Chrome Extension Lookup & Permission Audit (Web Store)

Get Chrome Web Store extensions as clean JSON. Each row has users, rating, version, update and publish dates, size, languages, category and the Store's badges. It also has the permissions and host access the extension asks for, with a risk level. Look extensions up by id or URL, or read the top extensions of any Store category. Run it on a schedule, and each row says what changed since your last run: a new version, new permissions, more users, a lost badge.

By FtryTech.

What it reads

Each extension's public Chrome Web Store page (chromewebstore.google.com/detail/<id>) and the Store's category pages. The Store's robots.txt allows these pages. It disallows search and the reviews tab, so this Actor does not search and does not read reviews. It reads the extensions you name, or the ones a category page lists. The Actor reads robots.txt at the start of every run and stops if the rules change. It fetches one page at a time, about a second apart. There is no login, no cookies, no proxy and no browser.

The permissions come from the extension's own manifest, which the Store page includes. The Actor returns what the manifest asks for, never the manifest text.

No personal data. A Store page also shows the publisher's e-mail, street address and phone. The Actor never returns them. The publisher's name, website, support and privacy-policy links are kept only when the name reads as an organisation (a company, foundation or project). When the publisher may be a private person, these fields are null.

Who it is for

• Security and IT teams: audit the extensions your people use. Find every extension that can read all websites or your cookies. Schedule a run on your allow-list and get told when an extension adds a permission.
• Extension makers: watch your competitors' versions, users, ratings and badges. Use includeRelated to find the extensions the Store shows next to yours.
• Market research: read the top 32 of any category, by relevance or rating.
• AI agents: one call answers "what does this extension access, and is it safe?" Every field has a default, and an empty answer is an explicit row, never a silent empty dataset.

Input

Every field is optional. With no input, the Actor reads one sample extension (uBlock Origin Lite).

{
  "extensions": [
    "ddkjiahejlhfcafbddmgiahcphecmpfh",
    "https://chromewebstore.google.com/detail/grammarly-ai-writing-assi/kbfnbcaeplbcioakkpcpgfkobkghlhen"
  ],
  "categories": ["productivity/workflow"],
  "categorySort": "highestRated",
  "maxPerCategory": 10,
  "includeRelated": false,
  "includeDescription": false,
  "trackChanges": true,
  "changeFilter": "all_rows",
  "stateKey": "my-allow-list"
}

Field	Default	Meaning
extensions	one sample extension	Extension or theme ids (32 letters, a to p) or Store URLs, old or new, one per line (up to 1,000). The sample is used only when you name no category either.
categories	none	Also read the top extensions of these categories, e.g. productivity/developer, make_chrome_yours/privacy (18 categories).
categorySort	mostRelevant	mostRelevant (the Store's default) or highestRated.
maxPerCategory	20	The most extensions read from each category, from the top (at most 32).
includeRelated	false	Add a row for each extension the Store lists as related (about 12 per extension).
includeDescription	false	Add the full listing text.
trackChanges	true	Remember each extension and report what changed on the next run.
changeFilter	all_rows	all_rows, any_change (only changed or new extensions) or version_or_permissions (only a new version or changed permissions, and new extensions).
stateKey	default	The memory's name. Use one per watch list you schedule.

Output

Each row has a type.

extension

{
  "type": "extension",
  "input": "kbfnbcaeplbcioakkpcpgfkobkghlhen",
  "source": "input",
  "categoryRank": null,
  "extensionId": "kbfnbcaeplbcioakkpcpgfkobkghlhen",
  "name": "Grammarly: AI Writing Assistant and Grammar Checker App",
  "itemType": "extension",
  "category": "productivity/communication",
  "rating": 3.87,
  "ratingCount": 43163,
  "users": 40000000,
  "featured": true,
  "establishedPublisher": true,
  "publishedAt": "2012-10-22T10:17:01.000Z",
  "lastUpdated": "2026-10-22T15:54:11.000Z",
  "version": "14.1341.0",
  "size": "17.61MiB",
  "sizeBytes": 18465423,
  "languageCount": 1,
  "minimumChromeVersion": "98",
  "manifestVersion": 3,
  "permissions": ["scripting", "sidePanel", "tabs", "notifications", "cookies", "identity", "storage"],
  "optionalPermissions": ["nativeMessaging", "clipboardRead"],
  "hostPermissions": ["http://*/*", "https://*/*"],
  "broadHostAccess": true,
  "sensitivePermissions": ["cookies", "identity", "scripting", "tabs"],
  "riskLevel": "high",
  "publisher": "Grammarly, Inc.",
  "publisherIsTrader": true,
  "publisherId": "u7431803589585a11dd7aea578e1005d0",
  "website": "http://grammarly.com/",
  "url": "https://chromewebstore.google.com/detail/kbfnbcaeplbcioakkpcpgfkobkghlhen",
  "firstCheck": false,
  "previousCheckAt": "2026-10-18T06:00:00.000Z",
  "changes": [{ "field": "version", "before": "14.1338.0", "after": "14.1341.0" }]
}

Rows also carry shortDescription, languages, optionalHostPermissions, contentScriptMatches, supportUrl, privacyPolicyUrl and iconUrl.

riskLevel is a plain reading of the manifest, not a verdict:

• high: it asks for debugger, nativeMessaging or proxy. Or it can reach every website and also asks for a permission that reads or reroutes browsing, such as cookies, webRequest, scripting, history or clipboardRead.
• medium: it can reach every website, or it asks for any sensitive permission (tabs, downloads, bookmarks and others; see sensitivePermissions).
• low: neither.

Many trusted extensions are high because their job needs it; an ad blocker must see every page. Use the level to decide what to look at first.

changes lists each tracked field that moved since the last check, as {field, before, after}. The tracked fields are name, version, permissions, host permissions, optional permissions, content-script pages, users, rating, rating count, the two badges and the publisher. It is null on the first check.

related_extension: extension (the looked-up id), position, extensionId, name, itemType, category, shortDescription, rating, ratingCount, users, featured, establishedPublisher and url.

no_results (free): written when an entry gives nothing. Its reason is one of invalid_entry, extension_not_found, category_empty, blocked_by_robots, page_unreadable, no_related, no_changes or fetch_failed, and message says what to change. You are never charged for these rows.

Pricing (pay per event)

Event	Price
Extension record (one extension row)	$0.002 ($2 per 1,000 extensions)
Related extension (one related_extension row)	$0.0005
no_results rows, including unchanged extensions under a change filter	free

Apify also charges its standard tiny run-start fee. The run stops cleanly at your spending limit.

Tips

• Permission-drift alerts: put your allow-list in extensions, set changeFilter to version_or_permissions, and schedule the run daily. You pay only for the extensions that changed. Connect the dataset to Slack, Sheets or a webhook.
• Competitor watch: schedule a weekly run on your rivals with changeFilter: "any_change".
• Category snapshot: categories with trackChanges on shows who climbed or lost users between runs.
• An extension's id is the last part of its Store URL.

For AI agents (MCP)

• Call it with only extensions. Every other input has a default.
• Read type first. no_results rows explain an empty answer in reason and message.
• For "is this extension safe?", read riskLevel, broadHostAccess and sensitivePermissions, then establishedPublisher and lastUpdated.

Limits

• No keyword search and no reviews: the Store's robots.txt disallows both, and this Actor keeps to it.
• A category page lists at most 32 extensions; the Actor reads no further.
• users is the Store's own figure, which it rounds down (for example 22,000,000).
• The risk level reads only the manifest. It does not inspect the extension's code.
• Publishers that may be private persons have no name or links in the rows.

Questions or a field you need? Open an issue on the Actor's Issues tab.