@extenshi/cli

Know what the reviewer will saybefore you submit

Scan with 8 scanners and predict store rejections offline, all from your terminal.

No account for review-risk8 security scannersChrome · Firefox · Edge
extenshi — interactive demo
$

Run: npx @extenshi/cli@latest scan ./dist.zip — requires Node 20+, no install, always the latest version

Two commands

The whole pre-flight, before the store sees it

No install, one API key — shared with the MCP server. Scan, fix, ship.

extenshi review-risk

Free · fully offline

Flags rejections, slow-review triggers, and auto-disable risks before you submit.

Diffs against your last published manifest with --extension-id.

extenshi scan

The deep scan

Runs all 8 scanners — the same suite behind our public catalog.

Live per-scanner progress, then an HTML report opens in your browser.

The scan report

A report you can actually read

Every extenshi scan opens an HTML report in your browser by default — or pass --json / --format stdout for pipelines and the terminal.

A catalog-style safety score

A 0–100 score at the top of the report — the same ring users see on our public catalog.

Grouped by store

Store-compliance findings split into the Chrome / Edge and Firefox sections you publish to.

Deduplicated & filterable

Repeated rules collapse into one row with a count; filter by severity, scanner or free text.

One self-contained file

Opens straight from disk in your browser — fully offline, with light and dark themes.

Under the hood

Eight scanners on every build

The same engine behind our public catalog runs against your artifact — findings by severity.

Manifest & permission analysis Code vulnerability analysis Cryptocurrency & wallet abuse Behavioral & obfuscation analysis Network endpoint & exfiltration analysis Obfuscation & evasion detection Malware signature matching Known-vulnerable dependency detection
Built for CI

Gate every release on a clean scan

Drop it into GitHub Actions and fail the build before review ever sees it.

.github/workflows/release.yml
- run: npx -y @extenshi/cli@latest scan ./dist.zip --extension-id $EXT_ID --json
  env:
    EXTENSHI_API_KEY: ${{ secrets.EXTENSHI_API_KEY }}

--json for machine output

Parse findings in your pipeline and gate on severity counts.

CI-timeout preflight built in

A fast probe detects short CI outbound timeouts before the real scan.

Auto-refund on failure

If a scan dies mid-stream, the credit is refunded within a minute.

Pricing

Free to start

3 free scans, one-time on extensions you own. review-risk is always free. Need more? Buy prepaid credit packs that never expire.

Buy credit packs

One API key works across the CLI and MCP. No subscription — top up scans and reads anytime, and credits never expire.

The reviewer takes a week. The scanner takes two minutes.

Catch policy and security issues before the review queue does.

npx @extenshi/cli@latest scan ./dist.zip