Local diagnostics for chrome extension manifest.json — flags MV3 leftovers, broad host_permissions, and CSP footguns before you ship to the Chrome Web Store.
Installation
Launch VS Code Quick Open (Ctrl+P), paste the following command, and press enter.
Local VS Code diagnostics that flag Chrome Web Store / MV3 footguns in manifest.jsonbefore you zip — broad host_permissions, CSP holes, and MV2 leftovers (background.scripts, browser_action).
Not a JSON schema pack. Peer listings bind autocomplete schemas; Policy Guard audits semantic policy into the Problems panel.
Runs fully offline. No network, no telemetry, no accounts.
60-second win
Open a Chrome extension manifest.json with browser_action, background.scripts, or "<all_urls>".
Open Problems — see MP001–MP005.
Fix the key (quick-fix available for browser_action / page_action → action) → diagnostics clear on save.
Optional: Policy Guard: Rescan Workspace Manifests from the Command Palette, or click the status bar when a manifest is focused.
Rules (v1)
Code
Check
Severity
Fix
MP001
MV3 still has background.scripts or background.page
Error
Use background.service_worker
MP002
MV3 still has browser_action or page_action
Error
Rename to action (quick-fix)
MP003
host_permissions / permissions contains <all_urls> or *://*/*
Warning
Prefer narrow host matches
MP004
CSP contains unsafe-eval or remote script-src
Warning
Tighten CSP for CWS remote-code rules
MP005
MV3 background object without service_worker
Error
Add service_worker
Settings
Setting
Purpose
mv3PolicyGuard.include
Globs to find manifests (default **/manifest.json)
mv3PolicyGuard.exclude
Skip node_modules / build folders
mv3PolicyGuard.rules.MP00N.enabled
Turn a rule on/off
mv3PolicyGuard.rules.MP00N.severity
Override severity (default keeps the rule default)
