When using Hoppscotch (an open-source API testing tool) in the browser, CORS policies prevent sending requests to many APIs. This extension removes those restrictions by acting as a privileged intermediary that can make cross-origin requests on behalf of the web app.

1. Install extension from Chrome Web Store. 2. Open Hoppscotch web app (https://hoppscotch.io or self-hosted instance). 3. Extension content script auto-injects a hook (__POSTWOMAN_EXTENSION_HOOK__) into allowed pages. 4. When user sends an API request in Hoppscotch, the web app communicates via window.postMessage to the content script. 5. Content script relays the request to the background service worker via chrome.runtime.sendMessage. 6. Background worker executes the fetch with <all_urls> permissions (bypassing CORS) and returns the response. 7. Popup UI allows managing which origin domains are trusted for the hook.

Target users: Developers and QA engineers using Hoppscotch for API testing and development / Front-end developers testing REST/GraphQL APIs from the browser

The extension destination (hoppscotch.io) may have its own account system for saving collections/environments, but this is outside the extension's scope and does not affect its core CORS-bypass functionality.
Source code is minified/bundled (Parcel), making exact line-by-line tracing harder, but the logic is clear and well-structured.

Monetization

No paid features detected

The extension is entirely free and open source (GitHub: hoppscotch/hoppscotch-extension). All 'subscribe' keyword hits are from a Proxy-based reactive programming pattern (defineSubscribableObject with _subscribers/subscribe for property change observation), not subscription/payment. All 'pro' keyword hits are from generic code patterns like Object.defineProperty, Proxy, processRequest, etc. No billing APIs, payment UI, feature gating, or payment processors (Stripe, etc.) exist in the code. Hoppscotch.io has a separate paid teams/enterprise plan, but the extension itself gates no features behind payment.

Confidence: 92
Payment platform: --
Source: AI / High
Login required: No
Reason: The extension contains no login UI, no authentication APIs, and no credential storage. It operates purely as a utility layer that injects hooks into web pages and proxies HTTP requests through its background service worker. No account or authentication is needed to use the extension's core CORS-bypass functionality.

Permission risk

High-risk permissions

This estimate uses declared permissions and host permissions to assess access scope and sensitivity.

扩展能力较强：storage、tabs、cookies、scripting
主机权限覆盖范围较宽

Publisher

Hoppscotch Support

Hoppscotch

Email: [email protected]
Phone: +919539653962
Address: Chittilappilly House Anjangadi, Anthikad Thrissur, Kerala 680641 IN

Public contact fields are shown above. Developer portfolio pages are available on paid accounts.

View developer portfolio

Permissions

Host access