Skip to main content
Glama

๐Ÿ›๏ธ WebArcheology-MCP

Architected & Licensed under Proprietary (All Rights Reserved) ยท Junho Kim


Legacy web archival tools and scrapers were built in the 1990s and 2000s for a static web that no longer exists:

Tool

Architecture Limitation

Why It Fails Modern Web & Vibe Coding

HTTrack / Cyotek WebCopy

Static HTML crawler (1998 era)

Completely breaks on modern SPAs (React, Vue, Next.js, Vite), Webpack chunk splitting, client hydration, and WAFs.

SingleFile

Single-file HTML inliner

Compresses one page into a bloated monolithic data-URI string. Completely incapable of multi-page apps, API discovery, or component extraction.

ArchiveBox / Browsertrix

Archival WARC/WACZ containers

Built for library archivists; produces heavy binary WARC files. Unusable for modern developer workflows, code reconstruction, or interactive offline execution.

โœจ WebArcheology-MCP

Deep Reverse-Engineering & Synthesis Engine

Forensics + SourceMap Unpacker + Interactive Offline ServiceWorker + Vibe-Coding React/Tailwind Extractor + Stdio MCP Server.


1. ๐Ÿ” Deep Infrastructure & Network Forensics (web_recon_infrastructure)

  • Edge & CDN Identification: Detects Cloudflare Workers, Vercel Edge Network, Fastly VCL, Akamai Edge, AWS CloudFront, Fly.io, and Netlify.

  • WAF & Anti-Bot Profiling: Fingerprints Cloudflare Turnstile, DataDome, PerimeterX / HUMAN, AWS WAF, and Google reCAPTCHA.

  • Framework & Hydration Footprint: Identifies Next.js (__NEXT_DATA__, Turbopack/Webpack), Nuxt (Vue), Remix, SvelteKit, and Astro Islands.

  • Security & Headers Posture: Audits HSTS, CSP, X-Frame-Options, Permissions-Policy, and CORS access controls.

2. โšก Client-Side Bundle Decompiler & Sourcemap Unpacker (web_decompile_bundles)

  • Automatic Sourcemap Carving: Scans inline base64 sourcemaps (sourceMappingURL=data:...) and external .map files across all chunks.

  • Zero-Loss Source Reconstruction: Automatically unpacks sourcesContent into a clean, original directory structure (src/components/, src/hooks/, src/services/ etc.).

  • Unadvertised API Discovery: AST-scans minified and unbundled scripts for hidden REST endpoints (/api/..., /graphql, tRPC, query parameters, and custom headers).

3. ๐Ÿ“ฆ Interactive Offline Mirror with Mock ServiceWorker (web_clone_offline_mirror)

  • Beyond Static Screenshots: Downloads CSS, JS, WebFonts, SVGs, and images with relative URL path rewriting (assets/[hash].[ext]).

  • Zero-Network Interactive Replay: Injects a lightweight mock API ServiceWorker and fetch monkey-patch into the mirror.

  • Clickable Offline SPA: When opened locally (preview.bat / npx serve), search bars, tabs, filter buttons, and dialogs continue to work offline with simulated JSON responses!

4. ๐ŸŽจ Vibe-Coding Design Token & React Extractor (web_extract_vibe_components)

  • Instant Design Tokens: Carves all CSS variables, hex/rgb color palettes, typography hierarchies, and generates a plug-and-play tailwind.config.js extension.

  • Clean React JSX Generation: Extracts any UI section (header, nav, .hero, .pricing) and transforms raw DOM attributes into pristine, standalone React components ready for modern developer workflows!

5. ๐Ÿ“‘ Automated OpenAPI 3.0 Catalog Synthesis (web_audit_api_catalog)

  • Synthesizes a machine-readable OpenAPI/Swagger 3.0 specification representing the reverse-engineered attack surface and API schema of the target.

6. ๐Ÿงญ AST-Based Client Router & State Extraction (web_analyze_app_state)

  • Route Tree Reconstruction: Analyzes client-side router configurations across Next.js App Router (page.js, layout.js, dynamic segments), React Router DOM v6, and Vue Router, rebuilding full client-side URL route trees.

  • Global State Schema Inference: Extracts state schemas, store definitions, reducers, and action types for Redux Toolkit, Zustand, and Pinia stores directly from minified chunks.

  • Action & Dispatch Linkage: Maps frontend state transitions to outbound API endpoint calls, identifying state-driven network triggers.

7. ๐Ÿ“ก Headless CDP Live Session Capture & WebSocket Replay (web_capture_live_session)

  • Full-Spectrum Network Forensics: Connects to Chrome DevTools Protocol (CDP) or runs high-fidelity standalone interception, saving complete request/response transactions into strict HAR 1.2 archives.

  • WebSocket Message Stream Recording: Records WebSocket connection handshakes, inbound/outbound binary and text frames, timestamps, and JSON payloads.

  • Storage State Injection: Snapshots and injects HTTP cookies, localStorage keys, and sessionStorage tokens for authenticated app workflows.

  • Self-Contained Offline WebSocket Replayer: Automatically synthesizes replay_server.mjs (RFC 6455 compliant) and client bridge offline_session_bridge.js to simulate live interactive applications with zero external dependencies.

8. โšก Tailwind CSS & Radix/Shadcn UI Component Synthesizer (web_synthesize_shadcn)

  • Radix & Shadcn UI Mapping: Synthesizes type-safe, production-ready TypeScript React components from arbitrary web subtrees or raw HTML. Maps Buttons (variants: default, outline, destructive, ghost, link; sizes: sm, default, lg, icon; asChild), Cards (CardHeader, CardTitle, CardDescription, CardContent, CardFooter), Dialogs, Badges, Avatars (AvatarImage, AvatarFallback), Separators, Inputs, Textareas, and Labels.

  • Lucide React Icon Synthesis: Automatically identifies SVG path vectors, shapes, and icon classes (Chevron, Arrow, Search, Menu, X, Bell, User, Heart, Star, etc.) and replaces raw SVG blobs with clean Lucide React component imports.

  • Intelligent Dark Mode Synthesis: Detects existing dark: Tailwind classes and automatically infers/synthesizes intelligent dark mode variants for light styles (e.g., bg-white -> dark:bg-zinc-900, text-gray-900 -> dark:text-zinc-50, border-gray-200 -> dark:border-zinc-800), returning a comprehensive dark mode audit report.

  • Storybook 7/8 CSF3 Generation: Automatically exports Storybook .stories.tsx files with Default, DarkMode (decorator-wrapped), and CustomProps stories with interactive controls and ArgTypes.

9. โšก Distributed Multi-Origin Cache Optimizer & HTTP/2 Preview (web_optimize_offline_cache)

  • Content-Addressable Storage (CAS): Computes cryptographic SHA-256 digests for all downloaded assets and stores unique blobs in .cas/blobs/<sha256>. Transparently deduplicates identical files across multi-origin mirrors (cdn.domain.com vs static.domain.com) via hard-linking with automatic copy fallback.

  • Static Compression Engine: Pre-compresses text and binary assets (.html, .js, .css, .json, .svg, .wasm, .xml, .txt, .map) with Brotli (.br) and Gzip (.gz), compiling comprehensive size savings metrics.

  • Automated Cache Manifest & Graph Topology: Compiles cache_manifest.json with MIME types, raw and compressed payload byte counts, and deduplication ratios, accompanied by asset_graph.json detailing inter-asset links, origins, and duplicate clusters.

  • High-Performance Cleartext HTTP/2 & HTTP/1.1 Static Server: Pure Node.js dual-protocol multiplexing over cleartext TCP, automatic Accept-Encoding negotiation, RFC-compliant ETag headers with HTTP 304 Not Modified validation, and clean Zero-Zombie process shutdown.

10. โšก Client Bundle Time-Series Diffing & Version Drift (web_diff_bundle_releases)

  • Normalized Chunk Matching: Matches bundle chunks across deployments by stripping hash variations, tracking added, removed, and modified chunks with byte-accurate delta sizing.

  • API & Route Drift Tracking: Audits removed and modified REST/GraphQL API endpoints, flagging breaking removals (404 risks) and tracking Next.js/React/Vue route tree evolution.

  • Visual & UI Component Regression: Detects deleted components and theme token shifts (e.g. CSS custom properties) with automated risk scoring (CRITICAL, HIGH, MODERATE, LOW, SAFE).

  • Multi-Format Reporting: Synthesizes drift_manifest.json, DRIFT_REPORT.md, and an interactive, 100% self-hosted HTML visual diff dashboard (drift_visualizer.html).

11. ๐Ÿงช Automated E2E Test Harness & Playwright/Cypress Suite Generator (web_generate_e2e_harness)

  • Multi-Framework E2E Synthesis: Automatically reconstructs client route topologies, form interactions, and navigation flows into clean, idiomatic Playwright (playwright_suite.spec.mjs) and Cypress (cypress_suite.cy.js) test suites.

  • Dynamic Mock API Route Handlers: Synthesizes realistic network interception mocks (page.route / cy.intercept) with JSON fixtures derived from discovered endpoints and API schemas for deterministic, zero-network test execution.

  • Interactive HTML Flow Simulator: Compiles e2e_flow_simulator.html featuring a visual route transition graph, step-by-step state playback, mock payload inspector, and clickable journey emulator with zero external runtime dependencies.

  • Standalone Execution Rig: Generates run_e2e_rig.mjs enabling instant local test execution, regression verification, and assertion checks without heavy browser dependencies.

  • Comprehensive Audit Artifacts: Produces human-readable E2E_HARNESS_REPORT.md and structured e2e_harness_manifest.json cataloging route coverage, user journeys, and verification steps.

12. ๐Ÿงฉ WebAssembly Binary Decompiler & Declarative Memory Interface (web_decompile_wasm)

  • Zero-Dependency 12-Section Binary Decoder: Decodes all 12 standard WebAssembly binary sections (Custom, Type, Import, Function, Table, Memory, Global, Export, Start, Element, Code, and Data) directly from compiled .wasm files using pure Node.js binary buffers.

  • Inline Module Carving from Bundles: Scans minified JavaScript bundles and HTML <link rel="preload"> tags to extract embedded Base64 WASM modules (data:application/wasm;base64,...) and external binary assets.

  • Full WAT Disassembler: Reconstructs bytecode into idiomatic WebAssembly Text Format (WAT) recovering instruction streams, control flow blocks (block, loop, if/else), arithmetic instructions, and linear memory operations.

  • Declarative TypeScript Interface Generator: Automatically synthesizes type-safe .d.ts definitions describing exported functions, imported host requirements, and linear memory boundaries, alongside an instant host loader instantiation bridge.

  • Data Segment & Secret Carving: Inspects static data segments to carve embedded strings, rodata constants, lookup tables, and potential embedded secret keys.

  • Interactive Offline WebAssembly Explorer: Generates a self-contained HTML visual report (wasm_explorer.html) featuring an instruction opcode graph, section byte-distribution chart, memory segment browser, and interactive call graph navigator with zero external CDN dependencies.

13. ๐Ÿ“ฑ PWA Manifest, ServiceWorker Cache Storage & IndexedDB Forensics (web_inspect_pwa_cache)

  • Web App Manifest Extraction & Installability Audit: Parses web app manifests (manifest.json, Web App Manifest links), auditing icons (maskable/any, resolutions), theme_color, background_color, display modes (standalone, minimal-ui, fullscreen, browser), start_url, scope, orientation, shortcuts, and share_target against modern PWA installability criteria.

  • ServiceWorker & Runtime Caching Forensics: Extracts ServiceWorker registrations and lifecycle event handlers (install, activate, fetch, sync, push). Reverse-engineers runtime caching configurations including Workbox 5 strategies (CacheFirst, NetworkFirst, StaleWhileRevalidate, NetworkOnly, CacheOnly), cache expiration policies (maxEntries, maxAgeSeconds), and precache asset manifests (self.__WB_MANIFEST, cache.addAll).

  • Background Sync & Web Push Pipeline: Identifies background sync tags (workbox.backgroundSync, self.addEventListener('sync')), offline replay queues, and push notification event listeners (push, notificationclick).

  • IndexedDB Schema Inference & Sensitive Data Audit: Dissects client persistence schemas across native indexedDB, Dexie.js (db.version.stores), idb / idb-keyval, localForage, and Redux-Persist. Incurs key paths, auto-incrementing primary keys, and secondary indexes while flagging unencrypted sensitive data (tokens, authentication credentials, PII) stored in client storage.

  • PWA Resilience Scoring & Interactive Visual Inspector: Computes an offline resilience score (0-100) and letter grade (A+ to F) with categorized audit findings. Generates structured manifests pwa_manifest.json and pwa_cache_manifest.json, a human-readable audit report PWA_INSPECT_REPORT.md, and a self-contained interactive visual inspector (pwa_cache_visualizer.html) with zero external CDN dependencies.

14. ๐Ÿ” Browser Fingerprint & Client-Side Anti-Bot Profiler (web_profile_fingerprint)

  • 8 Browser Surface Vectors: Extracts and profiles client fingerprint probes across Canvas 2D (toDataURL, getImageData, measureText), WebGL/GPU (0x9245, 0x9246, extension enumeration, shader precision), AudioContext (OfflineAudioContext, oscillator frequency shaping, PCM sample hashing), Navigator & Concurrency (hardwareConcurrency, deviceMemory, Client Hints), Screen & Window geometry, Font fallback measurement, Permissions & WebRTC IP leak probes, and Headless/Automation indicators (navigator.webdriver, ChromeDriver CDC symbols).

  • Commercial Anti-Bot Sensor Detection: Automatically detects signature payloads and sensor scripts for Kasada (ips.js, kex.js), Akamai BMP (_abck, sensor_data), F5 Shape Security (_sec_cpt), Cloudflare Turnstile (challenges.cloudflare.com), DataDome (datadome.js), HUMAN / PerimeterX (_pxVid), FingerprintJS (fp.js), and Arkose Labs FunCaptcha.

  • Shannon Entropy Analysis: Evaluates Shannon entropy across script blocks to identify polymorphic obfuscation, packed scripts, and high-entropy encryption routines (> 5.8 bits/byte).

  • Mitigation Scoring & Self-Hosted Dashboard: Calculates a unified Bot Mitigation Index (0-100) and defense classification grade (NONE to EXTREME), generating fingerprint_profile_manifest.json, FINGERPRINT_REPORT.md, and an interactive visual dashboard (fingerprint_visualizer.html) with zero external CDN dependencies.

15. ๐Ÿ”„ Real-Time Collaboration & CRDT State Decompiler (web_inspect_crdt_state)

  • CRDT Framework Identification: Scans and identifies client collaboration stacks across Yjs (yjs, y-websocket, y-webrtc, y-indexeddb), Automerge (@automerge/automerge, actor DAG changes), Liveblocks (@liveblocks/client, LiveObject, LiveMap), ShareDB / OT (ot-json0), and local-first sync engines (Replicache, ElectricSQL, Logux).

  • Binary Vector Clock & State Vector Decoding: Pure Node.js zero-dependency VarUint (LEB128), VarInt, and VarString stream decoding. Decodes Yjs SyncStep1 state vectors, SyncStep2 / Update deltas, and multi-user awareness/presence streams into a synchronized vector clock matrix (Map<clientId, clock>).

  • Document State Tree Reconstruction: Reconstructs hierarchical collaborative document trees (Maps, Arrays, Rich-Text with character-level operation history and Lamport timestamp conflict resolution).

  • Collaboration Health Scoring & Interactive Dashboard: Computes a unified Collaboration Health Index (0-100) and grade (A+ to F) assessing protocol security, vector compactness, presence efficiency, and persistence readiness. Generates crdt_inspect_manifest.json, CRDT_INSPECT_REPORT.md, and an interactive visual dashboard (crdt_state_visualizer.html) with zero external CDN dependencies.

16. ๐ŸŽฌ Streaming Media Pipeline & DRM Forensics (web_inspect_media_pipeline)

  • Manifest Decompiler & Timeline Reconstruction: Parses RFC 8216 HLS Master/Media playlists (.m3u8, #EXT-X-STREAM-INF, #EXTINF, #EXT-X-KEY, #EXT-X-MAP) and ISO/IEC 23009-1 MPEG-DASH manifests (.mpd, AdaptationSets, Representations, SegmentTemplate, SegmentTimeline), reconstructing multi-bitrate ladders and segment timelines.

  • Protection System Specific Header (PSSH) Decoding: Pure Node.js binary and Base64 PSSH box decoder with automatic SystemID identification (Google Widevine, Microsoft PlayReady, Apple FairPlay, W3C ClearKey, ISO/IEC CENC), Key ID (KID) extraction, and private data carving.

  • Client-Side EME Forensics & Player Detection: Audits Encrypted Media Extensions (EME) JavaScript API calls (requestMediaKeySystemAccess, createMediaKeySession), hardware security robustness levels (HW_SECURE_ALL L1 vs SW_SECURE_CRYPTO L3), license server endpoints, and video player libraries (Hls.js, Shaka Player, Dash.js, Video.js, JW Player, Clappr, Plyr).

  • Pipeline Health Scoring & Interactive Visualizer: Computes a unified Media Pipeline Health Score (0-100, A+ to F) assessing manifest standards, bitrate headroom, cryptographic robustness, and player integration. Generates media_pipeline_manifest.json, MEDIA_PIPELINE_REPORT.md, and an interactive visual dashboard (media_pipeline_visualizer.html) with zero external CDN dependencies.

17. ๐ŸŽฎ WebGL & WebGPU Shader Pipeline Reverser & 3D Decompiler (web_decompile_shaders)

  • Binary GLB & glTF 2.0 Geometry Decoding: Pure Node.js zero-dependency binary GLB container and glTF 2.0 parser extracting chunk headers, bufferViews, accessors, mesh geometry attributes (positions, normals, UVs, tangents), and embedded PBR texture buffers.

  • GLSL & WebGPU WGSL Static Analysis: Reverse-engineers vertex, fragment, and compute shaders across GLSL ES 1.00/3.00 and modern WebGPU WGSL. Extracts uniform/storage buffer layouts, @group and @binding decorators, @workgroup_size dimensions, variable bindings, and shader complexity metrics.

  • 3D Framework Forensics & PBR Material Mapping: Detects web 3D engines (Three.js, Babylon.js, PlayCanvas, A-Frame, PixiJS, CesiumJS, Model-Viewer, Spline) and maps complete PBR material parameter trees (albedo, roughness, metallic, normal maps, emissive factors).

  • Pipeline Health Scoring & Interactive 3D Visualizer: Computes a unified 3D Pipeline Health Score (0-100, A+ to F) evaluating draw call efficiency, uniform compactness, texture memory overhead, and shader execution complexity. Generates shader_decompile_manifest.json, SHADER_DECOMPILE_REPORT.md, and a standalone interactive 3D shader visualizer (shader_pipeline_visualizer.html) with zero external CDN dependencies.

18. ๐Ÿงฌ GraphQL Schema & gRPC-Web Interface Synthesizer (web_reconstruct_schema)

  • AST Query Extraction & Schema Inversion: Statically carves gql tagged template literals, Apollo/urql operations, and network payloads into AST representations. Reconstructs a unified, valid GraphQL Schema Definition Language (schema.graphql) with type Query, type Mutation, type Subscription, object types, input schemas, and inferred primitive/complex scalar types (ID, String, Int, Float, Boolean, DateTime).

  • Zero-Dependency Protobuf v3 Wire Decoding: Pure Node.js binary wire parser (decodeProtobufWire) decoding Varint (LEB128), Fixed64, Fixed32, and recursively unpacking embedded length-delimited sub-messages, packed fields, and UTF-8 strings.

  • gRPC-Web 5-Byte Framed Stream Demultiplexing: Decompresses and unpacks gRPC-Web framing flags (data vs. trailer frames) across standard and base64-encoded application/grpc-web-text HTTP streams.

  • Service & Method Carving (.proto): Carves service and RPC method registrations from client stubs and synthesizes production-ready Protobuf v3 (service_definitions.proto) files.

  • Schema Health Scoring & Interactive Visualizer: Computes an API Architecture Health Score (0-100, A+ to F) evaluating operation diversity, field resolution rate, and protocol integrity. Outputs machine-readable manifest schema_reconstruct_manifest.json, high-signal audit report SCHEMA_RECONSTRUCT_REPORT.md, and a standalone interactive HTML visualizer (schema_visualizer.html) with zero external CDN dependencies.


1. Run via Claude Desktop / Cursor / Any MCP Client

Add to your claude_desktop_config.json or mcp_servers.json:

{
  "mcpServers": {
    "webarcheology": {
      "command": "node",
      "args": ["c:/github_iko098567/webarcheology-mcp/src/index.mjs"]
    }
  }
}

2. Standalone CLI Usage

# Deep infrastructure and security audit
node bin/cli.mjs recon https://example.com

# Decompile frontend bundles and unpack sourcemaps to disk
node bin/cli.mjs decompile https://example.com --unpack ./reconstructed_src

# Clone an interactive offline mirror with mock APIs
node bin/cli.mjs mirror https://example.com ./my_offline_mirror

# Optimize offline cache, deduplicate multi-origin assets (CAS) and launch HTTP/2 preview server
node bin/cli.mjs cache ./my_offline_mirror --preview

# Diff two release deployments and track breaking changes, APIs, and chunk sizes
node bin/cli.mjs diff ./release_v1 ./release_v2 --out ./bundle_diff_report

# Extract design tokens & standalone React component for vibe coding
node bin/cli.mjs vibe https://example.com header

# Synthesize clean TypeScript Shadcn UI component with Lucide icons & dark mode
node bin/cli.mjs shadcn https://example.com header --name MainHeader

# Analyze client-side routing trees and state stores (Redux, Zustand, Pinia)
node bin/cli.mjs state https://example.com

# Capture live dynamic session into HAR 1.2 archive and generate offline WebSocket replayer
node bin/cli.mjs session https://example.com --duration 5000 --out ./live_session

# Synthesize automated Playwright & Cypress E2E test suites with mock routes and flow simulator
node bin/cli.mjs harness https://example.com --out ./e2e_suite

# Decompile WebAssembly binary or carved module into WAT, TypeScript interfaces, and interactive explorer
# Options: --out <dir>, --no-wat, --no-ts, --no-html, --no-json
node bin/cli.mjs wasm ./app.wasm --out ./wasm_decompiled

# Decompile embedded WASM from live URL or bundle with selective outputs
node bin/cli.mjs wasm https://example.com/engine.wasm --out ./wasm_out --no-wat

# Audit PWA manifest, ServiceWorker caches, background sync, and IndexedDB schemas
# Options: --out <dir>, --no-html, --no-json, --no-md, --no-sw, --no-idb
node bin/cli.mjs pwa https://example.com --out ./pwa_audit

# Inspect local offline directory or mirror for PWA assets and persistence schemas
node bin/cli.mjs pwa ./my_offline_mirror --no-html
# Profile client-side fingerprinting surfaces & anti-bot telemetry
# Options: --out <dir>, --no-html, --no-json, --no-md, --no-entropy
node bin/cli.mjs fingerprint https://example.com --out ./fingerprint_report

# Decompile CRDT document states, decode vector clocks, and inspect real-time collaboration peers
# Options: --out <dir>, --no-html, --no-json, --no-md
node bin/cli.mjs crdt https://example.com --out ./crdt_report

# Inspect HLS/DASH streaming pipeline, bitrate ladders, PSSH box, and DRM EME APIs
# Options: --out <dir>, --no-html, --no-json, --no-md
node bin/cli.mjs media https://example.com/stream.m3u8 --out ./media_report

# Decompile WebGL/WebGPU shaders, parse GLB/GLTF geometry buffers, and inspect 3D scenes
# Options: --out <dir>, --no-html, --no-json, --no-md
node bin/cli.mjs shader https://example.com/scene.glb --out ./shader_report

# Reconstruct GraphQL SDL and gRPC-Web proto3 definitions from client bundles
# Options: --out <dir>, --no-html, --no-json, --no-md, --no-graphql, --no-proto
node bin/cli.mjs schema ./client_dist --out ./schema_artifacts

WebArcheology includes a comprehensive, zero-dependency test suite validating all subsystems:

node tests/run_all.mjs
===============================================================
๐Ÿงช RUNNING WEBARCHEOLOGY-MCP COMPREHENSIVE TEST SUITE
===============================================================
  โœ“ mcp_protocol.test.mjs passed
  โœ“ recon.test.mjs passed
  โœ“ decompiler.test.mjs passed
  โœ“ mirror.test.mjs passed
  โœ“ vibe.test.mjs passed
  โœ“ app_state.test.mjs passed
  โœ“ session_capture.test.mjs passed
  โœ“ shadcn_synthesizer.test.mjs passed
  โœ“ offline_cache.test.mjs passed
  โœ“ bundle_diff.test.mjs passed
  โœ“ e2e_harness.test.mjs passed
  โœ“ wasm_decompiler.test.mjs passed
  โœ“ pwa_cache_forensics.test.mjs passed
  โœ“ fingerprint_profiler.test.mjs passed
  โœ“ crdt_state_inspector.test.mjs passed
  โœ“ media_pipeline_inspector.test.mjs passed
  โœ“ shader_decompiler.test.mjs passed
  โœ“ schema_reconstructor.test.mjs passed
๐ŸŽ‰ ALL 18/18 TEST SUITES PASSED CLEANLY! (Exit 0)
===============================================================

This project is licensed under the Proprietary & Confidential Software License. All Rights Reserved.
Unauthorized copying, mirroring, modification, distribution, or commercial deployment is strictly prohibited.
Third-party upstream open-source attributions are preserved in NOTICE.

Available Tools

18 tools
web_analyze_app_stateC

Forensically reconstructs client-side route topologies (Next.js App Router, React Router, Vue Router) and global state stores (Zustand, Redux, Pinia) with inferred TypeScript interfaces and action creators from bundles and sourcemaps.

NameRequiredDescriptionDefault
urlYesTarget website URL
maxScriptsNoMaximum number of script chunks to analyze (default: 25)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden, yet it says nothing about network fetching cost, how many requests it makes, whether it fails without sourcemaps, or how long a 25-chunk analysis takes. The only behavioral hint is the word 'forensically', which does not tell the agent what to expect operationally.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with zero filler; the core action and the framework families are front-loaded. It is information-rich but slightly overloaded with parenthetical lists, which is acceptable given there is no other text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex analysis tool with no annotations and no output schema, the description names the deliverables at a high level (route topologies, state stores, inferred interfaces) but omits return shape, sourcemap dependency, and failure modes. It is minimally sufficient to select the tool but not to predict its output or cost.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both 'url' and 'maxScripts' are already documented in the schema, and the description adds no additional meaning such as what a script chunk is or how quality degrades below the default. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource pair ('forensically reconstructs client-side route topologies and global state stores') and names the frameworks it handles plus the artifacts it produces (TypeScript interfaces, action creators). It is clearly distinguished from a plain bundle decompiler, though it never explicitly contrasts itself with web_decompile_bundles or web_reconstruct_schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool, when not to, or which sibling to prefer. The agent must infer usage from the phrase 'forensically reconstructs', with no prerequisites (e.g. whether sourcemaps must be present) or alternatives named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_audit_api_catalogB

Scans client-side bundles of a target site to produce a comprehensive OpenAPI 3.0 specification of all internal, unadvertised API routes, methods, and endpoints.

NameRequiredDescriptionDefault
urlYesTarget website URL

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It reveals the mechanism (fetching and scanning client-side JS bundles) and the output format, but says nothing about whether this issues many network requests to the target, how long or how deep the scan runs, whether it is passive or detection-prone, or what happens on unreachable/locked-down sites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single well-formed sentence with the mechanism and the deliverable front-loaded, no filler. It is compact, though the density means the scope constraints an agent needs are simply absent rather than condensed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a one-parameter tool with no annotations and no output schema, the description does state the concrete return artifact (an OpenAPI 3.0 spec), which is the key missing piece elsewhere. Remaining gaps about scan scope and failure modes are real but modest for a tool this simple.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter and schema coverage is 100% ('Target website URL'), so the schema already does the work. The description adds nothing about what the URL should be โ€” root origin vs a deep page path โ€” which would materially change results, so this is baseline rather than above it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ('Scans client-side bundles') plus a concrete deliverable ('comprehensive OpenAPI 3.0 specification of all internal, unadvertised API routes'). An agent can distinguish it from web_decompile_bundles or web_reconstruct_schema by the OpenAPI-route-catalog output, though those siblings are never named.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use, when-not-to-use, or prerequisite (target reachability, auth, scope of crawl). Nothing steers the agent between this and adjacent siblings like web_reconstruct_schema or web_decompile_bundles, so selection is left entirely to inference from the noun phrase.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_capture_live_sessionB

Captures live dynamic web sessions, intercepts HTTP/XHR/Fetch traffic into strict HAR 1.2 format, records WebSocket frame streams, snapshots cookies/localStorage state, and generates a self-contained offline WebSocket replay server.

NameRequiredDescriptionDefault
urlYesTarget website URL to capture (e.g. https://example.com)
saveHarNoWhether to compile and save strict HAR 1.2 archive (default: true)
outputDirNoLocal directory to save session artifacts (default: ./live_session)
injectStateNoOptional cookies, localStorage, and sessionStorage to inject during capture
interactiveMockNoGenerate offline WebSocket replayer and mock bridge (default: true)
recordWebSocketsNoWhether to record WebSocket connections and frame streams (default: true)
maxNetworkEntriesNoMaximum number of HTTP network transactions to record (default: 100)
sessionDurationMsNoDuration to record live session in milliseconds (default: 5000)

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses useful facts (HAR 1.2 output, WebSocket replay server generation, live recording), but stays silent on side effects such as writing artifacts to disk, launching a browser, capture latency/cost, and whether the session is time-bounded by default. Slightly better than adequate but leaves meaningful gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence leads with the core action before listing capabilities, so the agent gets the gist immediately. The dense enumeration is slightly list-like but every clause corresponds to a real feature, so little is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter mutation tool with no annotations and no output schema, the description covers what the tool produces but omits operational context (disk writes, browser requirements, duration defaults, failure modes). It is minimally sufficient for an agent that reads the schema, but not self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all eight parameters are already documented, giving a baseline of 3. The description loosely maps its capability list onto flags (WebSocket recording, cookie/localStorage state), but it doesn't clarify the injection-vs-snapshot distinction or default behaviors beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ('Captures live dynamic web sessions') and enumerates four concrete capabilities (HAR 1.2 capture, WebSocket frame recording, cookie/localStorage snapshotting, offline replay server generation). It is clearly distinguishable in intent, though it never names or contrasts against nearby siblings like web_clone_offline_mirror or web_inspect_pwa_cache.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to reach for this tool versus alternatives, nor any stated prerequisites (e.g. headless browser availability, permissions). The usage is implied by the capability list but an agent must infer the selection criteria itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_clone_offline_mirrorB

Clones a website into an interactive 100% offline-playable mirror with relative asset URL rewrites and an injected mock API ServiceWorker/fetch interceptor so client-side SPAs remain interactive offline.

NameRequiredDescriptionDefault
urlYesTarget website URL to mirror
maxAssetsNoMaximum assets (CSS, JS, Fonts, Images) to download (default: 60)
outputDirNoLocal directory to save offline mirror (default: ./offline_mirror)
includeMockApiNoInject offline mock API interceptor for interactive SPA simulation (default: true)

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose real behavior: it rewrites asset URLs to relative paths and injects a ServiceWorker/fetch mock so SPAs stay interactive offline. It omits important side-effect context โ€” that it writes files to a local directory, what happens on failure or partial download, and the time/network cost of crawling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; every clause (offline mirror, URL rewrites, mock API interceptor, SPA interactivity) contributes distinct information. It is dense to the point of being a run-on, which slightly hurts readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description should state what the tool returns (a directory path? a manifest?) and note disk-write side effects. It explains the artifact well but leaves the return value and failure behavior unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so url, maxAssets, outputDir, and includeMockApi are all documented in the schema. The description mentions asset crawling and the mock API injection conceptually but adds no syntax, format, or default detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb plus resource: 'clones a website into an interactive 100% offline-playable mirror', and it names the distinguishing mechanisms (relative URL rewrites, injected mock API interceptor). It never mentions how it differs from sibling tools like web_optimize_offline_cache or web_inspect_pwa_cache, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no exclusions, and no named alternative. The agent must infer from 'offline mirror' alone whether this or web_optimize_offline_cache, web_capture_live_session, or web_inspect_pwa_cache is the right call.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_decompile_bundlesB

Decompiles modern frontend JavaScript chunks (Webpack/Vite/Turbopack), extracts and reconstructs original source files from sourcemaps into clean directories, and carves all internal API endpoints.

NameRequiredDescriptionDefault
urlYesTarget website URL
outputDirNoTarget directory for unpacked sources (default: ./decompiled_sources)
maxScriptsNoMaximum number of script chunks to decompile (default: 25)
unpackToDiskNoWhether to unpack reconstructed source files to local disk (default: false)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It says sources are reconstructed 'into clean directories,' which reads as always-on disk writes, while the schema's unpackToDisk parameter defaults to false โ€” the description never clarifies that disk output is opt-in. It also omits network/auth requirements, scope of crawling, output size/volume, and whether anything is mutated or overwritten in outputDir.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, leading with the primary action. It is dense โ€” three capabilities packed into one clause chain โ€” but nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-stage tool with no annotations and no output schema, the description covers what it does but not what an agent needs to run it safely: whether the target must be publicly reachable, whether output goes to disk by default, and roughly what the result contains (file tree, endpoint list). Adequate but with visible gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters including defaults are already documented in structured form. The description adds no extra semantics about url scope, chunk selection behavior, or what maxScripts truncation means in practice, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names three concrete operations with specific verbs and resources: decompiling Webpack/Vite/Turbopack JS chunks, reconstructing sources from sourcemaps, and carving internal API endpoints. The mention of modern frontend bundlers clearly separates it from siblings like web_decompile_wasm and web_decompile_shaders.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No indication of when to reach for this tool versus alternatives such as web_clone_offline_mirror, web_diff_bundle_releases, or web_audit_api_catalog, even though the endpoint-carving capability overlaps with the latter. No prerequisites, no conditions, no exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_decompile_shadersB

Decompiles client-side 3D graphics and shader pipelines: decodes binary GLB container chunks and glTF 2.0 PBR materials, analyzes GLSL ES 1.00/3.00 and WebGPU WGSL shaders, fingerprints 3D rendering engines (Three.js/Babylon.js), and synthesizes interactive 3D visualizers.

NameRequiredDescriptionDefault
targetYesTarget website URL, GLB/glTF model file, shader file (.vert/.frag/.wgsl), or local folder with 3D client bundles
outputDirNoTarget directory for shader decompile artifacts (default: ./shader_report)
generateHtmlNoGenerate standalone interactive shader_pipeline_visualizer.html (default: true)
generateJsonNoGenerate structured shader_decompile_manifest.json (default: true)
generateMarkdownNoGenerate SHADER_DECOMPILE_REPORT.md audit report (default: true)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does not state that the tool writes files to disk (via outputDir), overwrites existing artifacts, or requires specific permissions. The phrase 'synthesizes interactive 3D visualizers' hints at output generation but does not clarify side effects or safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently lists the tool's capabilities without filler. It could be slightly more scannable (e.g., broken into bullet points), but it remains concise and informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with five parameters and no output schema, the description is missing key context about return values, file-writing behavior, and the relationship between the generateHtml/generateJson/generateMarkdown flags and the actual outputs. It covers what is analyzed but not what the agent should expect as a result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all five parameters in detail. The description does not add any parameter-specific meaning beyond what the schema provides; it mentions file types that are already covered in the target parameter's description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('decompiles') and a precise resource scope: 3D graphics and shader pipelines, covering GLB chunks, glTF materials, GLSL/WGSL shaders, engine fingerprinting, and visualizer synthesis. This clearly distinguishes it from sibling tools like web_decompile_bundles (JS bundles) and web_decompile_wasm (WebAssembly).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for 3D/shader content by naming the file types and analysis tasks, but it provides no explicit guidance on when to choose this tool over alternatives such as web_decompile_bundles. No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_decompile_wasmA

Decompiles WebAssembly binaries or carved Base64 WASM modules from web bundles into WebAssembly Text Format (WAT), synthesizes declarative TypeScript memory interfaces (.d.ts) and host loaders, carves data strings/secrets, and creates an interactive visual WebAssembly Explorer.

NameRequiredDescriptionDefault
targetYesTarget .wasm file path, URL, or JavaScript bundle/HTML file containing embedded Base64 WASM modules
outputDirNoOutput directory for decompiled artifacts (default: ./wasm_decompiled)
generateWatNoGenerate full WebAssembly Text Format (.wat) disassembly (default: true)
generateManifestNoGenerate structured wasm_decompile_manifest.json (default: true)
generateMarkdownNoGenerate WASM_DECOMPILE_REPORT.md audit report (default: true)
generateTypeScriptNoGenerate typed TypeScript memory interfaces (.d.ts) and loader bridge (default: true)
generateHtmlExplorerNoGenerate self-contained interactive wasm_explorer.html report (default: true)

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries the burden: it usefully reveals that the tool writes multiple artifact files, carves embedded strings/secrets from data sections, and produces a self-contained interactive HTML report โ€” non-obvious side effects worth knowing. It omits whether outputDir is created or overwritten, whether URL targets require network egress, and whether the operation is purely read-only against the source target.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence led by the action verb, with the artifact list appended in priority order. Dense but every clause names a distinct capability that maps to a required flag or output; nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with no annotations and no output schema, the description does explain the generated artifacts, which is the main unknown. It leaves gaps on filesystem side effects (overwrite behavior of outputDir), network requirements for URL targets, and what the tool returns to the caller, which an agent needs before invoking it in a loop.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with per-parameter descriptions and defaults, so the schema already documents target, outputDir, and all five generate* toggles. The description restates that these outputs exist but adds no syntax, format, or default rationale beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb ("Decompiles") and named resources (WebAssembly binaries or carved Base64 WASM modules), then enumerates the concrete artifacts produced (WAT, .d.ts interfaces, host loaders, carved secrets, HTML explorer). An agent immediately knows what it does and what it emits, though it never distinguishes itself from the adjacent web_decompile_bundles or web_decompile_shaders siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied by the accepted inputs (a .wasm file or a JS bundle/HTML containing embedded Base64 WASM), so the agent can infer this is the tool to reach for when the WASM payload is the target rather than the surrounding bundle. There is no explicit when-to-use / when-not guidance and no pointer to the decompile-bundles or decompile-shaders alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_diff_bundle_releasesB

Compares two client web releases (local directories or live URLs), detecting changed JavaScript chunks, deleted/added API endpoints, client routes, UI components, and generating visual regression and breaking change reports.

NameRequiredDescriptionDefault
outputDirNoTarget directory for reports (default: ./bundle_diff_report)
baseTargetYesBaseline release target (local directory path or URL)
currentTargetYesCurrent release target (local directory path or URL)
generateHtmlReportNoGenerate interactive standalone drift_visualizer.html (default: true)
generateJsonManifestNoGenerate machine-readable drift_manifest.json (default: true)
generateMarkdownReportNoGenerate comprehensive DRIFT_REPORT.md (default: true)

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden: it discloses that reports are generated (visual regression and breaking change), which hints at filesystem writes, but omits whether live URL targets require auth/network access, cost or timing implications, and whether output artifacts are overwritten in outputDir.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that packs the operation, inputs, and output artifacts without filler. It is dense but readable; slightly long as one sentence but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, multi-artifact tool with no annotations and no output schema, the description defines the analysis scope well but leaves gaps: what the returned result looks like (paths vs. summary), behavior when targets are unreachable, and any side effects on an existing output directory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all six parameters already have documented semantics and defaults. The description's parenthetical '(local directories or live URLs)' corroborates baseTarget/currentTarget but adds no format, constraint, or interaction detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('compares') and resource ('two client web releases') plus the artifacts it derives (chunks, endpoints, routes, components, reports). An agent can tell this apart from siblings like web_decompile_bundles or web_analyze_app_state, though it doesn't name those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the requirement of two targets (baseline + current), but the description never states when to use this versus web_decompile_bundles, web_audit_api_catalog, or web_analyze_app_state, nor any prerequisites such as access to a live URL.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_extract_vibe_componentsB

Extracts design tokens (colors, font hierarchy, Tailwind theme extension) and converts target DOM elements (header, hero, nav, etc.) into clean, standalone React JSX components for immediate vibe coding.

NameRequiredDescriptionDefault
urlYesTarget website URL
selectorNoDOM tag or selector to extract into React JSX (default: header)

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full behavioral burden. It does disclose the substantive outputโ€”design tokens plus standalone JSXโ€”but says nothing about network behavior, timeouts, auth requirements, whether rendering is headless, or how partial failures are reported for what is clearly a remote-fetch operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads the two output artifacts and ends with the use case. It is efficient, though the parenthetical lists make it slightly overloaded for one sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema and no annotations, the description should pin down the return shape (e.g., tokens as JSON plus JSX as string, single vs. multiple files). It gestures at the outputs but leaves the response structure and failure modes unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented, making 3 the baseline. The description does add modest value by illustrating selector values ('header, hero, nav'), but does not clarify accepted selector syntax (CSS selector vs. tag name) or what happens when the selector matches nothing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs specific verbs with specific artifacts: extracting design tokens (colors, font hierarchy, Tailwind theme) and converting DOM elements into standalone React JSX components. It is far more informative than a tautology, but it never names or contrasts with the closest sibling, web_synthesize_shadcn, which likely also emits components.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to reach for this tool versus alternatives such as web_synthesize_shadcn or web_clone_offline_mirror, and no preconditions (e.g., site must be publicly reachable, JS-rendered content). The only hint of context is the phrase 'for immediate vibe coding,' which signals intent but not selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_generate_e2e_harnessB

Extracts client routes, forms, and API schemas to automatically synthesize Playwright and Cypress end-to-end integration test suites, dynamic network mock handlers, an interactive flow simulator, and standalone execution rig.

NameRequiredDescriptionDefault
targetYesTarget website URL or local directory path
mockApisNoGenerate network mock route handlers and fixtures (default: true)
frameworkNoTesting framework to synthesize (playwright, cypress, or both; default: both)
outputDirNoTarget directory for E2E harness (default: ./e2e_harness)
generateRunnerNoGenerate standalone run_e2e_rig.mjs execution script (default: true)
generateVisualizerNoGenerate interactive standalone e2e_flow_simulator.html (default: true)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It implies file generation but does not disclose side effects such as whether outputDir is overwritten, whether network access to target is required, or what happens to existing files. It also omits any return-value or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single sentence is front-loaded with the core action and lists outputs efficiently. It is dense but every clause contributes to scope, with no obvious filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter generation tool that writes files and produces multiple artifacts, the description is missing key operational context: preconditions, whether it writes to disk, overwrite behavior, and what the caller receives. No annotations or output schema exist to fill those gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter including defaults and allowed framework values. The description does not add parameter-level meaning beyond what the schema provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-plus-resource construction: extracts routes/forms/API schemas to synthesize Playwright and Cypress E2E suites, mocks, simulator, and runner. This clearly distinguishes it from sibling tools like web_audit_api_catalog or web_synthesize_shadcn.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states what the tool generates but gives no guidance on when to choose it over alternatives such as web_audit_api_catalog or web_analyze_app_state. There are no exclusions, prerequisites, or contextual triggers for use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_inspect_crdt_stateC

Decompiles real-time collaboration engines and CRDT state synchronization protocols (Yjs, Automerge, Liveblocks, ShareDB), decodes binary vector clocks and Lamport timestamps, reconstructs document state trees, and synthesizes interactive conflict resolution visualizers.

NameRequiredDescriptionDefault
targetYesTarget website URL, client bundle file, or directory with captured WebSocket frames
outputDirNoTarget directory for CRDT audit artifacts (default: ./crdt_inspect_report)
generateHtmlNoGenerate standalone interactive crdt_state_visualizer.html (default: true)
generateJsonNoGenerate structured crdt_inspect_manifest.json (default: true)
generateMarkdownNoGenerate CRDT_INSPECT_REPORT.md audit report (default: true)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, yet it reads as a feature list. It never states whether 'target' as a URL triggers live network access, what permissions are needed, whether WebSocket frames are captured live or read from disk, or what the generated artifacts contain beyond their filenames. The composite, potentially heavyweight nature of the tool is undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single sentence with no filler words, but it is a dense, comma-chained list of four capabilities rather than a front-loaded statement of purpose. The agent must parse the whole run-on to extract what the tool does, and the visualizer clause adds length without routing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With five parameters, no output schema, and no annotations, the description should explain behavior and outputs more fully. It covers the capability surface and the schema covers the flags, but how the target is consumed, what capture is required for WebSocket input, and what the audit artifacts report are left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all five parameters, including the three generate flags and outputDir, are already documented in the schema. The description adds no syntax or format meaning beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs and named resources: 'decompiles... CRDT state synchronization protocols (Yjs, Automerge, Liveblocks, ShareDB),' 'decodes binary vector clocks,' 'reconstructs document state trees.' This is far more concrete than a tautology, but it stacks four distinct capabilities into one tool, making it hard to know the single primary action, and it never names a sibling it differs from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance, no prerequisites, and no exclusions. An agent cannot tell from the text when to pick this over web_decompile_bundles or web_analyze_app_state, which plausibly overlap with bundle and app-state inspection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_inspect_media_pipelineC

Decompiles streaming media pipelines (HLS .m3u8, MPEG-DASH .mpd), reconstructs media segment timelines and adaptive bitrate ladders, decodes ISO Protection System Specific Header (PSSH) boxes, and audits Encrypted Media Extensions (EME) key exchange APIs.

NameRequiredDescriptionDefault
targetYesTarget website URL, manifest URL, or local folder containing .m3u8/.mpd manifests and media player bundles
outputDirNoTarget directory for media pipeline audit artifacts (default: ./media_pipeline_report)
generateHtmlNoGenerate standalone interactive media_pipeline_visualizer.html (default: true)
generateJsonNoGenerate structured media_pipeline_manifest.json (default: true)
generateMarkdownNoGenerate MEDIA_PIPELINE_REPORT.md audit report (default: true)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden and falls well short. It doesn't say whether a URL target triggers live network fetches, whether authentication or cookies are required, whether any target files are modified, or what happens when no manifest is found. Only the target description hints that local folders and remote URLs are both accepted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with no filler, front-loaded on the core capability. It is jargon-heavy (PSSH, EME, ABR ladder) but each clause names a real, distinct audit dimension rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema covers outputs and flags, so the description needn't restate them, and there is no output schema to explain. But for a tool that fetches remote manifests and emits artifacts, the absence of any note on network access, safety, or failure modes leaves a meaningful gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all five parameters are already documented with defaults and types. The description adds nothing about parameter behavior (e.g., how outputDir interacts with the three format flags, or what 'target website URL' crawling entails), so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Concrete verbs (decompiles, reconstructs, decodes, audits) applied to a specific resource: HLS/DASH streaming pipelines, segment timelines, ABR ladders, PSSH boxes, EME APIs. The domain is unambiguous and clearly distinct from siblings like web_decompile_bundles or web_decompile_wasm, though it never explicitly distinguishes itself from them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No statement of when to pick this tool over web_decompile_bundles, web_capture_live_session, or web_analyze_app_state, all of which an agent could plausibly confuse with media pipeline analysis. No prerequisites or trigger conditions given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_inspect_pwa_cacheC

Audits Web App Manifests for installability, reverse-engineers ServiceWorker caching strategies and precache manifests, discovers background sync/push listeners, extracts IndexedDB schemas, and audits unencrypted credentials with an interactive visualizer dashboard.

NameRequiredDescriptionDefault
targetYesTarget website URL or local directory/file path containing PWA manifests, ServiceWorker scripts, or client bundles
outputDirNoTarget directory for audit artifacts (default: ./pwa_inspect_report)
generateHtmlNoGenerate standalone interactive pwa_cache_visualizer.html (default: true)
generateJsonNoGenerate structured pwa_cache_manifest.json (default: true)
generateMarkdownNoGenerate PWA_INSPECT_REPORT.md audit report (default: true)
inspectIndexedDbNoInspect client bundles for IndexedDB persistence schemas and sensitive credentials (default: true)
inspectServiceWorkerNoInspect ServiceWorker scripts for caching policies and event listeners (default: true)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, yet it does not state whether the tool is read-only, what network or filesystem access is required, or that it writes audit artifacts to outputDir. It also does not address the sensitivity of extracting unencrypted credentials beyond naming the capability.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single long, comma-heavy sentence that lists many capabilities without structural breaks. It is compact and front-loads the manifest audit, but the run-on enumeration makes it harder to scan than a deliberately structured summary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema fully documents all seven parameters, which reduces the description's burden, and the description does enumerate the main inspection capabilities. However, with no annotations and no output schema, it still omits prerequisites, side effects, and how the generated artifacts should be interpreted, leaving meaningful context gaps for a multi-feature audit tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter including target, outputDir, and the generate/inspect flags is already documented in the input schema. The description adds no parameter-specific meaning beyond the operation names that the schema also covers, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs and resources โ€” auditing Web App Manifests, reverse-engineering ServiceWorker caches, extracting IndexedDB schemas โ€” so the tool's scope is clear. However, it bundles several capabilities into one sentence and never distinguishes itself from siblings such as web_optimize_offline_cache, web_reconstruct_schema, or web_analyze_app_state.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool, when not to use it, or which sibling to choose for adjacent tasks like offline caching optimization or schema reconstruction. The intended use case is only implied by the tool name and by the listed inspection targets.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_optimize_offline_cacheC

Optimizes offline site mirrors with SHA-256 Content-Addressable Storage (CAS), multi-origin asset deduplication, static Brotli/Gzip pre-compression, and a built-in high-performance HTTP/2 & HTTP/1.1 static preview server with ETag caching.

NameRequiredDescriptionDefault
gzipNoPre-compress eligible assets with Gzip (.gz) (default: true)
portNoPort for static preview server (default: 0 for random free port)
brotliNoPre-compress eligible assets with Brotli (.br) (default: true)
targetYesTarget local directory path or website URL to optimize and deduplicate
outputDirNoLocal directory to store optimized content-addressable assets (default: ./optimized_cache)
deduplicateNoEnable SHA-256 Content-Addressable Storage (CAS) deduplication with hard links (default: true)
startPreviewNoStart built-in HTTP/2 & HTTP/1.1 static preview server (default: false)

TDQS

C2.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose real behavior beyond the schema: output is content-addressable assets written to outputDir, deduplication uses hard links, compression produces .gz/.br files, and an optional preview server can be launched. However, it never says whether the source target is modified in place, whether network access is required for URL targets, or what the tool returns (server URL, summary report, nothing), which are the traits an agent most needs for a mutating, 7-parameter tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single sentence, so it is compact, but it is a run-on that front-loads jargon ("SHA-256 Content-Addressable Storage (CAS)") and marketing adjectives ("built-in high-performance") instead of the one thing an agent needs first: when to call this and what it produces. Signal-to-noise is mediocre.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Seven parameters, no annotations, and no output schema โ€” a case where the description must compensate, and it does not. The most consequential unknown is the return value: if startPreview is true, does the tool return the bound port/URL? The description also leaves open whether the tool is safe to re-run and whether it mutates the target directory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so every parameter including defaults is already documented in the schema. The description only restates the same concepts (deduplication, pre-compression, preview server) at a higher level without adding format, interaction, or constraint detail. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening clause states a verb and resource ("Optimizes offline site mirrors"), which is intelligible, but the rest is a feature inventory (CAS, Brotli/Gzip, HTTP/2 preview server) rather than a statement of purpose. Nothing distinguishes it from a sibling like web_clone_offline_mirror or web_inspect_pwa_cache, so an agent cannot confidently route between them from the text alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites (does target need to already be a mirror, or can it be a live URL?), and no named alternative. The description reads as a capability list rather than invocation guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_profile_fingerprintB

Profiles client-side browser fingerprinting surfaces (Canvas 2D, WebGL/GPU, AudioContext, Navigator, Screen, Fonts, Permissions, Headless indicators), detects commercial anti-bot telemetry sensors (Kasada, Akamai BMP, Shape, Cloudflare, DataDome, PerimeterX, FingerprintJS), calculates code Shannon entropy, and generates interactive visual reports.

NameRequiredDescriptionDefault
targetYesTarget website URL or local directory/file path containing client scripts
outputDirNoTarget directory for audit artifacts (default: ./fingerprint_report)
generateHtmlNoGenerate standalone interactive fingerprint_visualizer.html (default: true)
generateJsonNoGenerate structured fingerprint_profile_manifest.json (default: true)
detectEntropyNoCompute Shannon entropy for script blocks (default: true)
generateMarkdownNoGenerate FINGERPRINT_REPORT.md audit report (default: true)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It mentions generating reports and artifacts but omits key operational traits: whether it requires network access, executes scripts in a browser, handles authentication, has rate limits, or what permissions are needed. For a tool that writes files to outputDir, these gaps are significant.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the core purpose and then lists secondary capabilities. It is information-packed but not repetitive; however, the long enumeration could be slightly streamlined without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with six parameters, no output schema, and no annotations, the description covers what the tool does and what artifacts it generates, but it lacks operational context such as environment requirements, failure modes, or security implications. It is sufficient to understand the tool's purpose but not fully complete for safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters thoroughly. The description does not add meaning beyond what the schema provides for any parameter; it only reiterates high-level capabilities already implied by the parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Profiles') and enumerates the exact resources (Canvas 2D, WebGL/GPU, AudioContext, etc.), plus additional actions like detection, entropy calculation, and report generation. This clearly distinguishes it from sibling tools such as web_decompile_shaders or web_recon_infrastructure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for auditing client-side fingerprinting and anti-bot telemetry, but it never states when to use this tool versus alternatives or when NOT to use it. No explicit prerequisites or exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_recon_infrastructureB

Performs deep infrastructure, Edge/CDN, WAF, DNS, TLS, security headers, and frontend framework forensics on any target website URL.

NameRequiredDescriptionDefault
urlYesTarget website URL (e.g. https://example.com)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does not disclose whether the scan is passive or active, whether it touches the target in an intrusive way, rate limits, authentication requirements, or what the result looks like; it only lists analysis categories.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is a single front-loaded sentence with no filler. Every listed domain contributes to the tool's scope, and the target is stated immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a broad forensics tool with no annotations and no output schema, the description is too thin about what an agent will get back, how deep or slow the scan may be, and any scope limitations. It names analysis areas but does not complete the operational picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'url' parameter is fully documented in the schema, including an example, so the description does not need to repeat its type or format. It also adds no extra parameter semantics beyond the schema, making the high-coverage baseline of 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (performs deep forensics) and enumerates concrete resource areas: infrastructure, Edge/CDN, WAF, DNS, TLS, security headers, and frontend frameworks. That is clear enough to distinguish it from siblings like web_decompile_bundles or web_inspect_pwa_cache, though it does not explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by 'on any target website URL' and by the listed forensic domains, but there is no explicit when-to-use, when-not-to-use, prerequisite, or sibling routing guidance. An agent must infer that this is the broad infra reconnaissance option.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_reconstruct_schemaA

Reconstructs GraphQL SDL schemas and gRPC-Web Protocol Buffers (proto3) interfaces from client bundles, AST queries, and binary wire frames, generating standalone schema.graphql, service_definitions.proto, and interactive visualizer dashboards.

NameRequiredDescriptionDefault
targetYesTarget website URL, client bundle directory, JS file with gql/gRPC stubs, or binary wire payload (.pb/.bin)
outputDirNoTarget directory for reconstructed schema artifacts (default: ./schema_artifacts)
generateHtmlNoGenerate standalone interactive schema_visualizer.html (default: true)
generateJsonNoGenerate structured schema_reconstruct_manifest.json (default: true)
generateProtoNoGenerate syntax-valid service_definitions.proto (default: true)
generateGraphqlNoGenerate syntax-valid schema.graphql SDL (default: true)
generateMarkdownNoGenerate SCHEMA_RECONSTRUCT_REPORT.md audit report (default: true)

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It helpfully discloses the exact artifacts produced and their formats, implying filesystem writes, but says nothing about whether the target URL is fetched live, permission/auth needs, reversibility of writes to outputDir, or the cost of processing bundles. Useful but materially incomplete for a multi-parameter generation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence beginning with the verb, with no filler. It is dense and slightly run-on due to the artifact list, but every clause (sources, output formats, artifact names) earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with no output schema and no annotations, the description covers what is produced (substituting partly for a return-value section) and the range of acceptable targets. It omits prerequisites such as whether network access to the target is required and what happens on partial/failed reconstruction.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so every parameter is already documented in the schema, setting baseline 3. The description's enumeration of output artifacts loosely maps to the generate* flags but adds no meaning beyond what the schema already says (defaults, accepted target types).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Reconstructs') and precise resources: GraphQL SDL, gRPC-Web proto3 interfaces, derived from client bundles/AST queries/wire frames. The named artifacts (schema.graphql, service_definitions.proto, visualizer) clearly separate this from siblings like web_decompile_bundles or web_audit_api_catalog, which extract rather than reconstruct schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies context by listing input sources (bundles, AST queries, wire frames), which loosely signals when the tool applies. But it never names an alternative sibling or states when not to use it, leaving the agent to infer that this is the schema-reconstruction option among many extraction tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_synthesize_shadcnB

Synthesizes clean, production-ready TypeScript React components using Shadcn UI, Radix primitives, Lucide React icons, and Tailwind dark-mode variants from any target website URL or raw HTML subtree.

NameRequiredDescriptionDefault
urlNoTarget website URL (e.g. https://example.com)
htmlNoOptional raw HTML string (if synthesizing from direct HTML instead of fetching URL)
selectorNoDOM tag, CSS selector, or semantic keyword (e.g. header, nav, main, section, hero, pricing, form, card, dialog, default: header)
typescriptNoWhether to generate strict TypeScript interfaces and types (default: true)
componentNameNoOptional custom PascalCase name for the generated React component
detectDarkModeNoWhether to detect and automatically synthesize dark mode variants for light Tailwind classes (default: true)
mapLucideIconsNoWhether to map SVG blobs, fa-icons, and icon classes to clean Lucide React components (default: true)
generateStorybookNoWhether to generate Storybook 7/8 CSF3 stories snippet (default: true)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden and it falls short: it doesn't say whether the tool fetches the URL over the network, how long generation takes, whether it writes files or returns code inline, or what the response looks like. It only names the technology stack and the dark-mode/Lucide/Storybook synthesis capabilities, which largely mirror the parameter schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the output artifact stated first and the input source last. Dense with tech-stack names but every clause adds identification value; no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 8 parameters (all optional), no annotations, and no output schema, the description does not need to restate parameter details but should state what is produced. It names the component output and stack but not the return shape (inline code string vs. file set vs. object with stories). Minor gap rather than a blocking one given the 100% schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including defaults and examples, so the schema does the heavy lifting. The description restates dark-mode variants and Lucide mapping without adding format, precedence (url vs html), or selector semantics beyond what the schema says. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Synthesizes') and a concrete output artifact (TypeScript React components using Shadcn UI, Radix, Lucide, Tailwind) from a specific input (URL or raw HTML subtree). An agent can tell it's a code-generation tool, not a recon or decompilation tool. It doesn't explicitly differentiate itself from the closest sibling, web_extract_vibe_components.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use / when-not-to-use guidance and no named alternatives, despite a crowded sibling set (web_extract_vibe_components, web_clone_offline_mirror, web_generate_e2e_harness) where routing matters. The only implicit guidance is that either a URL or an HTML string can be supplied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 18 tool updatesv1.13.0
    • First observedweb_analyze_app_state
    • First observedweb_audit_api_catalog
    • First observedweb_capture_live_session
    • First observedweb_clone_offline_mirror
    • First observedweb_decompile_bundles
    • First observedweb_decompile_shaders
    • First observedweb_decompile_wasm
    • First observedweb_diff_bundle_releases
    • First observedweb_extract_vibe_components
    • First observedweb_generate_e2e_harness
    • First observedweb_inspect_crdt_state
    • First observedweb_inspect_media_pipeline
    • First observedweb_inspect_pwa_cache
    • First observedweb_optimize_offline_cache
    • First observedweb_profile_fingerprint
    • First observedweb_recon_infrastructure
    • First observedweb_reconstruct_schema
    • First observedweb_synthesize_shadcn

TDQS

B3.2/5.0

Scored across 18 tools

Disambiguation3/5

Several tools overlap on the same action: web_audit_api_catalog, web_decompile_bundles, and web_reconstruct_schema all carve API/schema definitions from bundles, and web_extract_vibe_components vs web_synthesize_shadcn both produce React components from a target site. web_clone_offline_mirror and web_optimize_offline_cache also blur together around offline mirroring. The descriptions do add distinguishing detail (OpenAPI vs GraphQL/gRPC vs raw carving), but an agent can easily pick the wrong member of these clusters.

Naming Consistency5/5

Every tool uses the identical web_<verb>_<object> snake_case pattern (web_audit_api_catalog, web_capture_live_session, web_diff_bundle_releases). The leading verb is always imperative and the remainder names the target artifact. No camelCase or stylistic mixing anywhere in the set.

Tool Count3/5

18 tools is on the heavy side for a single server and pushes into the borderline band; a few (web_inspect_crdt_state, web_decompile_shaders, web_inspect_media_pipeline) are highly specialized niche capabilities. Each is individually justified by the broad 'web archaeology' scope, but consolidation of the overlapping decompile/extract groups would make the surface more manageable.

Completeness4/5

Coverage of the reverse-engineering domain is remarkably thorough: recon, bundle decompilation, API/schema reconstruction, state, WASM, PWA, media, shaders, fingerprinting, diffing, and e2e harness generation. Minor gaps exist around cross-artifact management โ€” no tool to list/search previously extracted source or a unified report/export โ€” but core lifecycle from recon to reconstruction is covered.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Enables reverse engineering of web applications and chat interfaces through browser automation, network traffic capture, and streaming API discovery. Provides comprehensive tools for analyzing network patterns, capturing streaming responses, and automating complex web interactions.
    14
    10 npm
    1
    ISC
  • A
    license
    A
    quality
    D
    maintenance
    Enables comprehensive web frontend debugging and analysis through DOM inspection, JavaScript execution, network monitoring, console log capture, and automated browser interactions. Supports complete web development workflows including testing, data extraction, and performance analysis.
    15
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Standardizes front-end JavaScript reverse engineering workflows by providing tools for browser observation, runtime sampling, hooking, debugging, network analysis, and local environment reproduction.
    948 npm
    70
    Apache 2.0
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables agents to inspect and reverse engineer native binaries, JavaScript/Electron applications, .NET assemblies, websites, and runtime behavior, returning evidence-backed findings that can be explained, implemented, or tested.
    397,275 npm
    2
    MIT