Davoguha/bookmarks-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep client secrets in add-on storage; host only verifies and serves the local API.

Browse Source
This commit is contained in:
alexveley
2026-09-22 07:42:10 -04:00
parent de0814f3ed
commit 41c83dabac
13 changed files with 185 additions and 290 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8 -8
View File
@@ -1,23 +1,23 @@
# Bookmarks API for Scripting and AI
A Firefox add-on that lets **local** scripts and agents call an allowlisted `browser.bookmarks` API — after you issue them a secret from inside the browser.
An API add-on for Firefox to allow agentic and script-based management of user bookmarks.
The published product is the add-on in `extension/`. It does not ship helper scripts. Callers use ordinary HTTP and a Bearer token, stored however they already keep secrets.
The published product is the add-on in `extension/`. Issue a secret in **Manage clients**, store it with your secrets, and keep Firefox open. A separately installed native host is what accepts those local calls. The options page does not need the host.
This is not a bookmark sync engine, and it is not a Mozilla product. Mozilla’s add-on naming rule is “Name for Firefox,” never “Firefox Name”; this listing uses neither form in the title.
This is not a bookmark sync engine, and it is not a Mozilla product.
## Setup
1. Register the native host once (`tools/install-native-host.ps1` on this workstation).
2. Load the add-on (temporary via `about:debugging`, or a signed `.xpi` — [docs/signing.md](docs/signing.md)).
3. Toolbar icon → **Manage clients** → generate a secret → store it with your secrets.
1. Load the add-on (temporary via `about:debugging`, or a signed `.xpi` — [docs/signing.md](docs/signing.md)).
2. Toolbar → **Manage clients** → generate a secret → store it with your secrets.
3. To let scripts call in, register the native host once (`tools/install-native-host.ps1` on this workstation).
While Firefox is open, `http://127.0.0.1:17634/health` answers if the host is up. Authenticated calls use `Authorization: Bearer <secret>` on `/v1/call`. Method list: the repo [AGENTS.md](AGENTS.md) (for people working on this codebase, not for the AMO listing).
Authenticated calls use `Authorization: Bearer <secret>` on `http://127.0.0.1:17634`. Method list for people working in this repo: [AGENTS.md](AGENTS.md).
## Security
- Binds **127.0.0.1** only. Browser `Origin` headers are rejected.
- Each caller is an issued token. The add-on stores a hash, not the secret.
- Client hashes live in the add-on’s storage. The host asks the add-on whether a token is valid.
- Only `bookmarks.*` (plus `meta.*`). No history, cookies, tabs, or `onMessageExternal`.
## License