Is MCP SuperAssistant safe?
MCP SuperAssistant sends page URLs, titles, environment details, and a persistent client ID to Google Analytics.
On supported AI and chat sites, the content script reports page views, URL changes, and load events to the extension background service. The background service adds a persistent client ID and session ID, then posts the events with page URLs, titles, browser and OS details, language, region, screen details, timezone, and user agent to Google Analytics.
Who publishes itSaurabh patel - no other listings under this identity
Saurabh patel - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
MCP SuperAssistant reports every AI-chat page you visit to Google Analytics
On every supported AI-chat site, the extension sends the page title, full URL, and a persistent tracking ID to Google Analytics on page load and each in-app navigation.
It does not send message text or cookies in the traffic we observed.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open or navigate within a supported AI-chat site such as ChatGPT, Perplexity, or Grok while the extension is enabled.
The extension sends the page's title, full URL, and a persistent tracking ID to Google Analytics.
This fires once on load, then again on every in-app route change, checked once per second.
{ "client_id": "692a200b-19f1-40c2-9987-e0128fa7f8f6", "events": [ { "name": "page_view", "params": { "session_id": "1789150115231", "page_title": "ChatGPT: Chat, Work, Create & Code with AI", "page_location": "https://chatgpt.com/", "browser": "Chrome", "browser_version": "146.0", "operating_system": "macOS", "os_version": "10.15.7", "pixel_ratio": 2, "device_type": "desktop" } } ]}- Persistent tracking ID692a200b-19f1-40c2-9987-e0128fa7f8f6
A random ID created once and stored on your device, so every event ties back to the same browser install.
- Page addresshttps://chatgpt.com/
The full web address of the page you have open on the supported site.
- Page titleChatGPT: Chat, Work, Create & Code with AI
The browser tab title of the page you are viewing.
- Browser and OSChrome 146.0 on macOS 10.15.7
Your browser, browser version, operating system, and OS version.
- Device type and pixel ratiodesktop, 2x
Whether you are on desktop, mobile, or tablet, plus your screen's pixel density.
Sending the page-view beacon
Content script: fires on load and on every route change
let lastPageUrl = window.location.href;const demographics = collectDemographics(); // browser, os, screen, language, region...try { chrome.runtime.sendMessage({ command: "trackAnalyticsEvent", eventName: "page_view", eventParams: { page_title: document.title, page_location: document.location.href, ...demographics } });} catch (err) { /* logged, not fatal */ }// Polled every second; fires a fresh event on every in-app route changesetInterval(() => { const currentUrl = window.location.href; if (currentUrl !== lastPageUrl) { try { chrome.runtime.sendMessage({ command: "trackAnalyticsEvent", eventName: "url_change", eventParams: { page_title: document.title, page_location: currentUrl, previous_page: lastPageUrl, ...demographics } }); lastPageUrl = currentUrl; } catch (err) { /* logged, not fatal */ } }}, 1000);try { chrome.runtime.sendMessage({ command: "trackAnalyticsEvent", eventName: "content_script_loaded", eventParams: { hostname: window.location.hostname, path: window.location.pathname } });} catch (err) { /* logged, not fatal */ }Background worker: builds and posts the GA4 event
async function sendAnalyticsEvent(eventName, eventParams, userProperties) { try { const clientId = await getOrCreateClientId(); const sessionId = await getOrCreateSessionId(); const event = { name: eventName, params: { session_id: sessionId, engagement_time_msec: ENGAGEMENT_TIME_MSEC, ...eventParams } }; const payload = { client_id: clientId, events: [event] }; if (userProperties) payload.user_properties = userProperties; const response = await fetch(`${GA_ENDPOINT}?measurement_id=${MEASUREMENT_ID}&api_secret=${API_SECRET}`, { method: "POST", body: JSON.stringify(payload), headers: { "Content-Type": "application/json" } });- www.google-analytics.com
Google's GA4 Measurement Protocol endpoint. Receives the page URL, title, persistent client ID, and browser and device details from every scoped-site visit.
Prints the persistent GA4 client ID this extension has stored for your browser.
- Chrome or a Chromium-based browser
- MCP SuperAssistant installed and enabled
chrome.storage.local.get("clientId", (result) => { console.log("Persistent GA4 client ID:", result.clientId);});- 1Open chrome://extensions and enable Developer mode.
- 2Click "service worker" under MCP SuperAssistant.
- 3Paste this into its console and press Enter.
- 4The printed value is sent with every analytics event.
What it can do
Permissions this extension asks for, as declared in version 0.6.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on perplexity.ai
*://*.perplexity.ai/*
Read and change your data on chat.openai.com
*://*.chat.openai.com/*
Read and change your data on chatgpt.com
*://*.chatgpt.com/*
Read and change your data on grok.com
*://*.grok.com/*
Read and change your data on x.com
*://*.x.com/*
Read and change your data on twitter.com
*://*.twitter.com/*
Read and change your data on gemini.google.com
*://*.gemini.google.com/*
Read and change your data on aistudio.google.com
*://*.aistudio.google.com/*
Read and change your data on openrouter.ai
*://*.openrouter.ai/*
Read and change your data on google-analytics.com
*://*.google-analytics.com/*
Read and change your data on chat.deepseek.com
*://*.chat.deepseek.com/*
Read and change your data on t3.chat
*://*.t3.chat/*
Read and change your data on chat.mistral.ai
*://*.chat.mistral.ai/*
Read and change your data on github.com
*://*.github.com/*
Read and change your data on copilot.github.com
*://*.copilot.github.com/*
Read and change your data on kimi.com
*://*.kimi.com/*
Read and change your data on chat.z.ai
*://*.chat.z.ai/*
Read and change your data on chat.qwen.ai
*://*.chat.qwen.ai/*
Store data in your browser
storage
Write to your clipboard
clipboardWrite
Where it sends data
Destinations our analysis observed MCP SuperAssistant contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.com/mp/collect
MCP SuperAssistant sends data to www.google-analytics.com/mp/collect. 6 other extensions we have analysed send data here.