extension_approvals

Read or revoke one approval a workspace owner was asked for on extension.dev.

Quick start

I approved that App Review submission by mistake, revoke it

How the agent uses it

action status (the default) answers where the approval stands: pending, approved and unused, used, declined, revoked or expired. action revoke takes back a pending approval, or one that was approved and not used yet, so no act can ever run with it; only a token minted by a workspace owner may revoke, nothing else changes, and an approval that already ran is refused with what it ran. Use revoke when the person says they approved something by mistake or no longer wants it to happen. The answer reports what the platform recorded after the revoke in value.outcome and the approval page in value.links.

Reference

Group	platform, on with --features=local,platform (private alpha)
Tier	Platform
Needs	the server started with --features=local,platform, and a login; revoke needs a token a workspace owner minted
Read only	no
Destructive	yes
Idempotent	no
Reaches the open web	yes

Inputs

Input	Type	Required	Default	What it does
action	"status" | "revoke"	no	"status"	status reads the approval; revoke ends a pending or approved, unused approval for good.
approvalId	string	yes		The approval, apr_ followed by 32 characters, as an approval-required answer or the approval page link gave it.
project	string	no		Which stored login to use, as '<workspace>/<project>' (or a project slug that matches one login), when extension_auth has signed in to more than one project on this machine. Omitted, the login this server resolved first is used, after EXTENSION_DEV_TOKEN when that is set, and a login made elsewhere on this machine does not move it. Named, it outranks EXTENSION_DEV_TOKEN. extension_auth (action: status) lists the stored logins.
api	string	no		Platform base URL (default EXTENSION_DEV_API_URL, else https://www.extension.dev)

When it fails

• The tool is missing from the client's list. Start the server with --features=local,platform; see Platform tools.
• The platform refuses the call. Log in first with extension_auth.
• The answer reads status: "platform-held". extension.dev is not open to the public yet, so nothing ran on its machines. Creating, running and building an extension still work on your machine; see Use the platform from your agent.
• The answer reads status: "approval-required". The act needs a person's approval. Open the approval URL in the answer, approve it, then call again with the same arguments and the approvalId.
• The approval is refused as ApprovalExpired. An approval lasts 15 minutes. Call again with no approvalId to ask for a fresh one.
• The approval is refused as ApprovalConsumed. An approval runs its act once, and the call that spent it may already have run. Read the current state first, then ask again only if the act did not happen.
• The approval is refused as ApprovalScopeMismatch. It covers a different act, or the arguments changed since it was approved. Call again with no approvalId.
• The answer depends on the network. This tool reaches the open web, so a refusal can be the network, not the project.

Next

• MCP server: install, the two groups and the session gates
• Install in your client
• extension_auth: Sign this machine in to extension.dev, report that login, or clear it: action status (the default), login and logout.
• extension_builds: Read, download, rebuild and configure the platform's builds of the logged-in project on extension.dev: action list (the default), get, logs, download, recheck, rebuild, configur...
• extension_preview_web: Preview a build in the web emulator and share it as a quick link anyone can open, with no install, sign-in or dev server.
• extension_project_create: Create an extension.dev project for an extension that has none yet, without opening the console: right after extension_create and extension_build, once the source is pushed to a...
• extension_publish: Publish a build of the logged-in project on extension.dev and answer the link to send testers, which opens a page with a download and a run command for each browser.
• extension_release_promote: Release a build to a channel.
• extension_release_status: Read where a project stands on extension.dev from the public registry (registry.extension.land): its release channels with each channel's audience and recent builds (include:'re...
• extension_shares: List, create and revoke the emulator preview links that give a tester one build and its zip (the uploads this login has shared, the same links extension_preview_web share:true h...
• extension_submit: Submit a built extension to a store through extension.dev, which holds the store credentials and uploads (Chrome Web Store, Firefox AMO, Edge Add-ons, App Store for Safari), and...
• extension_submit_check: Read a store submission and ask for an approval through extension_submit's own handler, under a read-only hint.
• extension_workspace: Read the extension.dev workspace a stored login belongs to, and change one project's settings.
• extension_workspace_create: Create an extension.dev workspace that does not exist yet, without opening the console.