Checks manifest.json against Manifest V3 and Chrome Web Store upload rules: MV2 leftovers, host patterns in permissions, remote code, field limits. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
VS Code MarketplaceOpen VSX (Cursor, VSCodium)npmDocker Hubext install ReadyStack.mv3-manifest-preflight npx @readystack/mv3-manifest-preflight <file> docker run --rm -v "$PWD:/w" getreadystack/mv3-manifest-preflight /w
Team? One key for every ReadyStack linter, 5 seats, $149 once
Scan every manifest.json in the workspace in one run and export the pre-submission report as a file you keep: Markdown for the reviewer, JSON for CI.
One payment, one licence key for this tool. The key is shown right after payment.
A contract extension developer at $80/h costs more than the licence after 22 minutes of resubmission rework, and a rejected upload restarts the Chrome Web Store review queue.
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.

Eight lines in one manifest.json are enough for the Chrome Web Store to refuse the upload, and a Chrome extension developer who let a code assistant draft the file will have written all eight without noticing. Run that file through MV3 Manifest Preflight and the count is worse than eight: 19 findings, 16 of them blockers. The file is no strawman - it is the reference fixture shipped with the source, an MV2-style draft of a tab manager, exactly the shape an assistant produces when you ask for "a Chrome extension that saves your tabs".
Here are the eight lines and what Manifest V3 takes instead.
"manifest_version": 2 becomes 3. Chrome stable no longer runs Manifest V2, and the Chrome Web Store has accepted only MV3 for new items since 17 January 2022.
"browser_action" becomes "action". MV2 had two toolbar keys, MV3 has one, and the old names do not load.
"background": {"scripts": ["background.js"], "persistent": false} becomes "background": {"service_worker": "sw.js"}. The "persistent" key is MV2-only and invalid on its own.
"content_security_policy" as a string becomes an object: {"extension_pages": "script-src 'self'; object-src 'self'"}.
"permissions": ["*://*/*"] moves to "host_permissions". MV3 splits API permissions from URL patterns, and a pattern left in the wrong array is an error, not a warning.
"webRequestBlocking" has no path forward for a store item; the blocking logic becomes a declarativeNetRequest ruleset.
A content script loading https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js is remotely hosted code, which the store's program policies do not allow. The library ships inside the package.
"version": "1.0.0-beta" is rejected at upload: the store takes one to four dot-separated integers between 0 and 65535, and nothing else.
The remaining eleven findings are the quiet ones - a name 99 characters long against a 75-character limit, a "short_name" of 18 against 12, no 128x128 icon, a "web_accessible_resources" list of bare paths, a content script with no "matches", an "update_url" that the store refuses in an uploaded package, a leftover "key", and broad host access that moves the item into extended review.
Why an assistant writes these lines is not a mystery. Years of Manifest V2 tutorials, answers and sample repositories sit in its training data, and the manifest is the one file nobody rereads. It is also the one file the store's pipeline reads first.
MV3 Manifest Preflight runs 25 rules over manifest.json. Open the file in VS Code and the findings appear in the Problems panel as you type; paste it into the free web page and the same engine runs in the browser with nothing uploaded. On the migrated fixture the same 25 rules return 0.
The free tier is the file you have open: every rule, every finding named, no key, one manifest finished. The licence ($29, one key per person or team seat. As a yardstick: at an $80/h contract rate, 22 minutes of resubmission rework already costs more than the licence, and a refused upload restarts the review queue.
It reads a manifest.json and returns every line Manifest V3 or the Chrome Web Store upload will refuse, with the replacement beside it. 25 rules cover MV2 leftovers such as browser_action and background.scripts, policy blockers such as remotely hosted code and webRequestBlocking, and upload fields such as version format, the 75-character name limit and the missing 128px icon.
Chrome and Edge extension developers who are about to upload, and teams whose manifest was drafted or refactored by a code assistant trained on Manifest V2 examples. It is equally useful for an agency migrating a client's old MV2 extension, where the manifest is the first thing the Chrome Web Store reviewer's pipeline rejects.
Chrome tells you at upload time, one review cycle per attempt, and stops you at the error it hits. Mozilla's web-ext lint checks Firefox AMO rules, not the Chrome Web Store's field limits, remote-code policy or permission split. This runs all 25 Chrome rules in your editor before the ZIP is built.
Free covers the file you have open: every rule, every finding named, nothing hidden. The licence adds a different job - scanning every manifest.json in the workspace in one run and exporting the result as a Markdown and JSON report you keep for CI and for your reviewer.
Reading the current manifest reference and store policies against one file takes a developer a sitting, and each miss costs another review cycle. At an $80/h contract rate, 22 minutes of resubmission rework already exceeds the $29 licence. The free tier costs nothing and finishes one file.
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. MV3 Manifest Preflight - Chrome Web Store checks the file you open against 25 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
One question, answered by the person who built it. Your email only if you want the answer sent.
Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.
For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →