bookmarks-api/README.md

Bookmarks API for Scripting and AI

A Firefox add-on that lets local scripts and agents call an allowlisted browser.bookmarks API — after you issue them a secret from inside the browser.

The published product is the add-on in extension/. It does not ship helper scripts. Callers use ordinary HTTP and a Bearer token, stored however they already keep secrets.

This is not a bookmark sync engine, and it is not a Mozilla product. Mozilla’s add-on naming rule is “Name for Firefox,” never “Firefox Name”; this listing uses neither form in the title.

Setup

1. Register the native host once (tools/install-native-host.ps1 on this workstation).
2. Load the add-on (temporary via about:debugging, or a signed .xpi — docs/signing.md).
3. Toolbar icon → Manage clients → generate a secret → store it with your secrets.

While Firefox is open, http://127.0.0.1:17634/health answers if the host is up. Authenticated calls use Authorization: Bearer <secret> on /v1/call. Method list: the repo AGENTS.md (for people working on this codebase, not for the AMO listing).

Security

• Binds 127.0.0.1 only. Browser Origin headers are rejected.
• Each caller is an issued token. The add-on stores a hash, not the secret.
• Only bookmarks.* (plus meta.*). No history, cookies, tabs, or onMessageExternal.

License

MIT.