Open Claude in Chrome

The README openly states that file_upload does not restrict sources to session-shared paths and accepts any absolute path on the machine, and it deliberately removes the official extension's 58-domain blocklist (banking, brokerage, payments, crypto wallets, gambling, adult, dating). That is intentional permission amplification rather than least privilege. For user confirmation, apart from update_plan and the recording flow, no mandatory confirmation gate is shown for destructive actions such as form submission or clicks on financial pages. Data-flow transparency is partial: the README explains the OpenAI key is used for transcription, recordings are written to ~/.config/open-claude-in-chrome/recordings/, and execute_code runs in a workerd V8 isolate with HTTP callbacks, but there is no egress inventory or retention policy. Sensitive data handling scores 0: recordings capture 240p frames, cursor trajectories and microphone audio, the Options page keeps audio and frame copies in IndexedDB, long recordings accumulate with cleanup deferred to 'a later refinement', and no redaction or encryption of credentials/privacy data is described. Dependency security scores 0: no lockfile evidence, no dependency audit or pinning, and a documented fallback to fetching wrangler over the network via npx --yes. External effects and rollback each score 1: there is an Alt mask mode, a humanize guarantee that only the path changes and never the outcome, and replayable recordings, but no transactional rollback or undo of already-committed external actions. Source attribution scores 1: the README self-describes as a clean-room reimplementation of Anthropic's extension and links official docs, but offers no clean-room process evidence, and the NOASSERTION license metadata conflicts with the in-repo PolyForm Noncommercial text.

Self-consistency scores 1: the object description says '18 MCP tools' while the README body says 21 MCP tools and the tool table lists additional non-parity tools, so the tool count is internally inconsistent. Dependency availability scores 1: Node 18+, Claude Code versions, an OpenAI key and the wrangler/workerd sidecar are all documented, but the sidecar has no health check and no auto-restart, and dependency versions are not pinned. Failure messages score 2: the README gives recognizable log lines ([wrangler] Ready on ..., sandbox prewarmed in ...), pgrep checks, /mcp reconnect and pkill recovery steps, and explains partial degradation rather than total failure; this is the strongest area in the repository.

Audience and scenarios score 2: it targets Claude Code users across browser automation, code mode and imitation-learning recording, with explicit verification scripts. Capability boundaries score 2: the tool table marks parity per tool (check/cross/blank) and documents divergences and stubs for file_upload, upload_image, gif_creator, shortcuts_* and switch_browser. Trigger precision scores 1: choosing between execute_code and direct tools is left to the model, and the README itself admits that if the model keeps using direct tools the description needs tuning, i.e. the trigger boundary is not converged. Environment fit scores 2: any Chromium browser, multi-browser ID registration, coexisting server variants, 127.0.0.1 binding and per-PID state directories are all described.

Information architecture scores 2: anchored TOC, architecture diagrams, seven install steps, verification, recovery, tool table and recording flow are well organized. Install notes score 2: from npm install through native messaging registration, browser restart, OpenAI key, microphone grant, claude mcp add and the development-channel launch, with common failure causes called out. Naming stability scores 1: server names and tool names are used consistently, but the tool-count conflict between the description and the README weakens naming/count stability. Examples and FAQ score 2: reddit verification, execute_code verification, recording verification, and the scratch/test-form four-challenge suite with a prompt template. Known limitations score 2: v1 trade-offs are listed explicitly (no chrome.downloads, IndexedDB accumulation, not rrweb, no sidecar self-healing, saturating benchmark, ambiguous grading, 10-20% run variance). License scores 1: the repo contains PolyForm Noncommercial 1.0.0 (noncommercial only) while metadata is NOASSERTION and the README comparison table claims 'Open source (MIT)' - three mutually inconsistent statements. Versioning/changelog scores 0: no CHANGELOG, no version number, no release history. Maintenance responsibility scores 1: attributed to noemica with a blog and Discord, but the publisher is unverified and there is no security disclosure channel, maintenance commitment or SLA.

Output usability scores 2: the tool set covers navigation, reading, forms, screenshots, network and console reads, with a paste-able recording reference and unambiguous completion criteria (green banner, per-challenge timing table). Marginal value scores 1: the core delta over the official extension is removing domain restrictions plus code-mode batching, yet the README itself reports cold-start parity with the official extension (2.04 vs 1.95 min/task, p=0.44/0.67), with gains coming mainly from prompt distillation and warmed sessions rather than anything unique to this repo. Cost-benefit scores 1: it requires Node, a Claude Code development-channel flag, an OpenAI key (billed transcription), a wrangler sidecar and extra dependency installs, while context cost is self-reported at +1.9s per turn per 100k tokens; the return is not clearly favorable against that operational burden.

Claim traceability scores 1: performance and parity claims point to benchmark/writeup/writeup.md and parity.png, but neither the writeup nor raw data is included in this static evidence, so the 17 arms, 12 tasks and p-values cannot be checked. Cross-source corroboration scores 1: README and LICENSE contradict each other on licensing (MIT claim vs PolyForm Noncommercial) and the tool count conflicts between description and body, weakening cross-file consistency. Fact/inference separation scores 1: the README largely separates 'validated' items (MCP channel, transcription and track merge, native-host file writes) from 'awaiting your live pass' items (in-browser capture, mic, stop pipeline), but strong assertions such as '100% feature & performance parity' and 'identical performance' lack verifiable support and sit in tension with the same page's 'statistically indistinguishable' framing.