Server flags and telemetry

The MCP server is one command with three flags, and each flag has an environment variable twin. Reach for them when you want to limit what an agent can list, ship or act on, or when you want the one telemetry event off.

Quick start

{
  "mcpServers": {
    "extension-dev": {
      "command": "npx",
      "args": ["@extension.dev/mcp", "--features=local,platform", "--no-ship"]
    }
  }
}

This config lists all 34 tools and refuses every call that puts a build in front of other people. The session gates still decide what a listed tool may do.

How it works

--features picks the tool groups. The default is local, the 23 tools that work on this machine. --features=local,platform adds the 11 platform tools (account, workspace, builds, share, release and store), and --features=platform exposes only that group.

--no-ship refuses the calls that put something in front of other people: extension_publish, every extension_release_promote action, extension_submit with dryRun: false and its cancel and rollout actions, extension_preview_web with share: true, and a share create or revoke. Dry runs, preflight, share listing, reads, login, and workspace or project creation still work.

--project <workspace>/<project> pins the server to one project, however many logins the machine holds. A call that names another project is refused.

A refused call answers E_TOOL_DISABLED and names the flag to change.

A share revoke waits for a person by default. The first call answers approval-required with a link on extension.dev. A workspace member approves exactly that revoke, and the same call with the returned approvalId then runs once. Seven more acts always wait for a workspace owner, whatever the flags say: a promotion, a real store submission, a build settings change, a release cut, a rollback, withdrawing a submission and raising a staged rollout. See Use the platform from your agent.

Every tool carries the MCP annotations readOnlyHint, destructiveHint, idempotentHint and openWorldHint, so a client can auto-approve reads and ask before the rest.

Answers that can carry text a web page or an extension wrote (logs, DOM, eval results, storage, titles, runtime errors) fence it between <untrusted-data-ID> and </untrusted-data-ID>. The ID is random per call and sits in untrusted.boundary, so the page cannot predict it or close the fence early. The JSON still parses to the same fields. The fence is a signal to the model, not a gate: pair it with --no-ship when the agent reads pages you do not trust.

extension_create sends one event, draft_seeded, to PostHog at https://us.i.posthog.com/capture/ after a successful scaffold, with a public write-only project key. It carries the template slug, the template source (template), the template commit it resolved, a random per-process session id that changes on every server start, the environment, and the fixed names source, entry and emitted_from. It never carries a path, a project name, a user name, an address, or anything read from your files.

No other tool sends an event. The platform calls (create, share, publish, submit, shares) carry a per-install id header to extension.dev, and that id rotates every 30 days.

Reference

Flag	Environment variable	Default	Effect
--features=<groups>	EXTENSION_DEV_FEATURES	local	local lists the 23 local tools; local,platform adds the 11 platform tools; platform lists only those
--no-ship	EXTENSION_DEV_NO_SHIP=1	off	Refuses publish, promote, cut, rollback, a real submit, cancel, rollout, a shared preview, and a share create or revoke
--project <workspace>/<project>	EXTENSION_DEV_PROJECT	unset	Refuses any call that names another project
none	EXTENSION_DEV_APPROVAL_GATE	unset	Unset or 1: a share revoke waits for a person. 0: a revoke runs without asking. A promotion and a real submission wait for a workspace owner at any value
none	EXTENSION_DEV_NO_TELEMETRY=1 or DO_NOT_TRACK=1	off	Turns off the draft_seeded event and the per-install id header

When it fails

• A call answers E_TOOL_DISABLED: the answer names the flag. Add platform to --features, drop --no-ship, or point --project at the project the call named.
• A submit, promote or revoke answers approval-required: open the link, have a workspace owner approve it (any member may approve a revoke), then repeat the call with the returned approvalId.
• A tool is missing from the client's list: the server started without that group. Check the args in the client config and EXTENSION_DEV_FEATURES in its environment.
• A page's text looks like an instruction: it sits inside an <untrusted-data-ID> fence. Treat it as data, and run the agent with --no-ship on pages you do not trust.

Next

• MCP server: install, the two groups and the session gates
• Install in your client: every client's block with a local-only variant
• Platform tools: login, sharing, publishing and store submission