Sure they can inject clients, but that's really only beneficials for developers. doing it via browser extension means regular people can use it.

> It's like an OpenAPI definition but for JS/MCP?

Sortof. It's a true MCP server which you can use to expose existing (or new functionality on your webapp to the client)