# Chrome Web Store Scraper (`sellerkit/chrome-web-store-scraper`) Actor

Chrome Web Store extensions with the permissions they ask for and the sites they can read, taken from each extension's own manifest.

- **URL**: https://apify.com/sellerkit/chrome-web-store-scraper.md
- **Developed by:** [SellerKit](https://apify.com/sellerkit) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 extensions

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Chrome Web Store Scraper

Every extension with **the permissions it asks for** and **the sites it can read**, taken from the
extension's own manifest.

![The same request gives the rating and the permissions](https://img.namubase.com/apify/chrome-web-store-scraper/01-permissions.png)

### What this gets you that the page does not show

Open any extension listing and you can see its rating, its user count and its description. What you
cannot see is the part that decides whether you would let it near a work laptop: the permission
list, the hosts it can reach, and the sites it injects code into.

That data is in the store's own response. This actor reads it, so a search for `password manager`
comes back as ten rows that each say, for example:

| | |
|---|---|
| `permissions` | `webRequest`, `scripting`, `privacy`, `browsingData`, `tabs` |
| `hostPermissions` | `<all_urls>` |
| `readsAllSites` | `true` |
| `riskFlags` | `webRequest`, `scripting`, `privacy` |

One search request returns 10 extensions with all of that. One category page returns 32.

![One request, ten extensions, every permission](https://img.namubase.com/apify/chrome-web-store-scraper/02-rows.png)

### What it returns

One row per extension:

| Field | |
|---|---|
| `extensionId` `name` `url` `iconUrl` | identity |
| `users` `rating` `reviewCount` | store numbers, and `rating` is the **unrounded** value |
| `category` `summary` `website` `publishedAt` | listing |
| `permissions` | the API permissions it asks for |
| `hostPermissions` `contentScriptMatches` `siteCount` | where it can read and where it runs |
| `optionalPermissions` | what it can ask for later |
| `readsAllSites` | `true` when it asks for `<all_urls>` or `*://*/*` |
| `riskFlags` `riskNotes` | the permissions worth a second look, each with a plain sentence |
| `manifestVersion` `minimumChromeVersion` `usesRemoteCode` | manifest facts |
| `version` `updatedAt` `size` `languages` | extension page only |
| `developer` `developerEmail` `developerAddress` `supportUrl` `privacyPolicyUrl` | extension page only |
| `relatedIds` | similar extensions, so you can walk a niche |

The rating is worth one line on its own. The store rounds it to one decimal on screen. This actor
returns what the store actually holds, so `4.5` on the page arrives here as `4.495407524238066` and
two extensions that both show `4.5` can be told apart.

### Input

```json
{
  "queries": ["password manager"],
  "maxItems": 100,
  "includeDetails": false,
  "readsAllSitesOnly": false,
  "requirePermissions": []
}
```

You can also pass `categories` (`make_chrome_yours/privacy`, `productivity/communication`, or the
full category URL) or `extensionIds` (the 32 character id, or the full store URL).

`readsAllSitesOnly`, `requirePermissions`, `minUsers` and `minRating` filter before anything is
written, so the rows you did not want are never saved and never charged.

### What a single run looks like

![37 of 40 extensions could read every site](https://img.namubase.com/apify/chrome-web-store-scraper/03-run.png)

Those numbers are from one run of this actor: the Privacy and security category plus a search for
"password manager", 40 extensions in total. **37 of the 40** asked to read every site you visit,
**8** can see and disable your other extensions, and **6** can talk to a program installed on the
machine. It is a permission heavy corner of the store by nature, which is the point: you can now
measure that instead of assuming it.

### Uses this was built for

- **Extension review before allowlisting.** Pull a category, keep the rows where `readsAllSites` is
  true, and you have the shortlist that needs a human.
- **Watching an extension you already trust.** `version`, `updatedAt` and the permission list in one
  row. A permission that appears in an update is the thing you want to catch.
- **Market research.** Users, unrounded rating, review count and category, per extension.

### Pricing

Charged **per row that reaches the dataset**, not per minute of compute. A run that finds nothing
costs nothing. Opening the extension page is a second event, charged only for the rows where it
worked.

### Notes

- The store answers plain requests, so runs are quick and a proxy is optional.
- Manifest version 2 extensions list host access in the same field as API permissions. This actor
  splits them, so `permissions` and `hostPermissions` mean the same thing whether the extension is
  MV2 or MV3.
- One extension that fails to load does not stop the run. It is recorded in `RUN_SUMMARY` with the
  reason, and the rest still come back. `RUN_SUMMARY` also counts how many rows carried a manifest.
- A search page returns 10 extensions and a category page returns 32. To go wider, pass several
  search terms or categories, or turn on `includeRelated` to walk the similar extensions.

# Actor input Schema

## `queries` (type: `array`):

Chrome Web Store search terms, for example "password manager". One search returns 10 extensions, each with its permissions.

## `categories` (type: `array`):

Category paths such as make\_chrome\_yours/privacy or productivity/communication, or the full category URL. One category page returns 32 extensions.

## `extensionIds` (type: `array`):

Specific extensions, for example kbfnbcaeplbcioakkpcpgfkobkghlhen or the full store URL. These always read the extension page, so they carry the developer contact, version, size and languages.

## `maxItems` (type: `integer`):

Stop after this many unique extensions. This is also the cap on what you can be charged.

## `includeDetails` (type: `boolean`):

Adds version, last updated date, size, languages, developer email and address, support and privacy policy URLs. One extra request per extension, charged as a separate event.

## `includeRelated` (type: `boolean`):

Each extension page lists similar extensions. Turn this on to walk them, which is a quick way to map a niche.

## `readsAllSitesOnly` (type: `boolean`):

Keeps extensions asking for \<all\_urls> or *://*/\*. Filtered rows are never saved, so they are never charged.

## `requirePermissions` (type: `array`):

For example cookies, nativeMessaging, debugger, history. A row is kept when it asks for any one of them.

## `minUsers` (type: `integer`):

Skip extensions below this user count.

## `minRating` (type: `integer`):

Skip extensions rated below this.

## `proxyConfiguration` (type: `object`):

Optional. The store answers plain requests, so a proxy is only useful for long runs.

## Actor input object example

```json
{
  "queries": [
    "password manager"
  ],
  "maxItems": 100,
  "includeDetails": false,
  "includeRelated": false,
  "readsAllSitesOnly": false,
  "minUsers": 0,
  "minRating": 0,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `extensions` (type: `string`):

One row per extension: identity, users, exact rating, category, and the full permission picture.

## `extensionsCsv` (type: `string`):

The same rows as a spreadsheet.

## `runSummary` (type: `string`):

How many rows came back, how many carried a manifest, how many were filtered out, and every extension that could not be read.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "queries": [
        "password manager"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("sellerkit/chrome-web-store-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "queries": ["password manager"] }

# Run the Actor and wait for it to finish
run = client.actor("sellerkit/chrome-web-store-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "queries": [
    "password manager"
  ]
}' |
apify call sellerkit/chrome-web-store-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,sellerkit/chrome-web-store-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Q62X67oTbzVsM0Ozr/builds/zekBrYgOMfr4612VR/openapi.json