Security & Testing

zovo.one

Analyzes Chrome extension permissions and manifests for security and privacy assessment.

1 endpoint3 known toolsFirst detected August 9, 2026Last detected August 9, 2026

ENDPOINT 1

https://crx-permission-risk-mcp.lipmichal.workers.dev/mcp

No auth detected

MCP server metadata

Name: crx-permission-risk
Version: 1.0.0

Capabilities

tools

Server instructions

Scores the privilege a Chrome MV3 extension takes from its manifest. Pass a manifest.json to analyze_manifest, ask about one permission with explain_permission, or diff two permission sets with compare_permission_sets to see whether an update will force user re-consent. Pure static analysis, no network calls, nothing is stored.

Known tools 3

analyze_manifest

Static privilege analysis of a Chrome MV3 manifest.

Inferred read-only

explain_permission

Returns the privilege weight (0-10) for a single Chrome extension permission or host pattern, what it actually grants, whether it triggers an install-time warning, and the narrower alternative if one exists.

Inferred read-only

compare_permission_sets

Compares the permissions and host patterns of two versions of an extension.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.crx-permission-risk]
url = "https://crx-permission-risk-mcp.lipmichal.workers.dev/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "crx-permission-risk": {
      "type": "http",
      "url": "https://crx-permission-risk-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: crx-permission-risk
Remote MCP URL: https://crx-permission-risk-mcp.lipmichal.workers.dev/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "crx-permission-risk": {
      "url": "https://crx-permission-risk-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "crx-permission-risk": {
      "type": "http",
      "url": "https://crx-permission-risk-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "crx-permission-risk",
  "transport": "streamable-http",
  "url": "https://crx-permission-risk-mcp.lipmichal.workers.dev/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for workers.dev was fetched 2026-07-25T21:40:35.686Z.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.