Cws Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Cws Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Chrome Web Store extension management. Upload, publish, and manage Chrome extensions directly from Claude Code or any MCP client.
Use this MCP when you need to:
upload tool to push it as a draftpublish to submit for review and go livestatus to see review state, version, and deploy percentageupdate-metadata-ui to change store listing detailscancel to withdraw a submission under reviewpublish with staged rollout, then deploy-percentage to ramp up| Tool | Description |
|---|---|
upload | Upload a ZIP file to Chrome Web Store (update existing item draft) |
publish | Publish an extension with optional staged rollout, publish type, and skip-review |
status | Fetch the current status including review state, deploy percentage, and version |
cancel | Cancel a pending submission |
deploy-percentage | Set staged rollout percentage (0-100, must exceed current target) |
get | Read draft/published listing metadata (v1.1 API, deprecated Oct 2026) |
update-metadata | Update listing metadata via v1.1 API (deprecated Oct 2026) |
update-metadata-ui | Update listing metadata via dashboard UI automation (Playwright) |
This MCP server covers all Chrome Web Store API v2 endpoints:
| v2 Endpoint | MCP Tool |
|---|---|
media.upload | upload |
publishers.items.publish | publish |
publishers.items.fetchStatus | status |
publishers.items.cancelSubmission | cancel |
publishers.items.setPublishedDeployPercentage | deploy-percentage |
Additionally, v1.1 API endpoints are available for metadata operations (get, update-metadata), with dashboard UI automation (update-metadata-ui) as the recommended alternative since v1 is deprecated.
# Open in browser to get authorization code
open "https://accounts.google.com/o/oauth2/auth?response_type=code&scope=https://www.googleapis.com/auth/chromewebstore&client_id=YOUR_CLIENT_ID&redirect_uri=urn:ietf:wg:oauth:2.0:oob"
# Exchange code for refresh token
curl -X POST https://oauth2.googleapis.com/token \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "code=YOUR_AUTH_CODE" \
-d "grant_type=authorization_code" \
-d "redirect_uri=urn:ietf:wg:oauth:2.0:oob"Add to your Claude Code MCP settings (~/.claude/settings.local.json):
{
"mcpServers": {
"cws-mcp": {
"command": "node",
"args": ["/path/to/cws-mcp/dist/index.js"],
"env": {
"CWS_CLIENT_ID": "xxxxx.apps.googleusercontent.com",
"CWS_CLIENT_SECRET": "GOCSPX-xxxxx",
"CWS_REFRESH_TOKEN": "1//xxxxx",
"CWS_PUBLISHER_ID": "me",
"CWS_ITEM_ID": "your-extension-id"
}
}
}
}Or install globally via npm:
{
"mcpServers": {
"cws-mcp": {
"command": "npx",
"args": ["-y", "cws-mcp"],
"env": { ... }
}
}
}| Variable | Required | Description |
|---|---|---|
CWS_CLIENT_ID | Yes | Google OAuth2 Client ID |
CWS_CLIENT_SECRET | Yes | Google OAuth2 Client Secret |
CWS_REFRESH_TOKEN | Yes | OAuth2 Refresh Token |
CWS_PUBLISHER_ID | No | Publisher ID (default: me) |
CWS_ITEM_ID | No | Default extension item ID |
CWS_DASHBOARD_PROFILE_DIR | No | Browser profile path for UI automation (default: ~/.cws-mcp-profile) |
Use the cws-mcp status tool1. Use cws-mcp upload with zipPath="/path/to/extension.zip"
2. Use cws-mcp publishUse cws-mcp publish with:
- publishType="STAGED_PUBLISH"
- deployPercentage=10Use cws-mcp publish with skipReview=trueUse cws-mcp update-metadata with:
- title="Pexus"
- summary="Official wallet for Plumise"
- description="..."
- category="productivity"
- defaultLocale="en"Use cws-mcp update-metadata with metadata={
"homepageUrl": "https://plumise.com",
"supportUrl": "https://plug.plumise.com/docs"
}Use cws-mcp update-metadata-ui with:
- title
- summary
- description
- category
- homepageUrl
- supportUrlNotes:
headless=false if login is required.~/.cws-mcp-profile (override with CWS_DASHBOARD_PROFILE_DIR).1. Use cws-mcp publish
2. Use cws-mcp deploy-percentage with percentage=10
3. Use cws-mcp deploy-percentage with percentage=50
4. Use cws-mcp deploy-percentage with percentage=100Note: deploy-percentage is only available for extensions with 10,000+ seven-day active users. The new percentage must always be higher than the current target.
The get and update-metadata tools use the Chrome Web Store v1.1 API, which is deprecated and will be removed after October 15, 2026. The v2 API does not provide metadata read/write endpoints, so these tools remain available as a bridge. Use update-metadata-ui (Playwright dashboard automation) as the long-term alternative.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.