Summary
Tampermonkey Editors accepts and forwards put and delete, but the official Tampermonkey 5.5.0 external userscripts API rejects both with 405 Method Not Allowed.
This makes the Editors/MCP protocol advertise capabilities that the connected official extension does not provide.
Reproduction
Environment:
- Chrome stable
- Tampermonkey 5.5.0
- Tampermonkey Editors 1.0.6
- tampermonkey-mcp 0.0.5
- Connect Tampermonkey Editors to tampermonkey-mcp.
- Call tampermonkey_list: succeeds.
- Call tampermonkey_patch on an existing script: succeeds.
- Call tampermonkey_put with a valid userscript containing @name: returns:
{"number":405,"message":"Method Not Allowed"}The MCP client sends an action-shaped message, not an HTTP method:
{
"action": "put",
"messageId": "1",
"value": "// ==UserScript==..."
}Root cause
The Editors relay allows put and delete in src/background/index.ts, then forwards them to the native extension.
The native Tampermonkey 5.5.0 external API responds to its options request with:
{"allow":["options","list","get","patch"]}and explicitly returns 405 for put and delete.
Editors currently only checks whether allow contains list; it does not retain or enforce the complete capability list. As a result, the relay accepts actions that the backend has already declared unsupported.
Relevant code:
Requested fix
Please choose one of these contract fixes:
- Implement put and delete in the official Tampermonkey external userscripts API; or
- Make Editors capability-aware and stop advertising/forwarding unsupported actions.
At minimum, the Editors relay should preserve the allow list from the options response and return a descriptive unsupported-capability error before forwarding the request. An integration test covering options -> put/delete would prevent this regression.
Summary
Tampermonkey Editors accepts and forwards put and delete, but the official Tampermonkey 5.5.0 external userscripts API rejects both with 405 Method Not Allowed.
This makes the Editors/MCP protocol advertise capabilities that the connected official extension does not provide.
Reproduction
Environment:
{"number":405,"message":"Method Not Allowed"}The MCP client sends an action-shaped message, not an HTTP method:
{ "action": "put", "messageId": "1", "value": "// ==UserScript==..." }Root cause
The Editors relay allows put and delete in src/background/index.ts, then forwards them to the native extension.
The native Tampermonkey 5.5.0 external API responds to its options request with:
{"allow":["options","list","get","patch"]}and explicitly returns 405 for put and delete.
Editors currently only checks whether allow contains list; it does not retain or enforce the complete capability list. As a result, the relay accepts actions that the backend has already declared unsupported.
Relevant code:
Requested fix
Please choose one of these contract fixes:
At minimum, the Editors relay should preserve the allow list from the options response and return a descriptive unsupported-capability error before forwarding the request. An integration test covering options -> put/delete would prevent this regression.