You issue a secret from the toolbar (Manage clients). The add-on keeps only a hash. Tools running on this computer — a local script, an editor agent, or a session you opened here (SSH, remote desktop) — call a loopback HTTP API with that secret.
Websites and in-browser agents (chatgpt.com and friends) cannot see that port. Pages inside Firefox are blocked too. If this Firefox profile syncs bookmarks with a Mozilla account, edits made here can show up on your other devices. Sync is Firefox’s feature; the API still only accepts connections on the machine running that Firefox.
What it asks for
bookmarks— the only WebExtension API it callsstorage— hashes of issued secrets, local onlynativeMessaging— the inbound path for those local tools
It does not request tabs, history, cookies, or access to the open web. Other add-ons cannot call it. Firefox will mention bookmark information at install because authorized local tools can read and change bookmarks. Nothing is sent to us.
Source
MIT-licensed. Source and docs live at git.easygoingaming.com/Davoguha/bookmarks-api.
Support: support@easygoinproductions.com