Open Source Firefox Extensions: Most Don't Publish Code

I went looking for a tab manager last week. addons.mozilla.org gave me a grid of recommended extensions, a star rating, and a user count. Nothing on that page told me whether anyone outside the author had ever read the code, and the thing I was about to install wanted access to every site I visit.

So I crawled the whole catalogue and built ffext, which lists only extensions with an open source license and ranks them by things you can verify instead of by how many people already clicked install.

What is actually open source

The AMO API caps any single query at 30,000 results, so the crawler slices by category and unions on addon id. That got 96,532 of the 96,606 listed extensions.

So 74% of extensions declare an open source license, and about a quarter of those point anywhere you can read the code.

The license field alone explains why. Here are the top declarations:

MPL-2.0 is more than half the corpus, and it is the option AMO pre-selects in its submission form. Most of those 36,342 are people who left a dropdown alone. A declared license tells you what an author agreed to in a form. A repository link tells you where to look. ffext splits the two into separate tiers and defaults to showing only the second.

A linked repo is not proof either. Nothing checks that the XPI you install was built from that tree, and I am not doing reproducible builds here. It is the difference between being able to look and not.

Ranking

The score has five components, all visible on each extension’s page: source availability, permission footprint, data collection disclosure, maintenance recency, and adoption. Popularity is capped at a log-scaled 9 out of 100 so it cannot carry a listing on its own.

The raw rating average is not a usable signal here. Of 96,532 extensions, 28,555 have any rating at all. The median rated extension has two. 6,373 of them hold a perfect 5.0 from three ratings or fewer. Sorting by average rating returns that wall of noise and buries the extensions thousands of people actually rated, so the rating sort pulls each average toward the corpus mean (4.16) in proportion to how little evidence backs it:

weighted = (average * count + 4.16 * 20) / (count + 20)

Twenty is roughly the 90th percentile of rating counts. Below that, an extension mostly inherits the corpus average.

Limitations

The data is a snapshot, taken 2026-08-09. There is no re-crawl on a schedule yet, so anything published or updated after that date is missing, and the maintenance component ages relative to the crawl rather than to today.

Permissions come from the manifest metadata AMO exposes, not from unpacking the XPI, so an extension that requests little and does a lot through remote code will look fine. Data collection is self-declared. Repository detection is a URL match against eight known forges, nothing more. 16,519 of the links come from AMO’s homepage or support_url fields, which the author filled in deliberately. The other 2,215 were matched in free-text description, and those can just as easily be a library the extension uses or the project it was forked from - the site labels them. Nothing is fetched, so a deleted or renamed repo still counts, and self-hosted Gitea and cgit are missed entirely.

Contributions

Source is at elsbrock/ffext, AGPL-3.0. The crawler, the scoring, and the site are all in there, so if you disagree with how a component is weighted you can read exactly what it does and open an issue. Scoring weights are the part I am least sure about, and misattributed repositories are the easiest thing to report.