The manifest must state every capability the add-in needs.
No credential access
Add-ins cannot read passwords, Passport tokens, or saved credentials.
No impersonation
Names and icons must not imply official Mocha ownership unless the add-in is official.
Planned permissions
links.openExternal - open declared external HTTPS URLs. emoticons.install - provide an emoticon pack. ui.actionPane - appear in the Messenger action pane. ui.help - appear in help and documentation areas. ui.tabs - appear in the Messenger tab area. webview.hostedContent - render declared HTTPS or packaged HTML content in a sandboxed tab. webview.mochaBridge - request a narrow reviewed JavaScript bridge inside a tab. activities.launch - expose a reviewed Game Activity in conversations. activities.channel - exchange bounded peer activity data through Mocha's channel broker. profile.basicRead - future consent-based display-name level identity access. presence.statusWrite - request user-visible status or personal-message updates.
Tab safety
Tabs cannot receive private messages, contact lists, Passport tokens, saved credentials, or arbitrary local files. Hosted tabs must use HTTPS and declared origins. Packaged tabs must stay inside their package folder.
Higher-risk capabilities such as reading messages, sending automatic messages, changing contacts, or running code inside Messenger are intentionally excluded from the first add-in platform.
