:3 Extensions documentation

Query Chrome, Edge, and Firefox extension analysis from one index.

Quick start

Searches combine a field and value. Use and, or, and parentheses to build larger expressions.

platform:chrome and host:*.example.com
platform:firefox and (api:tabs or api:webRequest)
domain:example.com and route:*oauth*
has:warning and warnings:>=3
platform:firefox and users:>=100000
name:"password manager" and ext:wasm

Source code

Source search covers text files from the latest indexed package. Adjacent terms are joined with AND; use | for OR and - to exclude a term. Search for phrases, identifiers, domains, API calls, or other code and optionally narrow by platform or path.

"chrome.webRequest" onBeforeRequest
eval | Function
api.example.com
Path: *background*.js

Open a result to view syntax-highlighted source with line numbers, or browse an extension by ID. Links to a matched line are preserved in the address bar. Package trees are paginated for extensions containing thousands of files. Individual text files are indexed up to 16 MiB.

Syntax

Form	Use
`field:value`	Match a specific indexed field.
`term one`	Adjacent terms are joined with `and`.
`a or b`	Match either side. `and` takes precedence.
`(a or b) and c`	Use parentheses to control grouping.
`*`	Wildcard within names, IDs, hosts, paths, and text fields.
`"two words"`	Keep a value containing spaces together.
`> >= = != <= <`	Compare numeric count fields.

host:api.example.com is exact. host:*.example.com matches subdomains. domain:example.com matches the domain and its subdomains.

Search fields

Extension

Field	Matches	Example
`platform`, `store`	Chrome, Edge, or Firefox.	`platform:edge`
`id`	Store extension ID or Firefox slug.	`id:abc*`
`name`	Manifest display name.	`name:wallet`
`status`	Crawler status.	`status:succeeded`
Bare text	ID or manifest name.	`ad blocker`

Network

Field	Matches	Example
`host`	Discovered hostname.	`host:api.example.com`
`domain`	Domain and all subdomains.	`domain:example.com`
`route`	Discovered HTTP path.	`route:graphql`
`routehost`	Hostname with discovered routes.	`routehost:api.example.com`
`websocket`, `ws`	WebSocket URL or hostname.	`ws:socket.example.com`

Permissions and package contents

Field	Matches	Example
`perm`, `permission`	Any manifest permission.	`perm:cookies`
`api`	API permission.	`api:webRequest`
`hostperm`	Required or optional host permission.	`hostperm::///*`
`file`, `path`	Packaged file path.	`file:*background.js`
`ext`	Packaged file extension.	`ext:wasm`
`warningtext`	Generated warning text.	`warningtext:proxy`
`resource`	Exposed or externally connectable resource.	`resource:all_urls`
`content`	Content-script match pattern.	`content::///*`

Counts and presence

Field	Matches	Example
`warnings`	Warning count.	`warnings:>=2`
`hosts`, `hostcount`	Unique hostname count.	`hosts:>100`
`urls`, `url`	Discovered URL count.	`urls:>=500`
`files`, `filecount`	Packaged file count.	`files:<20`
`users`, `installs`, `installcount`	Store user count.	`users:>=1000000`
`has`	`warning`, `host`, `url`, `users`, or `report`.	`has:warning`

Reports

Reports include the latest stored user count alongside manifest metadata, permissions, content scripts, resources, CSP, hosts and routes, WebSockets, packaged files, and warnings. Opening a report from search also lists matching source files; selecting one opens the file at the first matching line.

MCP

The authenticated MCP server exposes the extension index and source browser as read-only tools. Agents can call get_platform_documentation for the complete Markdown reference without consuming query quota. The MCP setup guide covers token creation and current configuration for Claude Code, Codex, and other Streamable HTTP clients.

Limits

Operation	Allowance	Window
Search	250	Rolling hour
Source search	Shared with Search	Rolling hour
Direct report	250	Rolling hour
Archive download	25	UTC day
MCP	Shared with the corresponding operation	Same window

Limits apply to both the account and its current IP address. Package browsing uses the direct-report allowance.

The configured administrator has unlimited search, report, source-browsing, and archive allowances, including MCP usage. Administrator requests do not consume shared-IP allowances. Request-size limits, security checks, and service throttling still apply.