WebTrace

AI-driven JSVMP Auto-Reversal Chrome/Edge Extension with MCP Server

Features

• MCP Server: Expose reverse engineering capabilities via MCP protocol for AI Agents

• JSVMP Auto-Detection: Automatically identify VM dispatch loops (while-switch/if-else/handler-table)

• QuickJS WASM Sandbox: Execute and trace JSVMP bytecode in isolated environment

• Stealth Engine: Three-layer stealth (Extension hiding + Proxy Hook cloaking + Timing alignment)

• Babel AST Instrumentation: Auto-instrument VM dispatch loops for trace collection

• Cross-browser: Chrome & Edge (Manifest V3)

Related MCP server: ghidraMCP

Quick Start

Build

npm install
npm run build

Load Extension

1. Open chrome://extensions/

2. Enable "Developer mode"

3. Click "Load unpacked" → select dist/ directory

Connect AI Agent

See docs/SKILL-INTEGRATION.md

Connect Codex CLI

WebTrace now includes a local stdio bridge for MCP clients that cannot connect to an Edge extension RuntimePort directly. The bridge listens for the extension at ws://127.0.0.1:3100/mcp and proxies MCP JSON-RPC over stdio to Codex. If the port is already used by another Codex session, the bridge automatically tries the next ports in the range.

codex mcp add webtrace -- node /Users/kk/git/web-trace/bin/webtrace-codex-bridge.mjs

After changing extension code, rebuild and reload the unpacked extension in edge://extensions. The extension service worker automatically connects to the bridge port range when Codex starts it, so multiple Codex sessions can use WebTrace at the same time.

Architecture

┌─────────────────────────────────────────────────────┐
│                   AI Agent (MCP Client)              │
│            Qoder / Cursor / Claude Code             │
└────────────────────┬────────────────────────────────┘
                     │ MCP Protocol (WebSocket/Port)
┌────────────────────▼────────────────────────────────┐
│              Service Worker (Background)              │
│  ┌─────────┐  ┌──────────┐  ┌──────────────────┐   │
│  │MCP Server│  │Tab Manager│  │Offscreen Manager │   │
│  └─────────┘  └──────────┘  └────────┬─────────┘   │
└───────────────────────────────────────┼─────────────┘
                                        │
┌───────────────────────────────────────▼─────────────┐
│              Offscreen Document                       │
│  ┌──────────────────┐  ┌─────────────────────────┐  │
│  │QuickJS WASM      │  │Babel AST Engine         │  │
│  │(Sandbox + Trace) │  │(Detect + Instrument)    │  │
│  └──────────────────┘  └─────────────────────────┘  │
└─────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────┐
│              Target Web Page                          │
│  ┌────────────┐  ┌────────────┐  ┌──────────────┐  │
│  │Stealth     │  │VM Tracer   │  │API Hooks     │  │
│  │Bootstrap   │  │(Proxy)     │  │(fetch/XHR)   │  │
│  └────────────┘  └────────────┘  └──────────────┘  │
└─────────────────────────────────────────────────────┘

MCP Tools

For InPrivate/incognito pages, Edge must allow the extension in InPrivate mode. Site access set to "all sites" is not enough by itself.

Integration

• AI Agent Integration Guide

• nodriver Setup

• patchright Setup

Tech Stack

• TypeScript + Vite

• Chrome Extension Manifest V3

• MCP (Model Context Protocol)

• QuickJS WASM (quickjs-emscripten)

• Babel AST (@babel/parser + traverse)

License

MIT