WebArcheology-MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| web_recon_infrastructureB | Performs deep infrastructure, Edge/CDN, WAF, DNS, TLS, security headers, and frontend framework forensics on any target website URL. |
| web_decompile_bundlesB | Decompiles modern frontend JavaScript chunks (Webpack/Vite/Turbopack), extracts and reconstructs original source files from sourcemaps into clean directories, and carves all internal API endpoints. |
| web_clone_offline_mirrorB | Clones a website into an interactive 100% offline-playable mirror with relative asset URL rewrites and an injected mock API ServiceWorker/fetch interceptor so client-side SPAs remain interactive offline. |
| web_extract_vibe_componentsB | Extracts design tokens (colors, font hierarchy, Tailwind theme extension) and converts target DOM elements (header, hero, nav, etc.) into clean, standalone React JSX components for immediate vibe coding. |
| web_audit_api_catalogB | Scans client-side bundles of a target site to produce a comprehensive OpenAPI 3.0 specification of all internal, unadvertised API routes, methods, and endpoints. |
| web_analyze_app_stateC | Forensically reconstructs client-side route topologies (Next.js App Router, React Router, Vue Router) and global state stores (Zustand, Redux, Pinia) with inferred TypeScript interfaces and action creators from bundles and sourcemaps. |
| web_capture_live_sessionB | Captures live dynamic web sessions, intercepts HTTP/XHR/Fetch traffic into strict HAR 1.2 format, records WebSocket frame streams, snapshots cookies/localStorage state, and generates a self-contained offline WebSocket replay server. |
| web_synthesize_shadcnB | Synthesizes clean, production-ready TypeScript React components using Shadcn UI, Radix primitives, Lucide React icons, and Tailwind dark-mode variants from any target website URL or raw HTML subtree. |
| web_optimize_offline_cacheC | Optimizes offline site mirrors with SHA-256 Content-Addressable Storage (CAS), multi-origin asset deduplication, static Brotli/Gzip pre-compression, and a built-in high-performance HTTP/2 & HTTP/1.1 static preview server with ETag caching. |
| web_diff_bundle_releasesB | Compares two client web releases (local directories or live URLs), detecting changed JavaScript chunks, deleted/added API endpoints, client routes, UI components, and generating visual regression and breaking change reports. |
| web_generate_e2e_harnessB | Extracts client routes, forms, and API schemas to automatically synthesize Playwright and Cypress end-to-end integration test suites, dynamic network mock handlers, an interactive flow simulator, and standalone execution rig. |
| web_decompile_wasmA | Decompiles WebAssembly binaries or carved Base64 WASM modules from web bundles into WebAssembly Text Format (WAT), synthesizes declarative TypeScript memory interfaces (.d.ts) and host loaders, carves data strings/secrets, and creates an interactive visual WebAssembly Explorer. |
| web_inspect_pwa_cacheC | Audits Web App Manifests for installability, reverse-engineers ServiceWorker caching strategies and precache manifests, discovers background sync/push listeners, extracts IndexedDB schemas, and audits unencrypted credentials with an interactive visualizer dashboard. |
| web_profile_fingerprintB | Profiles client-side browser fingerprinting surfaces (Canvas 2D, WebGL/GPU, AudioContext, Navigator, Screen, Fonts, Permissions, Headless indicators), detects commercial anti-bot telemetry sensors (Kasada, Akamai BMP, Shape, Cloudflare, DataDome, PerimeterX, FingerprintJS), calculates code Shannon entropy, and generates interactive visual reports. |
| web_inspect_crdt_stateC | Decompiles real-time collaboration engines and CRDT state synchronization protocols (Yjs, Automerge, Liveblocks, ShareDB), decodes binary vector clocks and Lamport timestamps, reconstructs document state trees, and synthesizes interactive conflict resolution visualizers. |
| web_inspect_media_pipelineC | Decompiles streaming media pipelines (HLS .m3u8, MPEG-DASH .mpd), reconstructs media segment timelines and adaptive bitrate ladders, decodes ISO Protection System Specific Header (PSSH) boxes, and audits Encrypted Media Extensions (EME) key exchange APIs. |
| web_decompile_shadersB | Decompiles client-side 3D graphics and shader pipelines: decodes binary GLB container chunks and glTF 2.0 PBR materials, analyzes GLSL ES 1.00/3.00 and WebGPU WGSL shaders, fingerprints 3D rendering engines (Three.js/Babylon.js), and synthesizes interactive 3D visualizers. |
| web_reconstruct_schemaA | Reconstructs GraphQL SDL schemas and gRPC-Web Protocol Buffers (proto3) interfaces from client bundles, AST queries, and binary wire frames, generating standalone schema.graphql, service_definitions.proto, and interactive visualizer dashboards. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 18 tools
Several tools overlap on the same action: web_audit_api_catalog, web_decompile_bundles, and web_reconstruct_schema all carve API/schema definitions from bundles, and web_extract_vibe_components vs web_synthesize_shadcn both produce React components from a target site. web_clone_offline_mirror and web_optimize_offline_cache also blur together around offline mirroring. The descriptions do add distinguishing detail (OpenAPI vs GraphQL/gRPC vs raw carving), but an agent can easily pick the wrong member of these clusters.
Every tool uses the identical web_<verb>_<object> snake_case pattern (web_audit_api_catalog, web_capture_live_session, web_diff_bundle_releases). The leading verb is always imperative and the remainder names the target artifact. No camelCase or stylistic mixing anywhere in the set.
18 tools is on the heavy side for a single server and pushes into the borderline band; a few (web_inspect_crdt_state, web_decompile_shaders, web_inspect_media_pipeline) are highly specialized niche capabilities. Each is individually justified by the broad 'web archaeology' scope, but consolidation of the overlapping decompile/extract groups would make the surface more manageable.
Coverage of the reverse-engineering domain is remarkably thorough: recon, bundle decompilation, API/schema reconstruction, state, WASM, PWA, media, shaders, fingerprinting, diffing, and e2e harness generation. Minor gaps exist around cross-artifact management — no tool to list/search previously extracted source or a unified report/export — but core lifecycle from recon to reconstruction is covered.