:3 Extensions documentation

Query Chrome, Edge, and Firefox extension analysis from one index.

Quick start

Searches combine a field and value. Use and, or, and parentheses to build larger expressions.

platform:chrome and host:*.example.com
platform:firefox and (api:tabs or api:webRequest)
domain:example.com and route:*oauth*
has:warning and warnings:>=3
platform:firefox and users:>=100000
name:"password manager" and ext:wasm

Syntax

Form	Use
`field:value`	Match a specific indexed field.
`term one`	Adjacent terms are joined with `and`.
`a or b`	Match either side. `and` takes precedence.
`(a or b) and c`	Use parentheses to control grouping.
`*`	Wildcard within names, IDs, hosts, paths, and text fields.
`"two words"`	Keep a value containing spaces together.
`> >= = != <= <`	Compare numeric count fields.

host:api.example.com is exact. host:*.example.com matches subdomains. domain:example.com matches the domain and its subdomains.

Search fields

Extension

Field	Matches	Example
`platform`, `store`	Chrome, Edge, or Firefox.	`platform:edge`
`id`	Store extension ID or Firefox slug.	`id:abc*`
`name`	Manifest display name.	`name:wallet`
`status`	Crawler status.	`status:succeeded`
Bare text	ID or manifest name.	`ad blocker`

Network

Field	Matches	Example
`host`	Discovered hostname.	`host:api.example.com`
`domain`	Domain and all subdomains.	`domain:example.com`
`route`	Discovered HTTP path.	`route:graphql`
`routehost`	Hostname with discovered routes.	`routehost:api.example.com`
`websocket`, `ws`	WebSocket URL or hostname.	`ws:socket.example.com`

Permissions and package contents

Field	Matches	Example
`perm`, `permission`	Any manifest permission.	`perm:cookies`
`api`	API permission.	`api:webRequest`
`hostperm`	Required or optional host permission.	`hostperm::///*`
`file`, `path`	Packaged file path.	`file:*background.js`
`ext`	Packaged file extension.	`ext:wasm`
`warningtext`	Generated warning text.	`warningtext:proxy`
`resource`	Exposed or externally connectable resource.	`resource:all_urls`
`content`	Content-script match pattern.	`content::///*`

Counts and presence

Field	Matches	Example
`warnings`	Warning count.	`warnings:>=2`
`hosts`, `hostcount`	Unique hostname count.	`hosts:>100`
`urls`, `url`	Discovered URL count.	`urls:>=500`
`files`, `filecount`	Packaged file count.	`files:<20`
`users`, `installs`, `installcount`	Store user count.	`users:>=1000000`
`has`	`warning`, `host`, `url`, `users`, or `report`.	`has:warning`

Reports

Direct reports include the latest stored user count alongside manifest metadata, permissions, content scripts, resources, CSP, hosts and routes, WebSockets, packaged files, and warnings.

Limits

Operation	Allowance	Window
Search	250	Rolling hour
Direct report	250	Rolling hour
Archive download	25	UTC day

Limits apply to both the account and its current IP address. Search and direct-report allowances are separate.