extension_auth

Sign this machine in to extension.dev, report that login, or clear it.

Quick start

Log this machine in to the acme/newtab project on extension.dev

How the agent uses it

Pass action:'status' (the default) to name the workspace and project the stored token is scoped to and when it expires, never the token itself; that identity comes from the stored token alone, and does not change with the current working directory or whichever project folder you are in. Status also asks the platform's whoami endpoint whether that credential actually resolves there: the answer rides value.server.verdict as confirmed, refused or unavailable (when the server could not be reached), with status logged-in for the first and last and refused-by-server for the second, so a local file claiming a login the server refused is never reported as logged in. Pass action:'login' for a two-phase flow: call with project to get a code plus a URL the user authorizes at extension.dev/device, then call again with the returned deviceCode. GitHub federation happens server-side, so no GitHub token lands on this machine. Minted tokens live at most 7 days, server-enforced, so CI must re-mint before expiry on the console's project settings, Access tokens page. Pass action:'logout' to delete the local credentials only (with project, just that project's login); the token stays valid server-side until it is revoked at the URL the response returns. Several logins live side by side on one machine, one per server and workspace/project, and status lists them all under logins; a call uses the login minted on the server it targets (api, else EXTENSION_DEV_API_URL, else production), so a local dev server login never replaces or stands in for a production one. To sign in to several existing projects of one workspace at once, pass projects instead of project: one approval, one stored token per project. To sign in to every project a workspace has, pass workspace with projects:"*": the approval page lists them and the answer names each project signed in.

Reference

Group	platform, on with --features=local,platform (private alpha)
Tier	Platform
Needs	the server started with --features=local,platform
Read only	no
Destructive	yes
Idempotent	no
Reaches the open web	yes

Inputs

Input	Type	Required	Default	What it does
action	"status" | "login" | "logout"	no	"status"
project	string	no		login: target project as '<workspace>/<project>'; the token is scoped to it. The slug pair is the console address bar: an existing project's page is console.extension.dev/<workspace>/<project>. Create one at extension.dev/new if none exists yet. Logins to several projects are all kept, the latest is the default; token-scoped tools take project to pick another. logout: remove only this project's login (omitted, every stored login goes).
projects	array | string	no		login: sign in to several existing projects of one workspace with one approval, instead of one approval each. 1 to 20 names as '<workspace>/<project>', all in the same workspace, each by its exact slug (lowercase letters and digits joined by single dashes, at most 48 characters), none twice. Pass it instead of project, never beside it. The approval page lists every name; one missing project refuses the whole list and mints nothing. Resume with the returned deviceCode and the same list. Every token is stored as that project's own login and all expire within 7 days, so the same call renews them together. Or pass the string "*" with workspace to sign in to every project that workspace has when the approver opens the page (at most 20); the answer names each project signed in.
workspace	string	no		login with projects: "*": the workspace slug whose every project to sign in to, with one approval. Only a project of this workspace is ever stored. A platform that does not offer it is refused before any code is spent.
deviceCode	string	no		login: resume token from the prior call's deviceCode; omit on the first call.
api	string	no		Platform base URL (default EXTENSION_DEV_API_URL, else https://www.extension.dev)

When it fails

• The tool is missing from the client's list. Start the server with --features=local,platform; see Platform tools.
• The answer reads status: "platform-held". extension.dev is not open to the public yet, so nothing ran on its machines. Creating, running and building an extension still work on your machine; see Use the platform from your agent.
• A login for every project is refused at approval. The workspace has more than 20 projects, or none. Name up to 20 projects in projects instead.
• The answer says the platform does not offer signing in to every project. The server you target predates projects: "*". Pass the project names in projects.
• A login stops working before its 7 days are up, as MinterNotMember. The account that approved it left the workspace. Sign in again as a current member.
• The answer depends on the network. This tool reaches the open web, so a refusal can be the network, not the project.

Next

• MCP server: install, the two groups and the session gates
• Install in your client
• extension_builds: Read, rebuild and configure the platform's builds of the logged-in project on extension.dev.
• extension_preview_web: Preview an in-progress extension in the web emulator, with no real browser.
• extension_project_create: Create an extension.dev project for an extension that does not have one yet, without opening the console.
• extension_publish: Publish the project your stored token is scoped to (extension_auth, or EXTENSION_DEV_TOKEN) to extension.dev, and return its shareable URL.
• extension_release_promote: Promote a built extension to a release channel (stable, preview, beta, …) on extension.dev, headless.
• extension_release_status: Read where a project stands on extension.dev, from the public registry (registry.extension.land).
• extension_shares: List, create and revoke the public preview links this token has shared, which is what extension_preview_web share:true hands out.
• extension_submit: Submit a built extension for store REVIEW through extension.dev, which holds your store credentials and dispatches from your project's mirror CI: the Chrome Web Store, Firefox A...
• extension_workspace: Read the extension.dev workspace a stored login belongs to: its plan and limits, its projects, and its usage.
• extension_workspace_create: Create an extension.dev workspace that does not exist yet, without opening the console.