# Chrome Web Store Intelligence & Permission-Risk Scraper (`tactful_anvil/chrome-web-store-intelligence-scraper`) Actor

Scrape Chrome Web Store extensions: ratings, users, versions, developer, and manifest permissions with a 0-100 permission-risk score. Input IDs, search queries, or categories. $2.40/1,000. HTTP-only, no login, no key.

- **URL**: https://apify.com/tactful\_anvil/chrome-web-store-intelligence-scraper.md
- **Developed by:** [Mr Zack](https://apify.com/tactful_anvil) (community)
- **Categories:** Developer tools, Automation, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.40 / 1,000 extension results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Chrome Web Store Intelligence & Permission-Risk Scraper

Scrape any Chrome Web Store extension — **ratings, user counts, versions, developer, category, size, languages, and the full manifest permission list** — plus a **0–100 permission-risk score** that no other Chrome Web Store scraper on Apify gives you. **$2.40 / 1,000 extensions.** HTTP-only, no login, no API key, no browser.

### Who this is for

- **Extension developers** tracking competitor ratings, user growth, versions, and update cadence.
- **Security & IT teams** auditing which extensions request broad host access, `cookies`, `debugger`, `nativeMessaging`, or other sensitive permissions — before allowing them in the org.
- **Acquirers & investors** screening extensions by users, rating, freshness, and abandonment risk.
- **Market researchers** mapping a whole category (productivity, privacy, AI, …) in one run.

### What makes it different

Most Chrome Web Store scrapers give you a listing snapshot. This one adds a **transparent permission-risk model**:

- Extracts `permissions`, `host_permissions`, and `optional_permissions` straight from the extension's embedded manifest (handles both Manifest V2 and V3).
- Scores each extension **0–100** by how much user-data exposure and system control it requests: broad host access (`<all_urls>`, `*://*/*`), `debugger`, `nativeMessaging`, `proxy`, `management`, `cookies`, `webRequest`, `history`, `tabs`, `scripting`, and more.
- Labels every extension **low / medium / high / critical** and lists human-readable **risk flags** (`broad_host_access`, `reads_cookies`, `injects_scripts`, …) so you can see *why*.
- Flags **abandoned** extensions (no update in over a year) — a common security and quality red flag.

The weights are documented and auditable; nothing is a black box.

### Three ways to choose extensions

1. **Extension URLs or IDs** — paste Chrome Web Store URLs or bare 32-character IDs.
2. **Search queries** — every extension on the results page is discovered and scraped.
3. **Categories** — enumerate a category path such as `extensions/productivity/tools` or `extensions/lifestyle`.

Mix all three in one run. `maxExtensions` caps the total.

### Fair, predictable pricing

You pay **$0.0024 per extension pushed** ($2.40 / 1,000) plus a $0.01 actor start.

- Extensions removed by your filters (`minUsers`, `minRating`, `onlyRiskLevels`, `requireBroadHostAccess`) are **never pushed, so never charged**.
- Duplicate IDs across your inputs are de-duplicated and charged once.
- Not-found or unparseable extensions are skipped and not charged.

### Output (one row per extension)

| Field | Example |
|---|---|
| `extensionId` | `ddkjiahejlhfcafbddmgiahcphecmpfh` |
| `name` | `uBlock Origin` |
| `url` | `https://chromewebstore.google.com/detail/…` |
| `developer` / `developerEmail` | `Raymond Hill (gorhill)` / `ubo@…` |
| `category` | `privacy` |
| `rating` / `ratingCount` | `4.7` / `35450` |
| `userCount` | `11000000` |
| `version` | `1.74.0` |
| `lastUpdatedAt` / `lastUpdatedDays` | `2026-08-25T16:03:53Z` / `0.3` |
| `isAbandoned` | `false` |
| `size` | `4.38MiB` |
| `manifestVersion` | `3` |
| `apiPermissions` | `["scripting","tabs","cookies"]` |
| `hostPermissions` | `["https://*/*"]` |
| `permissionRiskScore` | `86` |
| `riskLevel` | `critical` |
| `riskFlags` | `["broad_host_access","reads_cookies"]` |
| `hasBroadHostAccess` | `true` |

A **SUMMARY** record (in the run's key-value store) rolls up the run: extension count, average rating, risk-level distribution, broad-host-access count, abandoned count, and the most common permissions.

### Example input

```json
{
  "searchQueries": ["password manager"],
  "categories": ["extensions/productivity/tools"],
  "maxExtensions": 200,
  "minUsers": 10000,
  "onlyRiskLevels": ["high", "critical"]
}
```

This returns only the higher-risk, reasonably-popular extensions across the search and the category — the exact shortlist a security reviewer wants.

### How to schedule this actor (run it on autopilot)

Extension ratings, user counts, versions, and permissions change constantly — and new extensions appear every day. Put this actor on a schedule so you always have fresh intelligence:

1. Open the actor in Apify Console and click **Schedules** (or go to **Schedules → Create new**).
2. Add this actor and pick a cadence — **daily** is ideal for tracking a category or a competitor set.
3. Save your input (your watchlist of IDs, search queries, or categories) as a **task**, then attach the task to the schedule.
4. Connect the dataset to Google Sheets, Slack, or a webhook via **Integrations** to get a fresh report or an alert whenever a tracked extension changes version, spikes in users, or adds a risky permission.

A daily schedule over a fixed watchlist lets you diff runs and catch permission changes the moment they ship.

### Notes

- **HTTP-only, no residential proxy.** Every field comes from the public detail, search, and category pages — no login, no token, no headless browser.
- **Polite by default.** A configurable delay (`politenessMs`) sits between requests.
- Reviews text is intentionally out of scope — this actor is about **listing intelligence and permission risk**. Developer replies and full review corpora are not published by the Chrome Web Store the way they are on Google Play, so we don't fabricate them.

# Actor input Schema

## `extensionUrls` (type: `array`):

Chrome Web Store extension URLs or bare 32-character IDs to scrape directly.

## `searchQueries` (type: `array`):

Free-text Chrome Web Store searches. Every extension on the results page is discovered and scraped (subject to Max extensions).

## `categories` (type: `array`):

Category paths to enumerate, e.g. "extensions/productivity/tools" or "extensions/lifestyle". A full category URL works too.

## `maxExtensions` (type: `integer`):

Hard cap on how many extensions to scrape this run (across all inputs).

## `minUsers` (type: `integer`):

Skip extensions with fewer than this many users. Skipped rows are never charged.

## `minRating` (type: `integer`):

Skip extensions rated below this (0–5). Skipped rows are never charged.

## `onlyRiskLevels` (type: `array`):

Keep only extensions whose permission-risk level is in this list (low, medium, high, critical). Filtered-out rows are never charged.

## `requireBroadHostAccess` (type: `boolean`):

Keep only extensions that can read/modify data on all sites (\<all\_urls> or *://*/\*). Filtered-out rows are never charged.

## `politenessMs` (type: `integer`):

Pause between page fetches to stay polite to the Chrome Web Store.

## Actor input object example

```json
{
  "extensionUrls": [
    "https://chromewebstore.google.com/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh",
    "https://chromewebstore.google.com/detail/grammarly-ai-writing-assi/kbfnbcaeplbcioakkpcpgfkobkghlhen"
  ],
  "searchQueries": [],
  "categories": [],
  "maxExtensions": 100,
  "minUsers": 0,
  "minRating": 0,
  "onlyRiskLevels": [],
  "requireBroadHostAccess": false,
  "politenessMs": 700
}
```

# Actor output Schema

## `extensions` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "extensionUrls": [
        "https://chromewebstore.google.com/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh",
        "https://chromewebstore.google.com/detail/grammarly-ai-writing-assi/kbfnbcaeplbcioakkpcpgfkobkghlhen"
    ],
    "searchQueries": [],
    "categories": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("tactful_anvil/chrome-web-store-intelligence-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "extensionUrls": [
        "https://chromewebstore.google.com/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh",
        "https://chromewebstore.google.com/detail/grammarly-ai-writing-assi/kbfnbcaeplbcioakkpcpgfkobkghlhen",
    ],
    "searchQueries": [],
    "categories": [],
}

# Run the Actor and wait for it to finish
run = client.actor("tactful_anvil/chrome-web-store-intelligence-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "extensionUrls": [
    "https://chromewebstore.google.com/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh",
    "https://chromewebstore.google.com/detail/grammarly-ai-writing-assi/kbfnbcaeplbcioakkpcpgfkobkghlhen"
  ],
  "searchQueries": [],
  "categories": []
}' |
apify call tactful_anvil/chrome-web-store-intelligence-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tactful_anvil/chrome-web-store-intelligence-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/vfCTVI3efVqV0Z9TC/builds/dvhwmVZauJWjoQsgZ/openapi.json