Aarti-04/MailCleaner-chrome-extension
Project Overview
MailCleaner AI
Chrome extension that scans a Gmail inbox and trashes emails flagged as spam by a local API.
True Intent (AI Assessment)
A student/portfolio Chrome extension demonstrating Gmail OAuth, MV3 service workers, and integration with an external spam-classification API to auto-trash inbox spam.
README Accuracy
Notes
README describes AI-powered spam detection, but the classifier is a hardcoded localhost URL with no backend included in the repo, so out-of-the-box the extension cannot classify emails. The OAuth scope is the full-access https://mail.google.com/ scope rather than a least-privilege Gmail scope. The private signing key (dist.pem) is committed to the repository, which is a security hygiene issue.
MailCleaner AI is a Chrome Manifest V3 browser extension built with React and Vite. It authenticates a user against their Google account via OAuth 2.0, uses the Gmail REST API to fetch the last batch of messages from the user's inbox, and sends each message to a spam classification endpoint. Messages classified as spam can then be moved to the Gmail trash via the Gmail API.
The stated problem is manual spam and phishing cleanup in Gmail. Google's built-in spam filter is passive and lives in the Spam folder; this extension attempts an active sweep of the primary inbox using an external classifier, with a heuristic fallback advertised in the README.
The intended user is an individual Gmail account holder who installs the unpacked extension in Chrome developer mode. There is no published Chrome Web Store listing referenced, no backend server included, and the classifier API is expected to run on the user's own machine.
Architecturally, a React popup (src/App.jsx) sends chrome.runtime messages to a background service worker (public/service_worker.js). The service worker holds the OAuth token lifecycle via chrome.identity.getAuthToken, persists the token in chrome.storage.local, calls Gmail endpoints, and forwards message content to a spam prediction API hardcoded to http://127.0.0.1:8000/model/predict/. A Vite build plugin injects VITE_GOOGLE_CLIENT_ID into dist/manifest.json at build time so the client_id is not committed. The manifest requests broad scopes including https://mail.google.com/, which grants full read/write/delete access to the user's mail.
Notable observations: the spam predictor and history endpoints point to localhost (127.0.0.1:8000), meaning the extension is non-functional for spam detection without a separately hosted Django/FastAPI-style backend that is not included in this repository. The requested Gmail OAuth scope is the maximum-privilege mail scope rather than a narrower gmail.modify or gmail.readonly scope. A built dist.crx and dist.pem private signing key are checked into the repo, which is unusual and means anyone with the repo can sign updates as this extension identity.
| Languages | JavaScript, CSS, HTML |
| Runtime | Chrome (Manifest V3 service worker), Node.js for build |
| Framework | React 18 |
| Database | chrome.storage.local (no server DB in repo) |
| Package Manager | npm |
| Key Dependencies | react, react-dom, vite, @vitejs/plugin-react, tailwindcss, postcss, autoprefixer, eslint |
| Build Tool | Vite (with custom manifest-injection plugin) |
| Test Framework | None detected |