Know what the reviewer will say before you submit
Scan with 8 scanners and predict store rejections offline, all from your terminal.
$Run: npx @extenshi/cli@latest scan ./dist.zip — requires Node 20+, no install, always the latest version
The whole pre-flight, before the store sees it
No install, one API key — shared with the MCP server. Scan, fix, ship.
extenshi review-risk
Free · runs locally
Flags rejections, slow-review triggers, and auto-disable risks before you submit.
Diffs against your last published manifest with --extension-id.
extenshi scan
The deep scan
Runs all 8 scanners — the same suite behind our public catalog.
Live per-scanner progress, then an HTML report opens in your browser.
A report you can actually read
Every extenshi scan opens an HTML report in your browser by default — or pass --json / --format stdout for pipelines and the terminal.
A catalog-style safety score
A 0–100 score at the top of the report — the same ring users see on our public catalog.
Grouped by store
Store-compliance findings split into the Chrome / Edge and Firefox sections you publish to.
Deduplicated & filterable
Repeated rules collapse into one row with a count; filter by severity, scanner or free text.
One self-contained file
Opens straight from disk in your browser — fully offline, with light and dark themes.
Eight scanners on every build
The same engine behind our public catalog runs against your artifact — findings by severity.
Gate every release on a clean scan
Drop it into GitHub Actions and fail the build before review ever sees it.
- run: npx -y @extenshi/cli@latest scan ./dist.zip --extension-id $EXT_ID --json env: EXTENSHI_API_KEY: ${{ secrets.EXTENSHI_API_KEY }}
--json for machine output
Parse findings in your pipeline and gate on severity counts.
CI-timeout preflight built in
A fast probe detects short CI outbound timeouts before the real scan.
Auto-refund on failure
If a scan dies mid-stream, the credit is refunded within a minute.
Free to start
3 free scans, one-time on extensions you own. review-risk is always free. Need more? Buy prepaid credit packs that never expire.
Buy credit packsOne API key works across the CLI and MCP. No subscription — top up scans and reads whenever you need them.
Chrome Web Store questions, answered
- Will it tell me why the Chrome Web Store would reject my extension?
- That is what review-risk is for. It predicts what will likely be rejected, what triggers a slow manual review, and what would auto-disable the extension for existing users on update. Every finding names the Chrome Web Store program policy it predicts against, so you can read the rule at the source and quote it if a reviewer disagrees.
- Does my code get uploaded anywhere?
- Your build never leaves your machine with review-risk: it reads the manifest and listing text inside the package locally, and needs no API key. Two things do go out, neither of them your code. Passing --extension-id fetches your last published manifest from our catalog so it can diff for auto-disable risk — that sends the extension id, not your build. And the CLI reports anonymous usage (command and flag names, versions, a coarse error kind — never file paths, artifact contents or manifest data), which you can turn off with DO_NOT_TRACK=1 or EXTENSHI_TELEMETRY=0. scan is the one command that does upload the packaged artifact, because the eight-scanner engine runs server-side.
- Do I need an account or an API key?
- Not for review-risk — it works with no account at all. scan needs an API key, which you get by running extenshi login once. Every account includes a one-time free allowance of 3 scans and 10 reads, with no card required.
- Does it check Manifest V3 compliance?
- Yes. The review rules read your manifest directly, so Manifest V3 problems — permissions you declare but never use, broad host access like <all_urls>, and permission additions that would auto-disable your extension for existing users — are flagged before you submit rather than after a reviewer finds them.
- Which stores does it cover?
- Chrome Web Store, Firefox Add-ons, and Edge Add-ons. Permission sets differ per store, so review-risk takes --store chrome|firefox|edge and diffs the manifest against the right one; the scan report splits store-compliance findings into the Chrome/Edge and Firefox sections you actually publish to.
- Does it check my store listing too, or only the code?
- Both. Moderation reads your listing as closely as your code, so the listing rules run on every invocation using the name and short description from the package — including each locale you ship. The full description only exists in the developer dashboard, so pass it with --listing to have the keyword-spam rules read that as well.
- Can I run it in CI and fail the build on findings?
- Yes. Run it with --json in GitHub Actions and gate on the severity counts you care about. Note that the exit code signals whether the scan ran, not whether it found anything — a scan that completes with critical findings still exits 0, so read the JSON and decide the threshold yourself. A pre-flight probe detects short CI outbound timeouts before the real scan starts.
- What does it cost?
- review-risk is always free. Scanning draws on a one-time free allowance of 3 scans, and scanning an extension whose ownership you have verified is free as well. Beyond that you buy prepaid scan packs — no subscription, and the credits never expire. A scan that dies mid-stream is refunded automatically within a minute.
More developer tools
MCP server
The cross-store catalog and scanner, inside your AI tools.
Manifest generator
A guided MV3 manifest that passes store review.
Pin guide
Illustrated steps that get your extension pinned to the toolbar.
Uninstall feedback
A hosted exit survey — find out why users leave.
Policy generator
A store-ready privacy policy from your permissions.
Icon generator
Draw with your agent, verify in real toolbar mockups.
The reviewer takes a week. The scanner takes two minutes.
Catch policy and security issues before the review queue does.
npx @extenshi/cli@latest scan ./dist.zip