DApp Inspector Chrome extension security report

DApp Inspector adds a DevTools panel that captures every JSON-RPC call your favorite Web3 DApps send to the connected wallet (MetaMask, Rabby, OKX, anything that exposes window.ethereum or speaks EIP-6963). ═══════════════════════════════ WHAT YOU GET ═══════════════════════════════ ▸ LIVE RPC CAPTURE Every eth_call, eth_sendTransaction, eth_signTypedData_v4, personal_sign and friend lands in the panel as it happens. Method, params, result, error, latency breakdown — all visible at a glance. ▸ CALLDATA DECODING — PASTE-FREE Built-in ABIs cover ERC-20 / 721 / 1155 / Permit2 instantly. Unknown contracts are resolved from Sourcify or 4byte.sourcify.dev with a 7-day local cache. You see the function name and named arguments — not raw 0xabcd bytes. ▸ RISK BADGES FOR THE AUDIT MOMENT About to sign? "UNLIMITED APPROVAL", "ALL TOKENS APPROVAL", and "LARGE VALUE" warnings light up before the wallet popup does. Designed for the sub-second between clicking "Confirm" in the DApp and "Sign" in the wallet. ▸ REPLAY ANY CALL One click re-fires a captured call from the panel; the wallet re-prompts as if the DApp had triggered it. Great for repro-ing flaky tx flows without touching the DApp UI. ▸ MOCK & BLOCK RULES Short-circuit selected RPC methods with canned results, errors, or latency. "What if eth_chainId returns 0x89?" — answer in 30 seconds without leaving DevTools. ▸ FILTER, SEARCH, EXPORT Filter by kind (read / write / sign / subscribe) or by status (errors / mocked / blocked / throttled / replayed). Search by method name. Copy any call as a JSON-RPC envelope or Markdown row for issues / postmortems. ▸ POLISHED CHROME Light / dark themes following the system, multiple accent palettes, EN + 中文 UI, full keyboard nav. ═══════════════════════════════ PRIVACY — LOCAL FIRST ═══════════════════════════════ Everything runs in your browser. Captured RPC traffic, settings, rules, and ABI cache are stored in chrome.storage.local on your machine — nothing is sent to any server we control. The only outbound network requests are public, unauthenticated ABI / chain-name lookups (sourcify.dev, api.4byte.sourcify.dev, chainid.network) made on demand when you open the Decoded tab on a contract / chain not yet in the local cache. You can disable these in Settings → Capture → "Auto-fetch ABI" — the extension still works fully against its built-in ABI bundle. No analytics. No telemetry. No accounts. No tracking. ═══════════════════════════════ SCOPE ═══════════════════════════════ Currently supports EVM chains (any wallet that exposes window.ethereum or implements EIP-6963). Non-EVM (Solana, etc.) is on the roadmap. ═══════════════════════════════ OPEN SOURCE ═══════════════════════════════ Source code: https://github.com/beilunyang/dapp-inspector-extension Issues, feature requests, and PRs welcome.