HeaderLab Chrome extension security report

HeaderLab sets, appends and removes HTTP request and response headers on the sites you choose, using Chrome's own declarativeNetRequest engine. It holds no access to any site until you grant it. WHAT IT DOES • Set, append or remove any header, on the request side or the response side. • Scope by site. Sites are matched by host, so what the popup shows is what goes on the wire. • Apply everywhere, as an explicit mode. It costs access to all sites, and the switch does not ask for it — a separate Grant button does. • Filter by request type. Eight of Chrome's resource types, each its own checkbox, main_frame included — which Chrome's own default quietly leaves out. • Pause everything with one switch. The toolbar icon greys out to match, and stays grey across a restart. DRIVE IT FROM AN AI CODING AGENT HeaderLab ships an optional command line tool and a skill for Claude Code and Codex, so an agent can read and change your header rules while it works. Ask in your own words — add an X-Debug header and scope it to staging.example.com, or stop sending Referer to the API — and the result appears in the popup as if you had typed it there. It costs you no control: the bridge stays off until you flip its switch in the popup, the tool can neither turn itself on nor grant a site — Chrome takes both only from your own click — and it talks over a local socket, never a network. WHAT IT DOES NOT DO • No network calls. No analytics, no telemetry, no remote configuration, no update pings. • No content scripts. Nothing is injected into any page, and the extension never sees a page's contents. • No remote code, no CDN, no web fonts, no remote images. Nothing is fetched from outside the package. • Nothing leaves your machine. Your rules live in Chrome's own extension storage. https://github.com/say8425/headerlab Open source, Apache-2.0.