Privacy Policy & Chrome Web Store Data Disclosure
WebMCP Vault Kit (@gyga-browser/webmcp-vault-kit) and the WebMCP Vault Companion Chrome Extension operate on a strict 100% offline, local-first architecture. Zero personal data or credentials ever leave your machine.
1. Zero Data Collection Guarantee
Neither the WebMCP Vault Kit CLI/daemon nor the WebMCP Vault Companion browser extension collects, transmits, sells, or logs any user data to external servers, cloud databases, or analytics providers.
No Cloud Sync
All encrypted credentials, FIDO2 passkey keys, and TOTP seeds reside strictly inside ~/.webmcp/vault/credentials.enc.json on your local disk with 0600 permissions.
No Telemetry or Tracking
The extension contains zero analytics SDKs, zero crash reporters, and zero external network calls beyond your local loopback interface.
No Plaintext in Browser Storage
Passwords, passkeys, and TOTP secrets are never saved inside chrome.storage.local, chrome.storage.sync, or page localStorage.
2. Chrome Web Store Permission Justifications
The WebMCP Vault Companion extension requests the minimum set of Manifest V3 permissions required to perform local WebAuthn passkey ceremonies and credential autofill:
storage
Local Preferences Only
Used exclusively to persist two non-sensitive preferences in chrome.storage.local: the local Vault loopback port URL (webmcp_vault_url, defaulting to http://127.0.0.1:7876) and the boolean toggle for login form auto-save prompts (webmcp_vault_autosave).
tabs
Origin & RP ID Verification
Used to inspect the active tab's URL and hostname so the extension can verify the WebAuthn Relying Party ID (rpId) against phishing, display the badge count of matching local accounts for the current domain, and send user-triggered autofill messages to the top frame (frameId: 0).
http://127.0.0.1/* & http://localhost/*
Local Loopback Bridge
Allows the extension's background service worker to query the user's self-hosted WebMCP Vault daemon running locally on 127.0.0.1:7876. No external remote hosts are contacted.
content_scripts (<all_urls>)
Isolated Autofill & WebAuthn Shim
Required because login forms and FIDO2 WebAuthn challenges (navigator.credentials.get and navigator.credentials.create) can occur on any website. Password and 2FA TOTP DOM injection runs strictly inside Chrome's ISOLATED world so page scripts cannot access plaintext credentials.
3. Cryptographic Storage Specification
Your local vault file is encrypted at rest using authenticated AES-256-GCM with a fresh 12-byte random IV and 16-byte authentication tag on every write. Encryption keys are derived in memory using scrypt (N=16384, r=8, p=1, 32-byte key length) from your unlock key file (WEBMCP_VAULT_KEY_FILE). The unlock key is never written to disk by the vault process.
4. Open Source Verification & Contact
The complete source code for both the CLI/Server package and the Chrome Extension is publicly auditable under the MIT License at github.com/uyencss/webmcp-vault-kit. For security inquiries or support, please open an issue on the GitHub repository.