Extenshi MCP server — bring the extension catalog (search, security, market research) and pre-publish scanning into your AI tools
Extenshi MCP has 21 tools with consistent naming (verb_noun pattern) and reasonable descriptions (avg ~120 chars). However, critical gaps exist: input schemas are not visible in the provided source code excerpt, parameter descriptions are largely absent, and output schemas are undocumented. The tools.ts file shows tool bodies but not explicit schema registration. Error handling is minimal, most tools lack recovery guidance. Security is well-designed (identity-agnostic, no secrets in params), and composition is sound (single responsibility per tool). The server instructions are comprehensive, but tool-level documentation falls short of production standards.
Generate icon workflow (free; no key)
Generate welcome page workflow (free; no key)
Check the user's credit balance
Get the development guide listing every tool, service directory, account/local prerequisites, documentation links, GitHub repository guidance and the ordered plan from scope and research through code, assets, privacy, CI, store release and maintenance
Get detailed information about a specific extension
Get a privacy policy (hosted; Pro)
Input schemas not visible in source code. No explicit parameter type definitions, constraints, or descriptions found for any of the 21 tools. Schema registration code is absent from the provided excerpt.
Output schemas undocumented. No tool describes what fields it returns, their types, or structure. LLMs cannot plan downstream calls or extract required data without documented return types.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2025-06-18+ | v2 |
Get project scaffold for a new project
Get the current state of a project
Get reviews for an extension
Get risk assessment for up to 40 extensions by store IDs
Get security findings for an extension
List available extension templates
List projects associated with the user's account
List privacy policies (hosted; Pro)
Get market overview and statistics
Publish an extension to the store (local creds; stdio only)
Publish a privacy policy (hosted; Pro)
Scan a local extension artifact for security issues (local artifact; stdio only)
Search product documentation and CLI commands (free; no key required)
Search the extension catalog
Update privacy policy with AI assistance and return a proposal to review (hosted; Pro)
Parameter descriptions missing. Tool bodies reference parameters (e.g., store_ids, project_id, policy_id) but no descriptions explain what they control, valid formats, or constraints. LLMs cannot infer parameter semantics from names alone.
Error handling lacks recovery guidance. Tools reference error types (ScanError, PublishSetupError, DocsError) but descriptions do not explain what to do on failure, whether errors are retryable, or what the LLM should try next.
Pagination not documented. Tools like search_extensions and list_my_projects likely return lists but descriptions do not mention limit, offset, page, or cursor parameters, or whether results are capped.