# social-media-copilot: a browser extension that collects platform data

> social-media-copilot is a WXT browser extension for collecting data and media from Xiaohongshu, Douyin and Kuaishou, with a separate server branch that exposes the results over HTTP by proxying requests to the extension. The open source branch is a v0.x snapshot kept for study, and the repository carries a disclaimer that restricts use and warns about account bans.

**iszhouhua/social-media-copilot** — 社媒助手开源版 - 小红书、抖音、快手等平台数据采集的浏览器插件，可通过API调用，支持Docker部署。

- Repository: https://github.com/iszhouhua/social-media-copilot
- Website: https://socialext.com/open-source
- Stars: 1,381 · Forks: 227
- Language: TypeScript
- License: GPL-3.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/iszhouhua-social-media-copilot

## Three versions, and only one is the code you can read

social-media-copilot is a browser extension for collecting data from social platforms, and the repository is organised around three versions of it that share a name but are distributed separately.

The store version is the most complete and is not open source. The open source version is the branch you are reading, and the server version lives on a separate branch and is also open source.

The open source version is described as built from the v0.x code of the extension, with only basic feature maintenance, and it is offered for people to study and exchange notes. The store version, which is the one the Chrome Web Store listing for the project points at, supports the most platforms, including Xiaohongshu, Douyin, Bilibili, Kuaishou and TikTok, and is the one the maintainer prioritises. The open source version supports Xiaohongshu, Douyin and Kuaishou.

That split is the first thing to understand about the project. If you are evaluating it as a dependency, the version that most people install is the one whose source you cannot read, and the code in this repository is a frozen, earlier generation of it.

The project is written in TypeScript, the project states the licence is GPL-3.0, the homepage is socialext.com/open-source, and there are no GitHub releases. The last push was on 2026-08-31.

## The server branch proxies requests to the extension

The server branch is the more interesting piece of engineering, and its design explains the whole product.

The server side exposes an HTTP service. Requests arriving on that service are proxied to the extension side over socket.io, and the extension then makes the actual request to the platform and calls the result back to the server.

That architecture is unusual and it is driven by how the platforms work. A request to these services needs a logged-in session, and the session lives in a browser profile, with the cookies, the device fingerprint and whatever the platform's request signing expects. So the request has to originate from inside a browser where the user is logged in. The server cannot do that on its own, and neither can the extension reach a server-side caller directly, so the server acts as a broker between an API consumer and a browser that holds the credentials.

The consequence for a user is that something has to be running in a browser with a logged-in account for the API to answer. The extension is not a passive collector that runs on a schedule; it is an active participant in a request, and if the browser is closed, so is the API.

That design is also what makes the extension useful for a low volume of collection, which is the scenario the project description gives as its motivation: when you only need a small amount of data, doing it by hand is tedious, and other products are expensive or need a complicated development environment to configure.

The server branch is documented as suitable for users who need to obtain data through an API, and it supports custom deployment.

## What the open source branch can actually collect

The README publishes a capability table for the open source version, with three platforms as rows and five capabilities as columns. Translated out of the table, the capabilities are downloading video and images without a watermark, collecting the data of a specified work, collecting the comments of a specified work, collecting the data of a specified creator, and collecting the works of a specified creator.

All three platforms, Xiaohongshu, Douyin and Kuaishou, are marked as supported for all five capabilities, with a checkmark in every one of the fifteen cells. The project also links per-platform documentation in the docs/ directory, with a file each for Douyin and Xiaohongshu describing the features, and a Kuaishou file listed in the project structure.

The watermark-free download is the capability that carries the most legal weight, and it is worth being clear that it exists in all three platforms in this build. Downloading a creator's own media is straightforward; downloading media from other people is a different question, and the answer depends on the platform's terms and on the rights in the content, not on the extension.

The comment collection and creator statistics capabilities are the ones a data pipeline would actually use, and they are the reason the server branch exists, since a comment list for a popular work is a lot of requests to page through by hand.

## Built on WXT, with one content script per platform

The project structure section shows a WXT based extension, and the layout is the clearest description of how the code is organised.

The src/ directory holds the source, with an assets/ directory for resources, a components/ directory for shared components, an entrypoints/ directory for the extension entry points, a public/ directory for static files and a utils/ directory for helper functions. The entrypoints directory is where the platform logic lives: a background/ script for the extension background, a popup/ script for the popup interface, and a content script per platform, one for Xiaohongshu, one for Douyin and one for Kuaishou.

The per-platform content script structure is the important design decision. Each platform has its own entry point rather than one script with a switch on the hostname, so the platform-specific request building and page interaction stay isolated, and adding a platform means adding an entrypoint rather than editing a conditional in a shared file.

Around that there is the build configuration: wxt.config.ts for WXT itself, web-ext.config.ts for the browser extension tooling, postcss.config.js and tailwind.config.js for styling, tsconfig.json for TypeScript, components.json for the component library setup, and package.json for the dependencies. The output/ directory is the build output, and docs/ holds the documentation and screenshots with the per-platform markdown files and an images/ directory.

WXT is the framework the project names as its core, and the WXT documentation is linked for the details.

## Running it locally in two commands

The quick start is short, and it needs Node installed, with pnpm recommended although npm, yarn and cnpm are said to work as well.

```bash
# Install dependencies
pnpm install
# Run the project
pnpm dev
```

The package manifest requires Node 18 or later, and the scripts show the range of the tooling. The dev script runs wxt, and there is a dev:edge variant that runs wxt with the edge browser target. The build script is wxt build, again with an edge variant, and the zip script packages the extension with wxt zip, with the same edge variant. A compile script runs tsc with no emit, so type errors fail the build, and a postinstall script runs wxt prepare, which generates the WXT types and scaffolding.

After the dev server starts you load the extension into Chrome by hand. You open the extension management panel at chrome://extensions/, enable developer mode, choose Load unpacked, and select the output/chrome-mv3 directory. Then you open the extension and connect the server side, and once it is connected you can obtain platform data by calling the server side API.

The WXT development server is what makes that workable, because it rebuilds the extension on change and reloads it in the browser, so the loop is edit, save, refresh the page you are collecting from.

The version in the package manifest is 0.1.10, and the package is private, which is consistent with a source tree that is built and published through the Chrome Web Store listing rather than to npm.

## The React and Radix stack behind the popup

The dependency list describes a fairly conventional extension UI, and a few entries are worth explaining.

The interface is React 18 with react-dom, and the component layer is Radix UI, with the alert dialog, checkbox, collapsible, dialog, dropdown menu, label, progress, scroll area, separator and slot packages, plus the Radix icons. Styling is Tailwind with tailwindcss-animate, class-variance-authority, clsx and tailwind-merge for class composition, and lucide-react for icons. Toasts come from sonner, and the theme handling is next-themes, which is what lets a single build offer a light and a dark popup.

The form stack is react-hook-form with @hookform/resolvers and zod, so validation is schema-based rather than hand-written, which is a sensible choice for a form that takes URLs and options.

The utility dependencies reveal what the extension does under the hood. axios is the HTTP client, js-md5 and copy-to-clipboard are small helpers for the popup, ua-parser-js identifies the browser, and bowser detects the browser and platform at runtime, which is what a multi-browser extension needs. moment handles dates, lodash handles the general utility work, and xlsx is the spreadsheet export, pinned to version 0.20.3 and installed from a CDN tarball rather than from the registry.

The extension messaging package, @webext-core/messaging, handles the communication between the background script, the popup and the content scripts, which is the piece that makes the per-platform entry points work together.

## The disclaimer is the most important document here

The repository ends with a disclaimer in capitals, and it is worth reading in full before anything else, because it is unusually specific.

The project is for learning and research purposes only, must not be used for any commercial activity, and should be deleted within 24 hours of download. Users must comply with the laws of their own region, and the project and its author accept no responsibility for the consequences of unlawful use. The disclaimer then names the risks directly: the project may contain unknown defects and risks, including but not limited to device damage and account bans, and the user bears all of them. The author does not guarantee accuracy, completeness, timeliness or reliability, and accepts no losses or damages. Using the project counts as accepting the disclaimer in full, and the developer reserves the right to change it at any time.

The intellectual property statement is unusual too. The project's intellectual property belongs to the developer, who is the author of the package manifest, and users may download and use it provided they comply with the disclaimer and the law.

That is a licence-like document that is not a licence, and it sits alongside a GPL-3.0 metadata entry and a LICENSE file in the repository root. If you are thinking of running this in a business, the conflict between a copyleft grant and a disclaimer that forbids commercial use and requires deletion within a day is the thing to resolve first, and a commercial use of the open source branch needs more than a read of the badge.

There are also two privacy documents at the root, PRIVACY.md and PRIVACY.CN.md, which is where the extension's own data practices should be described, and the open source branch is explicitly the one meant for study, with the store version being the maintained one.

## Conclusion

Adopt the server branch of social-media-copilot if you need a self-hosted HTTP interface to platform data and you already operate the extension in a browser you control, since the architecture puts the real request in the extension and the server in front of it. Do not adopt it for commercial use, because the project explicitly restricts the software to learning and research and asks users to delete it within 24 hours, and do not expect a supported product, since the open source branch is a v0.x snapshot with basic maintenance only and the most complete build is closed source. Before you start, read the disclaimer and the PRIVACY.md in the repository, and weigh the stated risk of account bans against the value of the data, because the project itself names that as a possible outcome.

## FAQ

### What is social-media-copilot and which platforms does it support?

It is a browser extension for collecting data from social platforms. The open source branch supports Xiaohongshu, Douyin and Kuaishou, with the capabilities of watermark-free media download, work data, comments, creator data and creator works. The closed store version additionally covers Bilibili and TikTok.

### How does the server version of social-media-copilot work?

The server side exposes an HTTP service and proxies requests to the extension side over socket.io. The extension then makes the actual request to the platform and calls the result back to the server, so a browser with a logged-in session has to be running for the API to answer.

### How do I run social-media-copilot locally?

You need Node 18 or later, then pnpm install and pnpm dev. Once the dev server runs you open chrome://extensions/, enable developer mode, choose Load unpacked and select the output/chrome-mv3 directory, then connect the server side from the extension popup.

### What framework is social-media-copilot built on?

WXT, with the configuration in wxt.config.ts. The structure has one content script entry point per platform alongside the background and popup entry points, and the dev, build and zip scripts run wxt, wxt build and wxt zip, with separate Edge variants for each.

### What are the terms of using social-media-copilot?

The project states it is for learning and research only, must not be used for commercial activity, and should be deleted within 24 hours of download. The disclaimer also names account bans and device damage as possible risks and states the author gives no guarantee of accuracy or reliability, while the project states the licence is GPL-3.0.

## Sources

- [Issues](https://github.com/iszhouhua/social-media-copilot/issues)
- [iszhouhua/social-media-copilot on GitHub](https://github.com/iszhouhua/social-media-copilot)
- [License: GPL-3.0](https://github.com/iszhouhua/social-media-copilot/blob/main/LICENSE)
- [Project website](https://socialext.com/open-source)
- [README](https://github.com/iszhouhua/social-media-copilot/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/iszhouhua-social-media-copilot