Chrome Extension Downloader
REMOTE · EXTENSIONDOWNLOADER.COM
Chrome extension data: free previews; API key for full reviews, comparisons and permissions.
Available components
Last scanned (6 hours ago)
Scores higher than 79% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Search and Retrieval
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability73
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2116 tokens (~132/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 0
- Stability: unverified → 0.03 ▲ functional
- 1 Nov 26 +41
- Transport: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Authorization: Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. security
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 100 functional
- 31 Oct 26 36
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://extensiondownloader.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=extensiondownloader.com | CN=WE1,O=Google Trust Services,C=US | 18 Oct 2026 | 16 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 226bb608b67351f8136ad61661b927e2 |
| SANs: extensiondownloader.com, *.extensiondownloader.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of extensiondownloader.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| com. | DS published | 19718 | 13 | Verified |
| extensiondownloader.com. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="extension-mcp"
Bearer realm="extension-mcp"| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000 |
Protected resource metadata
| Retrieved | No |
|---|---|
| Problem | No resource metadata |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://extensiondownloader.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://extensiondownloader.com/api/mcp | HTTPS enforced | 301 | https://extensiondownloader.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
extension_api_usage ~80
Read the current API key's daily REST/MCP usage and remaining key/account allowance. Requires a key, but remains available after its daily data quota is exhausted. Does not debit data quota; account minute limits still apply.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Daily usage history lookback, up to 90 days. Today's balances and reset time are included separately. |
No output schema declared.
No examples provided.
extension_compare ~78
Compare up to four extensions side by side: users, stars, rating counts, versions, permissions and recent permission changes. For historical comparisons, call extension_trends for each ID; this is not code-similarity detection.
| Name | Type | Req | Description |
|---|---|---|---|
| eids | array | yes | One to four extension IDs to compare, in the desired display order. Use distinct IDs. |
No output schema declared.
No examples provided.
extension_get ~94
Get collected store metadata for one extension, including users, ratings and version. Free without a key for basic metadata only; a key returns the full metadata record. Unknown IDs return not found, never trigger a crawl.
| Name | Type | Req | Description |
|---|---|---|---|
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
No output schema declared.
No examples provided.
extension_rank_history ~108
Track one extension's position in our overall and category user-count rankings. Returns per-scope history, not official store or keyword search positions. Untracked ranks may be missing.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look back this many days for tracked ranking positions, up to 365. |
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
No output schema declared.
No examples provided.
extension_rankings ~156
Read our saved user-count leaderboard for one date, overall or within a category. Returns positions and pagination; not official store or keyword search ranks. Use extension_rank_history to follow one extension over time.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Ranking rows per page, up to 250. |
| page | integer | – | Page number, starting at 1. |
| rankDate | string | – | Ranking date as YYYY-MM-DD in Asia/Shanghai. Omit for today; missing dates are not replaced with another date. |
| scopeKey | string | – | Use all for overall scope; for category scope, use the recorded category key, not its translated display name. |
| scopeType | string | – | Choose the overall catalog or one category leaderboard. |
No output schema declared.
No examples provided.
extension_review_history ~88
Read collected review counts grouped by original publication date and stars, plus version-level ratings and undated/unrated counts. Reconstructed from retained reviews, not historical store rating-count snapshots.
| Name | Type | Req | Description |
|---|---|---|---|
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
No output schema declared.
No examples provided.
extension_review_insights ~139
Read stored review statistics and star distribution for an extension, optionally by review language. These describe collected reviews, not all store ratings. Missing statistics return null; no refresh is triggered.
| Name | Type | Req | Description |
|---|---|---|---|
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
| language | string | – | Original review language, e.g. en; all combines languages. This filters reviews rather than translating the response. |
| windowDays | – | – | 0 = all retained reviews; 365 = the stored one-year review window. |
No output schema declared.
No examples provided.
extension_review_summary ~118
Get an existing published AI summary of collected reviews, with pros and cons. Use extension_reviews for original comments. Returns null when unavailable and English when a translation is missing; never calls a model or generates a new summary.
| Name | Type | Req | Description |
|---|---|---|---|
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
| locale | string | – | Preferred response content language, not a review-language filter or a store search market. |
No output schema declared.
No examples provided.
extension_reviews ~205
Read original stored reviews for one extension, with text, star and language filters combined using AND. Returns reviews and pagination. For cross-extension or OR queries, use extension_reviews_search.
| Name | Type | Req | Description |
|---|---|---|---|
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
| language | string | – | Original review language, e.g. en. Omit for all languages; does not translate reviews. |
| page | integer | – | Page number, starting at 1. |
| pageSize | integer | – | Results per page, up to 100. |
| q | string | – | Text to match in review bodies, e.g. subscription. |
| rating | integer | – | Exact star rating from 1 to 5. |
| sort | string | – | timestamp_desc/asc = newest/oldest first; rating_desc/asc = highest/lowest stars first. |
No output schema declared.
No examples provided.
extension_reviews_search ~168
Search original stored reviews across extensions with AND/OR field filters. Returns reviews and pagination. Example filter: {"field":"body","operator":"contains","value":"subscription"}. Use extensionEid to narrow to an extension.
| Name | Type | Req | Description |
|---|---|---|---|
| filters | array | – | Up to 12 review filters. Example: [{"field":"rating","operator":"<=","value":2}]. Omit to browse retained reviews. |
| logic | string | – | AND requires every filter to match; OR requires at least one. |
| page | integer | – | Page number, starting at 1. |
| pageSize | integer | – | Results per page, up to 100. |
| sort | string | – | timestamp_desc/asc = newest/oldest first; rating_desc/asc = highest/lowest stars first. |
No output schema declared.
No examples provided.
extension_safety ~104
Inspect permission capabilities, observed permission changes and heuristic store risk signals. Reports evidence and incomplete assessments; not a malware scan, malware probability or safety guarantee.
| Name | Type | Req | Description |
|---|---|---|---|
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
| locale | string | – | Preferred response content language, not a review-language filter or a store search market. |
No output schema declared.
No examples provided.
extension_search ~101
Find extensions by name, description or category name. Returns metadata and pagination, ordered by user count. Use returned IDs for detail and analysis tools; not Chrome Web Store keyword search positions.
| Name | Type | Req | Description |
|---|---|---|---|
| page | integer | – | Page number, starting at 1. |
| pageSize | integer | – | Results per page, up to 100. |
| q | string | – | Text to match, e.g. password manager. Omit to browse the catalog by user count. |
No output schema declared.
No examples provided.
extension_source_search ~126
Find extensions by Manifest metadata, permission names, host patterns, descriptions or archived source file paths. Returns metadata matches and snippets, not full-text JavaScript search, source downloads or code-similarity analysis.
| Name | Type | Req | Description |
|---|---|---|---|
| field | string | – | Search target; source means archived file paths, not file contents. all searches metadata and paths. |
| limit | integer | – | Maximum matches, up to 50, ordered by user count. No pagination. |
| q | string | yes | Text to match, e.g. webRequest, example.com or background.js. Uses case-insensitive substring matching. |
No output schema declared.
No examples provided.
extension_top ~106
Browse extensions ranked by current users, average stars or store rating count. Free without a key for the first 10 by users only; omit arguments for that preview. Other sorts and pagination require a key.
| Name | Type | Req | Description |
|---|---|---|---|
| page | number | – | Free preview includes the first page only. |
| pageSize | number | – | Free preview returns at most 10 extensions; omit to use this default. |
| sort | string | – | Free preview ranks by store user count only; omit to use this default. |
No output schema declared.
No examples provided.
extension_trending ~183
Find growing extensions using saved 7/14/30/90-day user or rating-count growth rankings. Candidates have 1K-1M users and at least 500 net new users in the window. Free without a key for the first 10 by 30-day user gain; omit arguments for that preview. Missing comparison data is not zero growth; requests never rebuild rankings.
| Name | Type | Req | Description |
|---|---|---|---|
| fastGrowth | boolean | – | Free preview does not apply the optional 20% user-growth filter. |
| page | number | – | Free preview includes the first page only. |
| pageSize | number | – | Free preview returns at most 10 extensions; omit to use this default. |
| sort | string | – | Free preview ranks by net user gain, not percentage or rating-count gain. |
| windowDays | number | – | Free preview uses the saved 30-day growth window only. |
No output schema declared.
No examples provided.
extension_trends ~138
Read one extension's user-count, store rating-count and average-star history with current metrics and deltas. Use for time-series analysis, not keyword ranks. Missing days are not zero values.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look back this many days for stored metric snapshots, up to 365; coverage may be incomplete. |
| eid | string | yes | 32-letter Chrome Web Store extension ID (a-p), not a URL, name or slug. Example: cjpalhdlnbpafiamejdnhcphjbkeiagm. |
| locale | string | – | Preferred response content language, not a review-language filter or a store search market. |
No output schema declared.
No examples provided.
How do I install the Chrome Extension Downloader MCP server?
Chrome Extension Downloader is a hosted endpoint at https://extensiondownloader.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · extensiondownloader.com
claude mcp add --transport http com-extensiondownloader-mcp 'https://extensiondownloader.com/api/mcp'
What is the Chrome Extension Downloader MCP server?
Chrome Extension Downloader is an MCP server listed in the public MCP registry as com.extensiondownloader/mcp. Chrome extension data: free previews; API key for full reviews, comparisons and permissions. This page covers its hosted endpoint (https://extensiondownloader.com/api/mcp).
Is the Chrome Extension Downloader MCP server safe to use?
Chrome Extension Downloader scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Chrome Extension Downloader MCP server expose?
Chrome Extension Downloader exposes 16 tools: extension_search, extension_get, extension_trends, extension_rank_history, extension_safety, and 11 more. Their descriptions and schemas cost roughly 1,992 tokens of context every time the server is loaded.
Does the Chrome Extension Downloader MCP server require authentication?
Yes. Chrome Extension Downloader asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Chrome Extension Downloader MCP server still maintained?
Chrome Extension Downloader is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the Chrome Extension Downloader MCP server?
VerifyMCP ran 13 checks on Chrome Extension Downloader, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.