uncloseai.

Browser Toys

Browser extensions that add the uncloseai. floating button to every web page you visit. Lightweight wrappers around uncloseai.js — no server, no backend, no accounts. The extension injects the script tag, and everything else runs client-side in your browser.

Available Extensions

Chrome / Edge / Brave / Vivaldi / Arc

Manifest V3 extension for all Chromium-based browsers.

1. Clone the repo: git clone https://github.com/uncloseai/browser-toys.git
2. Open chrome://extensions, enable Developer mode
3. Click Load unpacked, select the extensions/chrome directory

Firefox

Manifest V2 extension for Firefox 109+ and Firefox-based browsers (LibreWolf, Waterfox).

1. Clone the repo: git clone https://github.com/uncloseai/browser-toys.git
2. Open about:debugging#/runtime/this-firefox
3. Click Load Temporary Add-on, select extensions/firefox/manifest.json

Safari

Safari Web Extension for macOS and iOS. Requires Xcode conversion.

git clone https://github.com/uncloseai/browser-toys.git
cd browser-toys
xcrun safari-web-extension-converter extensions/safari \
  --project-location ./safari-xcode \
  --app-name "uncloseai" \
  --bundle-identifier com.uncloseai.browser-toy \
  --no-open

Then open the Xcode project, build, and enable in Safari Settings > Extensions.

How it works

1. The content script injects <script src="https://uncloseai.com/uncloseai.js" type="module"> into every page
2. If uncloseai.js is already on the page, it skips injection (no duplicates)
3. The floating uncloseai. button appears in the bottom-right corner
4. Click it to chat with Hermes about the current page
5. Toggle the extension on or off from the toolbar popup

Storage and privacy

These extensions have no backend. Everything runs client-side in your browser.

• Chat history stays in your browser's localStorage, scoped per domain. Conversations on example.com are separate from conversations on github.com. Clear a site's localStorage to clear its chat history.
• Settings (model selection, language preference, voice) are stored in localStorage.
• Secrets (custom API keys, if you configure them) are protected by the optional UncloseVault, which encrypts with AES before writing to localStorage.
• The extension itself stores one boolean value: enabled on/off. That is the only data the extension touches.

No data leaves your browser except the messages you choose to send to the public AI endpoints at hermes.ai.unturf.com, qwen.ai.unturf.com, and speech.ai.unturf.com.

Security

The extension code has been audited across 6 security categories with 49 automated tests. Findings: 0 critical, 0 high, 0 medium, 0 low, 3 informational.

• No innerHTML, eval(), document.write, or new Function()
• No network requests from extension code (all networking is in the injected uncloseai.js)
• Minimal permissions: storage only (plus host access for injection)
• Content Security Policy restricts extension pages to script-src 'self'
• Extension stores exactly one value: {enabled: true|false}

📋 Read the full Security Audit Report →

Source Code

📦 github.com/uncloseai/browser-toys

Public domain. No attribution required.