Userscripts+

Userscript manager for Chrome (MV3) with a built-in security recon and network inspection panel.

Userscripts+ is a userscript manager for Chrome, built for Manifest V3, with a full security recon and network inspection toolkit built right in. It runs the classic // ==UserScript== ... ==/UserScript== metadata format, so your existing userscripts from Tampermonkey, Violentmonkey, or Greasemonkey work unchanged: no rewriting, no reformatting. Everything lives in one side panel. Click the toolbar icon and you get four tabs: Scripts, Overview, Security, and Network. No separate popup to hunt through, no settings buried three menus deep. SCRIPTS: a real userscript manager Write, install, and manage userscripts with full metadata support: @match, @include and @exclude, @grant, @require, @run-at, and @updateURL. Scripts are edited in a built-in CodeMirror editor with syntax highlighting for JavaScript, CSS, and JSON, and you can start from one of the built-in templates instead of a blank file. The GM_* API is implemented properly: GM_setValue and GM_getValue for persistent storage, GM_xmlhttpRequest for cross-origin requests, GM_notification for desktop notifications, GM_registerMenuCommand for menu commands, GM_setClipboard, GM_addStyle, and GM_openInTab. Import and export your scripts as JSON for backup or sharing, and let the extension check @updateURL/@downloadURL periodically so your scripts stay current on their own. OVERVIEW: know what site you're on For the site in your active tab, see its security headers, DNS records, subdomains (pulled from certificate transparency logs), and IP and hosting information. DNS records, resolved IPs, and subdomains are all clickable, so you can jump straight into further lookups. SECURITY: pentest-oriented tools for the active tab View and edit the current site's cookies, including their Secure, HttpOnly, and SameSite flags, directly from the panel. Read and edit localStorage and sessionStorage in place. Run a probe for commonly exposed paths (.git/HEAD, .env, backup files, admin panels, and more) to spot obvious misconfigurations. A built-in JWT decoder lets you inspect tokens without leaving the page. NETWORK: live traffic capture and replay Capture fetch and XHR requests from the active tab as they happen. Captured JSON or CSS responses are pretty-printed automatically and can be edited inline, then turned into a userscript that replays your edit on future requests, so you can patch a broken API response or tweak a stylesheet without touching the server. Binary responses (images, video, audio, fonts, and files like .glb, .pdf, or .zip) are never decoded as text: the panel shows their type and size and lets you preview or download the original bytes on demand. BUILT FOR PRIVACY Userscripts+ does not collect, transmit, or sell any of your data. There is no analytics, no telemetry, and no crash reporting. Every userscript, cookie, storage value, and captured request is processed entirely on your device and stored locally in your browser. The extension has no backend server: it does not run one, and it does not talk to one. The only outbound requests the extension itself makes are fetching the @require libraries and @updateURL/@downloadURL sources your own scripts declare, plus read-only lookups to public services (Google's DNS-over-HTTPS resolver, crt.sh, and ipapi.co) for the Overview panel, scoped to the site you're currently inspecting. REQUIREMENTS Requires Chrome 135 or newer, since script execution runs through the native chrome.userScripts API rather than any workaround. After installing, open the extension's Details page in chrome://extensions and turn on "Allow User Scripts": Chrome requires this switch to be enabled manually, and the side panel will show a notice until you do. Whether you're a developer who wants your userscripts to just work without a bloated manager, or someone doing recon and debugging on the sites you visit, Userscripts+ keeps the tools you actually need in one fast, local-first panel.