Tampermonkey Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tampermonkey Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
First install the following browser extensions:
Then install tampermonkey-mcp globally:
npm install -g tampermonkey-mcp@latestFinally configure your AI assistant to use the tampermonkey tool:
{
"mcpServers": {
"tampermonkey": {
"command": "npx",
"args": [
"-y",
"tampermonkey-mcp@latest"
]
}
}
}Your assistant will call tampermonkey.get-connection-code and return a connection code that you can enter in the Tampermonkey Editors extension.
npm install -g claude
// either use your local checkout
npm run watch
claude mcp add --transport http --scope project tampermonkey http://localhost:4001/mcp
// or the npm package
npm install -g tampermonkey-mcp@latest
claude mcp add --transport stdio --scope project tampermonkey -- npx -y tampermonkey-mcp
// more browser control needed?
// Open chrome://inspect/#remote-debugging
// [x] Allow remote debugging for this browser instance
// or
chromium --user-data-dir=/tmp/chrome-devtools-mcp-test-profile --remote-debugging-port=9222
npm install -g chrome-devtools-mcp@latest
// install Tampermonkey and Tampermonkey Editors
claude mcp add --transport stdio --scope project chrome-devtools-mcp -- npx -y chrome-devtools-mcp@latest --slim --no-usage-statistics --auto-connect --browser-url http://127.0.0.1:9222npm install
npm run allThis project implements an MCP (Model Context Protocol) server that allows AI assistants to read and modify Tampermonkey userscripts via the Tampermonkey Editors browser extension.
┌─────────────────────────────────────────────────────────────────────────────┐
│ AI Assistant │
└─────────────────────────────────────────────────────────────────────────────┘
│
│ MCP Protocol (stdio transport)
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ tampermonkey_mcp (MCP Server) │
│ │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ server.ts │ Main entry point │ │
│ │ │ - HTTP or stdio transport │ │
│ │ │ - MCP middleware │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ tampermonkey.ts │ MCP Tool Definitions │ │
│ │ │ - tampermonkey.get-connection-code │ │
│ │ │ - tampermonkey.list │ │
│ │ │ - tampermonkey.get │ │
│ │ │ - tampermonkey.patch │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ tampermonkey-ws-client.ts │ WebSocket Server │ │
│ │ │ - Connection code generation │ │
│ │ │ - Authentication handshake │ │
│ │ │ - Message relay to extension │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘
│
│ WebSocket (local, port derived from code)
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ Tampermonkey Editors Extension │
│ │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Service Worker │ Receives connection code, │ │
│ │ │ establishes WebSocket connection │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ │ Chrome Extension Messaging │
│ ▼ │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Content Script │ Bridges extension ↔ Tampermonkey │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Tampermonkey │ Userscript storage & execution │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘<base32(port - 1024)><auth_token><echo_token>Extension MCP Server
│ │
│───── auth (token) ──────────────────>│
│ │
│<──── auth (echo_token) ──────────────│
│ │
│───── auth (echo_token) ─────────────>│
│ │
│<──── authOK ─────────────────────────│
│ │
│<───── pings (every 15s) ─────────────│ (keep-alive)
│───── pongs ─────────────────────────>│
│ │
│<───── commands (list/get/patch) ─────│
│───── responses ─────────────────────>│tampermonkey.get-connection-codetampermonkey.listtampermonkey.getpath (from list), optional ifNotModifiedSince timestamp.tampermonkey.patchpath, value (new content), optional lastModified for optimistic locking.tampermonkey.putvalue (new script), optional lastModified.tampermonkey.deletepath (from list).curl -X POST http://localhost:4001/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"clientInfo": {
"name": "curl-client",
"version": "1.0.0"
},
"capabilities": {}
}
}'echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","clientInfo":{"name":"test-client","version":"1.0.0"},"capabilities":{}}}' | npx -y tampermonkey-mcp
echo '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | npx -y tampermonkey-mcp
echo '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"tampermonkey.list","arguments":{"pattern":""}}}' | npx -y tampermonkey-mcp~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.