# Browser Extension Permission & Risk Monitor (`sashaebashu/firefox-ext-risk`) Actor

Audit Firefox extensions: what permissions they request, what data they declare collecting, a documented risk score — and an alert when an extension you trust quietly asks for more.

- **URL**: https://apify.com/sashaebashu/firefox-ext-risk.md
- **Developed by:** [Sasha Ebashu](https://apify.com/sashaebashu) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Browser Extension Permission & Risk Monitor

An extension you installed last year can ask for more power in its next update, and nothing in the
browser tells you. This Actor reads what Firefox add-ons actually request — **permissions, site
access and declared data collection** — scores the risk, and reports **when those permissions last
changed**.

Built on Mozilla's public add-ons API. No key, no login, no scraping.

### What makes it useful on the first run

Most "monitors" can only tell you about a change after they have seen the thing twice. Mozilla
publishes permissions **per version**, so this one reads the version history and reports the last
permission change immediately — which version added what, and when.

Example from a live run: *Tampermonkey — last permission change in v5.5.0 (2026‑05‑21), added
`contextualIdentities`.* No second run required.

### Risk scoring, and why you can trust the number

The score is a published formula, not a black box. It ranks what an extension could **do**:

| Signal | Points |
|---|---|
| Access to every website (`<all_urls>`, `*://*/*`, `http://*/*`, `https://*/*`) | 40 |
| `nativeMessaging` — can hand data to a program outside the browser | 25 |
| `proxy` — can route all your traffic | 25 |
| `debugger` — can drive any page | 25 |
| `webRequestBlocking` — can rewrite traffic in flight | 15 |
| `webRequest`, `cookies`, `history`, `management` | 10 each |
| `clipboardRead` | 8 |
| `browsingData`, `bookmarks`, `downloads`, `privacy`, `identity`, `geolocation`, `topSites` | 5 each |
| `tabs`, `scripting` | 3 each |
| Each declared data-collection type (other than "none") | 10 each |
| Access to named sites only (not the whole web) | 1 each, capped at 10 |

`low` under 20 · `medium` 20–49 · `high` 50+. `riskReasons` spells out what drove the number.

**A high score is not an accusation.** uBlock Origin scores 73 because a content blocker genuinely
needs to see every request — and it is Mozilla-recommended, which the output also tells you
(`isRecommended`). The score measures capability; you supply the judgement about whether this
extension should have it.

### Monitor mode

| `changeType` | Means |
|---|---|
| **`permissions_added`** | It now asks for something it did not before — the event this exists for |
| `permissions_removed` | It gave something up |
| `version_change` | New version, same permissions |
| `risk_change` | The score moved for another reason |
| `new` | First time seen in this scope |
| `unchanged` | Nothing moved |

### Input

| Field | What it does |
|---|---|
| **Extensions** | Slugs, full addons.mozilla.org URLs or GUIDs — paste whatever you have. |
| **Search query** / **Category** / **Sort** | Discover extensions instead of naming them. |
| **Minimum daily users** | Useful when auditing what an organisation actually runs. |
| **Detect the last permission change** | Reads version history. One extra request per extension. |
| **Monitor mode / Output only changed** | The alert behaviour above. |

### Notes & limits

Properties of the source, measured rather than assumed:

- **Site access hides in two different fields.** Under manifest v2 host permissions sit inside
  `permissions`; under v3 they move to `host_permissions`. In the top 50 add-ons `<all_urls>`
  appears in `permissions` **28 times** and in `host_permissions` only **4 times** — so reading
  just the v3 field would miss full-web access on most extensions. Both are read and merged.
- **"Declares nothing" and "declared none" are different, and both appear.** `["none"]` is an
  explicit promise to collect nothing; an empty or absent field is simply no declaration —
  41 of the top 50 have none at all. `declaresDataCollection` is true only when something was
  actually declared, so silence is never reported as a promise.
- **Permission counts vary wildly**: median 13 in the top 50, maximum 397. A long list is not
  automatically dangerous, which is why the score weights permissions rather than counting them.
- **An unknown slug is reported, not guessed.** A missing add-on answers HTTP 404 and is logged as
  "check the slug" instead of silently disappearing from the output.
- The Actor honours your **Maximum cost per run** and stops when the cap is reached.

# Actor input Schema

## `extensions` (type: `array`):

Add-on slugs, full addons.mozilla.org URLs or GUIDs — paste whatever your browser shows. Leave empty to discover extensions with the search below.

## `searchQuery` (type: `string`):

Discover extensions by keyword instead of naming them. Ignored when Extensions is filled.

## `category` (type: `string`):

Mozilla category slug, e.g. privacy-security, shopping, search-tools.

## `sort` (type: `string`):

Order for discovered extensions. Only applies when you search or browse a category rather than naming extensions.

## `minDailyUsers` (type: `integer`):

Skip extensions below this install base — useful when auditing what your organisation actually runs.

## `maxItems` (type: `integer`):

How many extensions to report.

## `includePermissionHistory` (type: `boolean`):

Reads the version history and reports when permissions last changed, with what was added or removed. Works on the FIRST run — you do not have to wait for a second one. Costs one extra request per extension.

## `maxVersionsToScan` (type: `integer`):

How far back to look for the last permission change.

## `maxConcurrency` (type: `integer`):

How many extensions to fetch in parallel. Each one costs a detail request plus, if enabled, a version-history request.

## `monitorMode` (type: `boolean`):

Compare against the previous run over the same input and label every extension: permissions\_added, permissions\_removed, version\_change, risk\_change, new, unchanged.

## `onlyChanges` (type: `boolean`):

Monitor mode only — return just what moved.

## Actor input object example

```json
{
  "extensions": [
    "ublock-origin",
    "https://addons.mozilla.org/firefox/addon/darkreader/"
  ],
  "searchQuery": "vpn",
  "category": "privacy-security",
  "sort": "users",
  "minDailyUsers": 0,
  "maxItems": 50,
  "includePermissionHistory": true,
  "maxVersionsToScan": 10,
  "maxConcurrency": 5,
  "monitorMode": false,
  "onlyChanges": false
}
```

# Actor output Schema

## `overview` (type: `string`):

No description

## `alerts` (type: `string`):

No description

## `permissions` (type: `string`):

No description

## `full` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "extensions": [
        "ublock-origin"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("sashaebashu/firefox-ext-risk").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "extensions": ["ublock-origin"] }

# Run the Actor and wait for it to finish
run = client.actor("sashaebashu/firefox-ext-risk").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "extensions": [
    "ublock-origin"
  ]
}' |
apify call sashaebashu/firefox-ext-risk --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,sashaebashu/firefox-ext-risk"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/tai4Sscu1rANLAQrQ/builds/8xYlz1fn3Cp0mXz0f/openapi.json