of two versions of an extension. Reports the score delta, what was added or removed, and whether the change widens the install-time warning set, which makes Chrome disable the extension for existing users until they re-accept.
explain_permissionReturns the privilege weight (0-10) for a single Chrome extension permission or host pattern, what it actually grants, whether it triggers an install-time warning, and the narrower…No findings
Why it is in this group
- The name "explain_permission" says "explain": a word for reading.
Description, as the server wrote it Returns the privilege weight (0-10) for a single Chrome extension permission or host pattern, what it actually grants, whether it triggers an install-time warning, and the narrower alternative if one exists.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http crx-permission-risk https://crx-permission-risk-mcp.lipmichal.workers.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__crx-permission-risk__analyze_manifest",
"mcp__crx-permission-risk__explain_permission",
"mcp__crx-permission-risk__compare_permission_sets"
],
"ask": [],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as crx-permission-risk. Review it before you use it.