🧬 The Extension

SolanaShitList.fun for Chrome. Any Solana address on any page gets a badge — shitlisted or not, and who bundled the launch.

Soon on the Chrome Web Store — until it's approved, install it yourself in two minutes below.

🛠️ Install it (2 minutes)

The Web Store listing is in review. Until it's live, this is the same extension, installed by hand — Chrome calls it "unpacked".

1. Download and unzip it.

   ⬇ solanashitlist-extension.zip

   Put the unzipped folder somewhere permanent — Chrome loads it from that exact path every time it starts. If you delete the folder, the extension disappears.

2. Open chrome://extensions

   Paste it in the address bar. Then turn on Developer mode — the switch in the top-right corner.

3. Click "Load unpacked" and pick the folder.

   The one you just unzipped — the folder that has manifest.json in it. Don't drag the zip onto the page; that won't work.

4. Pin it, then open any post with a CA in it.

   A 🧬 bundle? pill appears next to the address — click it for the report. Works on X, pump.fun, DexScreener, Solscan, Axiom, Birdeye, GMGN and Telegram Web. The toolbar icon opens the trending list; the gear inside it opens settings.

Chrome will occasionally nag you about "developer mode extensions" on startup. That's Chrome being suspicious of anything not from its store — it goes away once the listing is approved and you switch to that version.

🎉 It's free

No key, no account, no payment. The shitlist check and the launch-bundle report are both open to everyone — install it and it works.

If the extension reports no record for a token, that means nobody has reconstructed its launch yet — not that the launch was clean. The chain analysis lives on memecoins.expert; scan it there and the answer shows up here.

🔍 What it can and can't do

The whole thing is about 600 lines you can read. Nothing below is a promise about intent — it's a description of what the code is able to do at all.

🔐 Permissions it asks Chrome for

Chrome shows you this list at install. Here's every entry and why it's there. There are no others — and no optional ones waiting to be switched on.

storage	Keeps the reports already fetched, in your browser. This is local storage on your machine — it is not an account, and we can't read it.
solanashitlist.fun	Lets it call our API. This is the only server it is permitted to contact; a request anywhere else would be blocked by Chrome.
Nine site permissions	x.com · twitter.com · pump.fun · dexscreener.com · solscan.io · axiom.trade · birdeye.so · gmgn.ai · web.telegram.org Read page text on these to find addresses and place the badge. Chrome words this as "read and change your data" on those sites — the "change" is the badge we insert; nothing else on the page is modified.

📡 What reaches our servers

A Solana address found on the page — only when you click its badge, or in one batched shitlist lookup per page	Sent
Your IP address — unavoidable for any web request, used only for rate limiting	Sent
Page content, post text, images, or anything you're reading	Never
The URL of the page you're on, or your browsing history	Never
Anything you type — searches, messages, form fields	Never
Wallet keys, balances, seed phrases, connected accounts	Never
Your name, email, or any identifier for you	Never
Cookies, analytics, tracking pixels, third-party SDKs	Never

Addresses are public chain data. We cache one report per address so the next person asking about the same token costs us nothing — but nothing about who asked is stored beside it, and we sell nothing to anyone. Full detail: privacy policy.

✅ Verify it yourself

• Read the code. The zip is plain, unminified JavaScript — content.js, sw.js, options.html. What you download is what runs; there's no build step to hide behind.
• Watch the network. Open DevTools → Network on any of those sites. Every request goes to solanashitlist.fun and carries an address and nothing else.
• Check the permissions. chrome://extensions → Details. Compare what Chrome lists against the table above.