RELATED 01
jshookmcp
Reverse-engineering workbench for web pages, JavaScript bundles, WASM, native processes and APKs
2.1kGitHub stars
1.3k/wknpm downloads
74popularity score
JS Reverse MCP
Debug and reverse-engineer a web page's JavaScript in a visible Chrome, with breakpoints and network capture
By Chen Shuai (individual) TypeScript Local · stdio Browser automationDeveloper tools
77 popularity score ★ 3.1k ↓ 1.2k/wk
Connect your client
Local (npm)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
Claude CodeTerminal
claude mcp add js-reverse -- npx js-reverse-mcpClaude Desktopclaude_desktop_config.json
{
"mcpServers": {
"js-reverse": {
"command": "npx",
"args": [
"js-reverse-mcp"
]
}
}
}Cursor~/.cursor/mcp.json
{
"mcpServers": {
"js-reverse": {
"command": "npx",
"args": [
"js-reverse-mcp"
]
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"js-reverse": {
"type": "stdio",
"command": "npx",
"args": [
"js-reverse-mcp"
]
}
}
}Codex~/.codex/config.toml
[mcp_servers.js-reverse]
command = "npx"
args = ["js-reverse-mcp"]Gemini CLITerminal
gemini mcp add --scope user js-reverse npx -- js-reverse-mcpLocal (from source)
Add in one click
Opens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.
Or add it by command or config
FirstTerminal
git clone https://github.com/zhizhuodemao/js-reverse-mcp.git
cd js-reverse-mcp
npm install
npm run buildClaude CodeTerminal
claude mcp add js-reverse -- node '<ABSOLUTE_PATH_TO_CLONE>/build/src/index.js'Claude Desktopclaude_desktop_config.json
{
"mcpServers": {
"js-reverse": {
"command": "node",
"args": [
"<ABSOLUTE_PATH_TO_CLONE>/build/src/index.js"
]
}
}
}Cursor~/.cursor/mcp.json
{
"mcpServers": {
"js-reverse": {
"command": "node",
"args": [
"<ABSOLUTE_PATH_TO_CLONE>/build/src/index.js"
]
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"js-reverse": {
"type": "stdio",
"command": "node",
"args": [
"<ABSOLUTE_PATH_TO_CLONE>/build/src/index.js"
]
}
}
}Codex~/.codex/config.toml
[mcp_servers.js-reverse]
command = "node"
args = ["<ABSOLUTE_PATH_TO_CLONE>/build/src/index.js"]Gemini CLITerminal
gemini mcp add --scope user js-reverse node -- '<ABSOLUTE_PATH_TO_CLONE>/build/src/index.js'What it does
JS Reverse MCP opens a visible Chrome window and hands an assistant the pieces of a JavaScript reverse-engineering session: list and search the scripts a page loaded, pull or save their source, set breakpoints by matching code text or by XHR/fetch URL, step through paused code and read scope variables, and evaluate expressions inside the paused call frame. It also records network requests with their JavaScript call stacks, groups WebSocket messages, and can wipe one site's cookies and storage so a cookie or bot-check flow can be replayed from a clean state.
Large material is meant to go to local files rather than into the chat: scripts, request bodies and headers can be exported, and evaluate_script can read one local file as input. By default it drives your installed Chrome through the maker's own Patchright fork, which avoids common automation tells at the protocol level; the --cloak flag swaps in the CloakBrowser Chromium build with fingerprint patches for sites that still block it. The profile persists logins between runs unless --isolated is given, and --browserUrl attaches to a Chrome you already started with a debugging port.
Version 4.0.5 registers 24 tools, matching the README. In the CLI source, --cloak is declared as conflicting with --browserUrl, so the stealth binary cannot be combined with attaching to an existing browser (src/cli.ts at v4.0.5); the CloakBrowser identity is kept per profile in a .cloak-seed file.
What it needs
| Runtime | Node.js 20+ |
|---|
Node.js 20.19 or newer and the stable Google Chrome on your machine. The --cloak mode downloads a CloakBrowser binary of about 200 MB on first use (the docs suggest running npx cloakbrowser install beforehand); on macOS that ad-hoc-signed binary may be stopped by Gatekeeper at first launch. No account or API key is needed.
Limits
The maker states the anti-detection work reduces known automation signals but does not promise the browser is undetectable. Network and debugger capture stay off during the first page load, so the docs advise calling list_network_requests and then reloading to see every request. --cloak cannot be used together with --browserUrl. In --cloak mode on Linux and Windows the browser presents a Windows desktop fingerprint. --browserUrl takes only a CDP HTTP endpoint, not the private local APIs of fingerprint browsers such as AdsPower or BitBrowser.
Who it suits
Suits developers and security researchers who need to find how a site builds signed parameters, tokens or cookies and want the assistant to set breakpoints and inspect runtime state, not just script clicks. It runs entirely on your own machine with a visible browser. For plain page automation or testing without debugging, a general browser server is a lighter fit; set --allowedRoots before using it anywhere shared, since file access is otherwise unrestricted. Using its stealth features against a site may conflict with that site's terms.
Tools 24
select_page- List open tabs or pick the one to debug
new_page- Open a new tab at a URL
navigate_page- Go to a URL, back, forward or reload
select_frame- List iframes or choose the execution context
click_element- Click one visible element matched strictly in the current frame
take_screenshot- Capture an image of the page
list_scripts- List every JavaScript file the page loaded
get_script_source- Fetch part of a script by line range or character offset
save_script_source- Write a whole script, including minified or WASM files, to a local file
search_in_sources- Search all scripts for a string or regular expression
set_breakpoint_on_text- Place a breakpoint by locating code text, useful in minified files
break_on_xhr- Pause when an XHR or fetch URL matches a pattern
remove_breakpoint- Remove breakpoints by ID, by URL or all at once
list_breakpoints- Show active breakpoints
get_paused_info- Report pause state, call stack and scope variables
pause_or_resume- Pause or continue script execution
step- Step over, into or out and return the new position with source context
list_network_requests- List requests, show one in detail, or export its raw headers and body to a file
clear_network_requests- Empty the collected requests and body cache after confirmation
get_request_initiator- Show the JavaScript call stack that sent a request
get_websocket_messages- List WebSocket connections, group message patterns or show one message
clear_site_data- Delete the current site's cookies and storage, optionally the HTTP cache
evaluate_script- Run JavaScript in the page or a paused frame, optionally reading a local input file or saving the result
list_console_messages- List console output or fetch one message