You issue a secret from the toolbar (Manage clients). The add-on keeps only a hash. Tools running on this computer — a local script, an editor agent, or a session you opened here (SSH, remote desktop) — call a loopback HTTP API with that secret.

Websites and in-browser agents (chatgpt.com and friends) cannot see that port. Pages inside Firefox are blocked too. If this Firefox profile syncs bookmarks with a Mozilla account, edits made here can show up on your other devices. Sync is Firefox’s feature; the API still only accepts connections on the machine running that Firefox.

What it asks for

  • bookmarks — the only WebExtension API it calls
  • storage — hashes of issued secrets, local only
  • nativeMessaging — the inbound path for those local tools

It does not request tabs, history, cookies, or access to the open web. Other add-ons cannot call it. Firefox will mention bookmark information at install because authorized local tools can read and change bookmarks. Nothing is sent to us.

Source

MIT-licensed. Source and docs live at git.easygoingaming.com/Davoguha/bookmarks-api.

Support: support@easygoinproductions.com