Power-Toolkit for Power Apps by Mohammed Khawatme

Debug Power Apps and Dynamics 365 without leaving the record you are on: inspect the live form, run Web API and FetchXML queries, read plug-in traces, and review your Copilot Studio agents. One panel, your own session, every change testable before you commit to it.

Nothing is installed in your tenant: no solution to import, no service account, no admin consent.

═══════════════════════════════════════════

100% FREE AND OPEN SOURCE — MIT LICENSED
NO TELEMETRY — nothing tracked, logged, or phoned home
NO BACKEND — no servers, no sign-up, no account, no license key
NO TENANT FOOTPRINT — uninstalling leaves no trace in the environment

═══════════════════════════════════════════

It runs with your session and your security roles, so it can read and write exactly what you could through the app itself, and nothing more. The only thing it talks to is the Dataverse Web API of the environment you already have open.

WHAT IT DOES

▸ FORMS
• Inspector — live tree of tabs, sections, and controls, with in-place value editing.
• Form Columns — every column as a searchable table: live form values or the saved record.
• Event Monitor — watch OnLoad, OnSave, and OnChange fire as you interact.
• Performance — load-time breakdown, plus the form checked against Microsoft's published guidance with every finding linked to its Learn page, and an optional static scan of the form's script libraries.
• Form Automation — business rules and handlers across Main, Quick View, Quick Create, and Card forms, with a web resource editor.

▸ DATA & APIs
• WebAPI Explorer — GET, POST, PATCH, DELETE with filter groups, bulk operations, and file uploads.
• FetchXML Tester — build and run FetchXML, then convert it to C#, JavaScript, OData, SQL, or Power Automate.
• Metadata Browser — searchable dictionary of every table and column, with choice options and lookup targets.
• Custom APIs — browse, create, test, and generate code, scoped by solution.
• Environment Variables — create and edit variables and their current values.

▸ SERVER-SIDE
• Plugin Traces — live trace viewer with an outcome filter and a switch for the environment's logging level.
• Plugin Context — simulated Target with pre and post images, plus a FakeXrmEasy unit-test generator.
• Solution Layers — find and remove unmanaged customization layers.
• Power Automate — browse, toggle, and edit cloud flows: visual runAfter editing, raw JSON, and run history.

▸ AI
• AI Workbench — Copilot Studio agents, transcripts, and workflows, plus AI Builder prompts and models. Read an agent's real system prompt, map how agents connect, edit and publish, test a prompt and see its token and credit cost, and check instructions against Microsoft's guidance.

▸ SECURITY
• Impersonate — run every request as another user, then diff privileges, field security, and command bars.
• User Context — roles, teams, and session details for the current or impersonated user.

▸ WORKFLOW
• Code Hub — copy-ready Client API snippets, reviewed against Microsoft Learn.
• Settings — reorder, hide, and color tabs, configure header buttons, then export the configuration and share it with your team.
• Enter runs the query you are editing, Escape closes the dialog you are in.

WHY IT ASKS FOR WHAT IT ASKS FOR

Two permissions, and a host list of three domains:

• activeTab — acts only on the tab you open the panel from. It has no standing access to your other tabs.
• scripting — injects the panel into the page. This is what puts the UI on screen.
• https://*.dynamics.com/, https://make.powerapps.com/, https://apps.powerapps.com/ — the only sites it can run on. On every other site the extension is inert.

Just as important, what it does NOT request:

• No <all_urls>. It cannot run on your bank, your mail, or your internal apps.
• No webRequest. It cannot see or modify your network traffic.
• No cookies. It never reads your cookie jar; it uses the page's own authenticated session.
• No storage permission. Preferences live in the page's localStorage, not in extension storage.
• No tabs, history, or bookmarks.

Every API call it makes is one your browser was already entitled to make, from a page you already had open.

REQUIREMENTS

A Power Apps or Dynamics 365 environment, and an account with the privileges for whatever you are inspecting. A few tabs need a record open; the rest work anywhere in the app.

REPOSITORY

Source, documentation, and issue tracker:
https://github.com/khawatme/Power-Toolkit