
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
MCP server for Chrome Web Store extension management. Upload, publish, and manage Chrome extensions directly from Claude Code or any MCP client.
Use this MCP when you need to:
upload tool to push it as a draftpublish to submit for review and go livestatus to see review state, version, and deploy percentageupdate-metadata-ui to change store listing detailscancel to withdraw a submission under reviewpublish with staged rollout, then deploy-percentage to ramp up| Tool | Description |
|---|---|
upload | Upload a ZIP file to Chrome Web Store (update existing item draft) |
publish | Publish an extension with optional staged rollout, publish type, and skip-review |
status | Fetch the current status including review state, deploy percentage, and version |
cancel | Cancel a pending submission |
deploy-percentage | Set staged rollout percentage (0-100, must exceed current target) |
get | Read draft/published listing metadata (v1.1 API, deprecated Oct 2026) |
update-metadata | Update listing metadata via v1.1 API (deprecated Oct 2026) |
update-metadata-ui | Update listing metadata via dashboard UI automation (Playwright) |
This MCP server covers all Chrome Web Store API v2 endpoints:
| v2 Endpoint | MCP Tool |
|---|---|
media.upload | upload |
publishers.items.publish | publish |
publishers.items.fetchStatus | status |
publishers.items.cancelSubmission | cancel |
publishers.items.setPublishedDeployPercentage | deploy-percentage |
Additionally, v1.1 API endpoints are available for metadata operations (get, update-metadata), with dashboard UI automation (update-metadata-ui) as the recommended alternative since v1 is deprecated.
# Open in browser to get authorization code
open "https://accounts.google.com/o/oauth2/auth?response_type=code&scope=https://www.googleapis.com/auth/chromewebstore&client_id=YOUR_CLIENT_ID&redirect_uri=urn:ietf:wg:oauth:2.0:oob"
# Exchange code for refresh token
curl -X POST https://oauth2.googleapis.com/token \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "code=YOUR_AUTH_CODE" \
-d "grant_type=authorization_code" \
-d "redirect_uri=urn:ietf:wg:oauth:2.0:oob"
Add to your Claude Code MCP settings (~/.claude/settings.local.json):
{
"mcpServers": {
"cws-mcp": {
"command": "node",
"args": ["/path/to/cws-mcp/dist/index.js"],
"env": {
"CWS_CLIENT_ID": "xxxxx.apps.googleusercontent.com",
"CWS_CLIENT_SECRET": "GOCSPX-xxxxx",
"CWS_REFRESH_TOKEN": "1//xxxxx",
"CWS_PUBLISHER_ID": "me",
"CWS_ITEM_ID": "your-extension-id"
}
}
}
}
Or install globally via npm:
{
"mcpServers": {
"cws-mcp": {
"command": "npx",
"args": ["-y", "cws-mcp"],
"env": { ... }
}
}
}
| Variable | Required | Description |
|---|---|---|
CWS_CLIENT_ID | Yes | Google OAuth2 Client ID |
CWS_CLIENT_SECRET | Yes | Google OAuth2 Client Secret |
CWS_REFRESH_TOKEN | Yes | OAuth2 Refresh Token |
CWS_PUBLISHER_ID | No | Publisher ID (default: me) |
CWS_ITEM_ID | No | Default extension item ID |
CWS_DASHBOARD_PROFILE_DIR | No | Browser profile path for UI automation (default: ~/.cws-mcp-profile) |
Use the cws-mcp status tool
1. Use cws-mcp upload with zipPath="/path/to/extension.zip"
2. Use cws-mcp publish
Use cws-mcp publish with:
- publishType="STAGED_PUBLISH"
- deployPercentage=10
Use cws-mcp publish with skipReview=true
Use cws-mcp update-metadata with:
- title="Pexus"
- summary="Official wallet for Plumise"
- description="..."
- category="productivity"
- defaultLocale="en"
Use cws-mcp update-metadata with metadata={
"homepageUrl": "https://plumise.com",
"supportUrl": "https://plug.plumise.com/docs"
}
Use cws-mcp update-metadata-ui with:
- title
- summary
- description
- category
- homepageUrl
- supportUrl
Notes:
headless=false if login is required.~/.cws-mcp-profile (override with CWS_DASHBOARD_PROFILE_DIR).1. Use cws-mcp publish
2. Use cws-mcp deploy-percentage with percentage=10
3. Use cws-mcp deploy-percentage with percentage=50
4. Use cws-mcp deploy-percentage with percentage=100
Note: deploy-percentage is only available for extensions with 10,000+ seven-day active users. The new percentage must always be higher than the current target.
The get and update-metadata tools use the Chrome Web Store v1.1 API, which is deprecated and will be removed after October 15, 2026. The v2 API does not provide metadata read/write endpoints, so these tools remain available as a bridge. Use update-metadata-ui (Playwright dashboard automation) as the long-term alternative.
MIT
FAQs
MCP server for Chrome Web Store extension management
The npm package cws-mcp receives a total of 42 weekly downloads. As such, cws-mcp popularity was classified as not popular.
We found that cws-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.