Bookmark ScoutPermissions
Each browser permission Bookmark Scout asks for, why it needs it, and the optional website access it requests only when you run a tool.
These are the permissions in the built extension for each browser. Bookmark Scout declares no content scripts and never reads the pages you visit; after a quick save shortcut it only shows its own notification in that tab. It asks at install only for what it cannot work without; everything else is asked for when you turn on or run the feature that needs it.
What your browser will ask, and why
When you install Bookmark Scout, the browser shows one line. Everything else is asked for only when you use the feature that needs it, after a short explanation in Bookmark Scout. If you say no, only that feature stays off. The table quotes the browsers' English wording.
| The browser says (Chrome and Edge / Firefox) | When | Why |
|---|---|---|
| "Read and change your bookmarks" / "Read and modify bookmarks" | At install | Save, search, and organize your bookmarks |
| "Read the icons of the websites you visit" (Chrome and Edge only) | You click Show browser icons on Refresh Site Icons, or turn on Use the browser's icon cache | Show the icons your browser already saved next to your bookmarks. Nothing is downloaded |
| "Read your browsing history" / "Access browser tabs" | You save the current page, or ask for folder suggestions, from the side panel | See which page you are on. The toolbar button and the quick save shortcut need no permission, so the explanation suggests them first |
| "Read and change your data on all example.com sites", or "on a number of websites" / "Access your data for sites in the example.com domain" | You run Check Dead Links, Metadata Fetcher, or Refresh Site Icons | Request the bookmarked pages of that run, on their sites only |
| "Read and change all your data on all websites" / "Access your data for all websites" | A tool run covers more than 20 sites, or you turn on Read page content | Request pages on any site |
| "Read and change your data on api.example.com" / "Access your data for api.example.com" | You click Verify Service or Refresh Models | Reach your AI provider's address |
| "Communicate with cooperating native applications" / "Exchange messages with programs other than Firefox" | You turn on Allow local AI agents | Talk to the bookmark-scout-mcp program on your computer |
| Firefox only: "The developer says the extension wants to collect: authentication information, bookmarks, browsing activity" | You turn on AI Features | Your API key, bookmarks and folder names, and the current page's title and URL go to your AI provider. "The developer" in this prompt is the AI provider you chose; Bookmark Scout receives nothing |
| Firefox only: the same prompt with "website content" | You turn on Read page content | Page text goes to your AI provider |
| Firefox only: the same prompt with "authentication information" | You click Verify Service or Refresh Models | Your API key goes to your AI provider |
| Firefox only: the same prompt with "bookmarks, browsing activity" | You turn on Allow local AI agents | What the AI agents on your computer can look up |
The right-click menu (Right-Click Menu) is optional in Chrome and Edge too, but has no warning, so the browser adds it without asking.
Granted at install
| Permission | Browsers | Why |
|---|---|---|
bookmarks | All | Show and search your bookmarks, and create, edit, move, and delete them when you act in the popup, side panel, manager, or right-click menu |
storage | All | Save your settings, and on this device only, your AI provider settings, tags, summaries, saved searches, recent folders, recent searches, and site icons saved with Refresh Site Icons |
activeTab | All | When you click the toolbar button or the right-click menu, or press a quick save shortcut, read that tab's title and URL, so you can save the page you are on. No other tabs, no history |
scripting | All | After a quick save shortcut, show the notification in that tab only. It reads nothing from the page |
sidePanel | Chrome, Edge | Provide the side panel view. Firefox declares the same page as a sidebar instead |
offscreen | Chrome, Edge | Run AI quick save's request in a hidden extension page, which the browser closes when it ends. Firefox's background page does this itself |
contextMenus | Firefox | Firefox does not let extensions ask for it later. The menu still appears only after you turn on Right-Click Menu |
In Chrome and Edge the extension also replaces the browser's bookmarks page with the Bookmark Scout manager. That is a page override, not a permission. Firefox does not allow it, so there the manager opens from Open bookmark manager in the popup; see Browser support.
Asked for when you need it
| Permission | Browsers | Asked for when |
|---|---|---|
tabs | All | You save the current page, or ask for folder suggestions, from the side panel. A short explanation comes first and offers the toolbar popup and the quick save shortcut, which never need it |
contextMenus | Chrome, Edge | You turn on Right-Click Menu in Settings. It is off by default, and Chrome grants it without a prompt |
favicon | Chrome, Edge | You click Show browser icons on Refresh Site Icons, or turn on Use the browser's icon cache in Settings, to show icons the browser has already saved. A short explanation comes first |
| Data sharing consent | Firefox | Each feature asks only for what it sends: AI Features for your API key, bookmarks, and the current page's title and URL; Read page content for page text; Verify Service for your API key. A short explanation first says the data goes to your AI provider, not to Bookmark Scout |
nativeMessaging | All | You turn on Allow local AI agents in Settings, so the extension can talk to the bookmark-scout-mcp program on your computer. A short explanation comes first; in Firefox the same prompt asks to share bookmark data with it |
If you decline, the feature stays off and nothing is sent. If you take a permission back later in the browser's extension settings, the feature turns off; turning it on again asks again.
Optional website access
The extension also declares access to http://*/* and https://*/*, but none of it is granted at install. The browser asks you at the moment you need it:
- Check Dead Links, Metadata Fetcher, and Refresh Site Icons ask, when you run them, for access to only the sites of the bookmarks in that run, each with its subdomains. A run over more than 20 sites asks for all websites instead. Sites you allowed before are not asked for again. Requests are sent without cookies, and only the page head is read for titles and icon links. If you decline, nothing is scanned. A link that redirects to a site outside the run cannot be followed, so Check Dead Links marks it Check manually instead of dead. See Find and repair dead links and Refresh site icons.
- Read page content in the AI settings asks for access to all websites when you turn it on, so AI tools can download pages, without cookies, and send their main text to your AI provider. Pages on your local network are never read. See Read page content.
- Verify Service and Refresh Models in the AI settings ask for access to that one provider's address only. See Set up AI tools.
To take access back, open the browser's page for the extension (for example chrome://extensions/, then Details on Bookmark Scout, or Permissions in Firefox's about:addons) and change its site access or permissions.
What is not requested
- No access to page content, and no declared content scripts
- No history, downloads, or cookies permissions
- No host access at install
Where your data goes when a permission is used is covered on Privacy. The justification for each permission, as submitted to the stores, is in the repository's store/permissions.md.
Last updated on