JS Reverse

JS Reverse MCP is an MCP server designed for JavaScript reverse engineering. It unifies browser debugging, script analysis, network tracing, and obfuscation deconstruction into a cohesive workflow that AI clients can drive step by step to locate targets, set breakpoints, sample runtime data, and assess risks.

How to use

You run an MCP client that connects to the JS Reverse MCP server to perform automated reverse engineering tasks on JavaScript pages. Your typical workflow is to open a target page, collect scripts, locate the function or string of interest, inject hooks, observe network activity, and derive concrete next actions. The server exposes a set of capabilities that you can sequence to accomplish end-to-end analysis, from page navigation to risk reporting.

Key capabilities you will use include script and source code analysis, breakpoint control, runtime hooks, network request tracing, integrated reverse engineering workflow, DOM and page automation, session state management, and anti-detection features. These tools are accessed through a unified set of commands that you can call in order to build a complete analysis run.

How to install

Install prerequisites and build the server, then configure the MCP client to connect to it.

Step-by-step instructions to set up the server locally are shown below.

Additional sections

Configuration notes, troubleshooting guidance, and practical workflow examples are provided to help you run the server in development or production. You can adjust enabling scripts, debugging channels, and AI provider settings to tailor the experience to your environment.

Available tools

list_scripts

Enumerates all loaded scripts in the page, enabling you to locate relevant sources quickly.

get_script_source

Fetches the full source of a selected script for in-depth analysis.

find_in_script

Searches for target functions or strings within a single script to pinpoint areas of interest.

search_in_scripts

Performs a global search across all loaded scripts to locate matching patterns.

set_breakpoint

Sets a breakpoint at a specific line or code region to pause execution.

set_breakpoint_on_text

Sets a breakpoint when a specific text or pattern is encountered during execution.

resume

Resumes execution after a breakpoint has paused the runtime.

pause

Pauses the current script execution.

step_over/into/out

Controls stepping through code to inspect behavior at a granular level.

create_hook

Defines a hook point in the runtime to observe or modify behavior.

inject_hook

Injects the hook into the running page to start observation.

get_hook_data

Retrieves data collected by hooks for analysis and correlation.

hook_function

Attaches a hook to a target function to monitor inputs, outputs, and timing.

trace_function

Tracks function calls and call stacks to understand execution flow.

list_network_requests

Lists all network requests made by the page for traceability.

get_network_request

Fetches details of a specific network request, including headers and payloads.

get_request_initiator

Identifies the origin of a network request to map the call chain.

break_on_xhr

Interrupts on XMLHttpRequests to capture dynamic interactions.

analyze_target

Runs a comprehensive analysis to identify high-priority targets and risks.

collect_code

Gathers code from relevant scripts for deeper understanding.

understand_code

Interprets collected code to reveal intent and behavior.

deobfuscate_code

Deobfuscates code to expose readable logic and data flows.

risk_panel

Aggregates risk data into a structured overview for quick assessment.

navigate_page

Programmatically navigate through pages and flows.

query_dom

Query and inspect DOM elements to locate targets.

click_element

Simulate user interactions by clicking elements.

type_text

Automate typing into inputs to drive forms and login flows.

take_screenshot

Capture visual snapshots of the page at key moments.

save_session_state

Persist the current browser session state for reuse.

restore_session_state

Apply a saved session state to resume work.

list_session_states

List all available saved session states.

dump_session_state

Export a session state to a portable file.

load_session_state

Load a session state from a file or JSON.

inject_stealth

Apply anti-detection techniques to bypass basic protections.

list_stealth_presets

List available stealth presets for evasion scenarios.

set_user_agent

Override the browser user agent to mimic different clients.