# io.github.mikusnuz/cws (npm · cws-mcp)

MCP server for Chrome Web Store — extension upload, publish, status, and rollout

- Trust score: 67/100 (medium)
- Change this week: +14
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `cws-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/mikusnuz-cws/cws-mcp.md), [page](https://verifymcp.io/servers/mikusnuz-cws/cws-mcp)

## Channel facts

- Registry: `npm`
- Package: `cws-mcp`
- Version: `1.4.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 136 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1053 tokens (~117/item across 9 items; 8 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add mikusnuz-cws -- npx -y cws-mcp
```

### Codex

```bash
codex mcp add mikusnuz-cws -- npx -y cws-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mikusnuz-cws": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "cws-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mikusnuz-cws --command npx --arg -y --arg cws-mcp
```

### Hermes

```yaml
mcp_servers:
  mikusnuz-cws:
    command: "npx"
    args: ["-y", "cws-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "mikusnuz-cws": {
      "command": "npx",
      "args": [
        "-y",
        "cws-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 67, −3)

- [security regression] Install scripts: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Known CVEs: partial → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Maintenance: pass → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] License: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional] Licence: MIT

### 2026-07-31 (score 70, +55)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 15, −67)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Dependency health: partial → unverified

### 2026-07-29 (score 82, +56)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-07-28 (score 26, −27)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (8)

### `upload` (~104 tokens)

Upload a ZIP file to update an existing Chrome Web Store item draft. Note: Creating new items via API is not supported in v2 — use the Developer Dashboard to create new items.

Input parameters:

- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `publisherId` (string): Publisher ID (defaults to CWS_PUBLISHER_ID env var or 'me')
- `zipPath` (string, required): Absolute path to the ZIP file to upload

### `publish` (~158 tokens)

Publish an extension to Chrome Web Store. Supports immediate publish, staged publish, initial deploy percentage, and skip-review.

Input parameters:

- `deployPercentage` (integer): Initial deploy percentage for staged rollout (0-100). Only used with STAGED_PUBLISH or DEFAULT_PUBLISH.
- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `publishType` (string): DEFAULT_PUBLISH: publishes immediately after approval. STAGED_PUBLISH: stages for manual publishing after approval. Defaults to DEFAULT_PUBLISH.
- `publisherId` (string): Publisher ID (defaults to CWS_PUBLISHER_ID env var or 'me')
- `skipReview` (boolean): Attempt to skip review if the extension qualifies. Defaults to false.

### `status` (~87 tokens)

Fetch the current status of an extension on Chrome Web Store. Returns published/submitted revision status, deploy percentage, version, takedown/warning flags, and last upload state.

Input parameters:

- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `publisherId` (string): Publisher ID (defaults to CWS_PUBLISHER_ID env var or 'me')

### `cancel` (~71 tokens)

Cancel a pending submission on Chrome Web Store. Can be used to cancel an item currently in review.

Input parameters:

- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `publisherId` (string): Publisher ID (defaults to CWS_PUBLISHER_ID env var or 'me')

### `deploy-percentage` (~114 tokens)

Set the published deploy percentage for staged rollout on Chrome Web Store. The new percentage must be higher than the current target. Only available for items with 10,000+ seven-day active users.

Input parameters:

- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `percentage` (number, required): Deploy percentage (0-100). Must be larger than the current target percentage.
- `publisherId` (string): Publisher ID (defaults to CWS_PUBLISHER_ID env var or 'me')

### `get` (~92 tokens)

Get the current metadata of a Chrome Web Store item (v1.1 API). Returns title, description, category, and other listing fields. Note: v1 API is deprecated and will be removed after Oct 15, 2026.

Input parameters:

- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `projection` (string): Metadata projection to fetch (defaults to DRAFT)

### `update-metadata` (~205 tokens)

Update the store listing metadata of a Chrome Web Store item (v1.1 API). Supports both common fields and raw metadata payload for advanced fields. Note: v1 API is deprecated and will be removed after Oct 15, 2026. Use update-metadata-ui as an alternative.

Input parameters:

- `category` (string): Category (e.g. 'productivity', 'developer_tools')
- `defaultLocale` (string): Default locale (e.g. 'ko', 'en')
- `description` (string): Store listing description
- `homepageUrl` (string): Homepage URL
- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `metadata` (object): Raw metadata object forwarded as-is to the v1 API. Useful for fields not exposed as first-class params.
- `summary` (string): Store listing short summary
- `supportUrl` (string): Support URL
- `title` (string): Store listing title

### `update-metadata-ui` (~189 tokens)

Update listing metadata via Chrome Web Store dashboard UI automation (Playwright). Use this when API metadata updates are not reflected, or as the primary metadata update method since the v1 API is deprecated.

Input parameters:

- `accountIndex` (integer): Google account index in dashboard URL (default: 0)
- `category` (string): Category label as shown in dashboard UI
- `description` (string): Store listing long description
- `headless` (boolean): Run browser headless (default: false)
- `homepageUrl` (string): Homepage URL
- `itemId` (string): Extension item ID (defaults to CWS_ITEM_ID env var)
- `storeIconPath` (string): Absolute path to 128x128 store icon image
- `summary` (string): Store listing short summary
- `supportUrl` (string): Support URL
- `title` (string): Store listing title

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mikusnuz-cws/cws-mcp#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 67
- 2026-08-01: 70
- 2026-07-31: 70
- 2026-07-30: 15
- 2026-07-29: 82
- 2026-07-28: 26
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/cws-mcp
- Socket report: https://socket.dev/npm/package/cws-mcp
- Repository: https://github.com/mikusnuz/cws-mcp
- Changelog RSS feed: https://verifymcp.io/servers/mikusnuz-cws/cws-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/mikusnuz-cws/cws-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/mikusnuz-cws/cws-mcp