WebClip Markdown — a rebrandable browser extension

Product add-ons

A Manifest V3 browser extension that turns the body text of a web page, or the subtitles of a YouTube video, into Markdown on the clipboard and shows the token count; a containerised build environment comes with it, and docker compose up produces the extension build output, an installable zip and a one-page delivery page.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

What is delivered is the source of a Manifest V3 extension you can rebrand yourself, together with a containerised build environment; which file to change for the extension's name, its icon, the options page and the body-text extraction logic is listed item by item in the cross-reference table in QUICKSTART.

How to start

$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview48 paths

▸assets1

tailwind.css

▸components2

ToggleOption.tsx
ui/

▸delivery-page1

index.html

▸entrypoints6

background.ts
content.tsx
options/
youtube-main-world.ts

▸lib8

showNotification.tsx
storage.ts
tagsToRemove.ts
utils.ts
yt/

▸public5

icon/

▸server1

serve-delivery.js

▫ATTRIBUTION.md

▫CLAUDE.md

▫Dockerfile

▫LICENSE

▫LICENSE-99LL

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫biome.jsonc

▫bun.lock

▫bunfig.toml

▫components.json

▫compose.yaml

▫delivery-manifest.txt

▫package.json

▫privacy.md

▫tsconfig.json

▫wxt.config.ts

▫Config and hidden files 5

Latest passing run

Clone → Checkout → Toolchain → Build → Run live

Pre-purchase Disclosure

What you are buying

The source of a Manifest V3 browser extension together with a containerised build environment: a keyboard shortcut turns the body text of a web page (or, on a YouTube video page, the subtitles) into Markdown on the clipboard and shows the token count. docker compose up builds the extension output and an installable zip, and opens a separate delivery page to download them from.

Derived from an open-source extension under the MIT licence; the containerised build, the delivery page and the Traditional Chinese installation guide are our work. Delivery is a frozen snapshot: one zip, taken from the product repository at revision 4ad667a.

Known limitations

The container provides the build output and a preview of the options page, not a runtime for the extension; to use it, it has to be loaded into a browser
The delivery page is served over plain HTTP on port 8115, and the snapshot contains no TLS or reverse proxy configuration
The delivery page has no login and no password mechanism, so anyone who can reach that port can download the extension output
The first build fetches from outside: it pulls the bun and node base images and installs the dependencies according to bun.lock
The extension requires the <all_urls>, activeTab, clipboardWrite, scripting and storage permissions
The options page has a celebration animation option, off by default, which when switched on opens a raycast.com background tab on every copy
The YouTube subtitle feature works by intercepting that site’s subtitle requests and its player API, and a change on their side may stop it working
Body-text extraction relies on Defuddle and Readability parsing the page DOM, and on sites with an unusual layout it may not extract cleanly
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit fd78289. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

3 PASS2 WARN0 FAIL

Source ReviewPASS

Every file was scanned: the 15 TS/TSX files under entrypoints / lib / components and our own server/; pattern matching for eval, new Function, innerHTML and dangerouslySetInnerHTML found zero hits for all four. The outbound behaviour that was found is recorded item by item: (a) youtube-main-world.ts overrides the page's XMLHttpRequest.prototype.open in order to intercept YouTube's subtitle requests — that is how the subtitle feature is implemented, and it is injected only on youtube.com (limited by web_accessible_resources in the manifest); (b) two files under lib/yt call YouTube's player and subtitle endpoints with ofetch; (c) background.ts has a celebration animation that opens a raycast.com background tab and then closes it again, and the default value in lib/storage.ts is showConfetti: false; (d) the options page has three explanatory links pointing at github.com and x.com, which connect only when they are clicked. Our delivery server uses nothing but Node's built-in modules and makes no outbound request.

Script SafetyWARN

package.json has an install-time script, postinstall: wxt prepare (the WXT framework generating types and the .wxt directory — a development toolchain convention, not malicious), so this is flagged as uncertain: the fact that installing means executing is itself worth saying. Our container build installs with --ignore-scripts and then runs wxt prepare explicitly, so the point of execution is visible.

RecencyPASS

Upstream is pinned at fd78289 (see the evidence link); this product is a frozen snapshot and does not follow upstream.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream is MIT: the LICENSE itself at the pinned commit fd782897b905d1024c6609edb205c956730e239d was read word for word (the standard full text of the MIT licence, Copyright 2025 ysm.dev), which permits commercial use, modification, derivative works, redistribution and sale, with the obligation of retaining the copyright notice and the full text of the licence. The root LICENSE is kept as it stands, and the provenance and the redistribution obligation are separately written in ATTRIBUTION.md, both of which are inside the delivered snapshot; for the parts we added, LICENSE-99LL is placed alongside as the 99LL product licence template v1, with spdx recorded as LicenseRef-99LL-Product. On branding: the health check asserts that the manifest.json and background.js that come out of the build contain no upstream name string; the provenance documents inside the delivered snapshot (ATTRIBUTION.md, SECURITY.md and upstream's README) still keep the upstream name, as the MIT obligation requires.

Dependency LicensesWARN

The dependencies in package.json list 16 runtime dependencies (@mozilla/readability, defuddle, turndown, js-tiktoken, react, react-dom, @radix-ui/react-switch, lucide-react, sonner, srt-parser-2, ofetch, @fxts/core, clsx, class-variance-authority, tailwind-merge, tw-animate-css), judged from package metadata to be permissive licences of the MIT / Apache-2.0 kind; each licence file was not opened one by one to check, and transitive dependencies were not expanded either, so this is flagged as uncertain — an honest statement of how deep the check went. These packages are fetched from npm by the buyer at build time and are not distributed with the snapshot.