Skip to main content
Glama

js.find_endpoints

Extract API endpoints, URLs, and paths from JavaScript source code to identify potential attack surfaces for security testing.

Instructions

Extract API endpoints, URLs, and paths from JavaScript code

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
sourceYesJavaScript source code

Implementation Reference

  • The main execution handler for the 'js.find_endpoints' tool. It uses regex patterns to extract full URLs, relative paths, and API endpoints from the provided JavaScript source code, deduplicates them, and returns a structured result.
    async ({ source }: any): Promise<ToolResult> => {
      try {
        // Find full URLs
        const urlRegex = /\bhttps?:\/\/[\w\-\.:%]+[\w\-\/_\.\?\=\%\&\#]*/g;
        const urls = Array.from(new Set(source.match(urlRegex) || []));
    
        // Find relative paths
        const pathRegex = /["'`](\/[-a-zA-Z0-9_@:\/\.]+)["'`]/g;
        const paths: string[] = [];
        let match: RegExpExecArray | null;
        while ((match = pathRegex.exec(source)) !== null) {
          paths.push(match[1]);
        }
    
        // Find API endpoints (common patterns)
        const apiRegex = /(?:api|endpoint|url|path)[\s:=]+["'`]([^"'`]+)["'`]/gi;
        const apiEndpoints: string[] = [];
        while ((match = apiRegex.exec(source)) !== null) {
          apiEndpoints.push(match[1]);
        }
    
        const uniquePaths = Array.from(new Set(paths));
        const uniqueApis = Array.from(new Set(apiEndpoints));
    
        return formatToolResult(true, {
          urls,
          paths: uniquePaths,
          apiEndpoints: uniqueApis,
          summary: {
            totalUrls: urls.length,
            totalPaths: uniquePaths.length,
            totalApis: uniqueApis.length,
          },
        });
      } catch (error: any) {
        return formatToolResult(false, null, error.message);
      }
    }
  • The input schema definition for the tool, specifying the required 'source' parameter as a string containing JavaScript code.
    {
      description: 'Extract API endpoints, URLs, and paths from JavaScript code',
      inputSchema: {
        type: 'object',
        properties: {
          source: { type: 'string', description: 'JavaScript source code' },
        },
        required: ['source'],
      },
    },
  • src/tools/js.ts:79-129 (registration)
    The server.tool registration within registerJsTools function, which defines and registers the 'js.find_endpoints' tool with its schema and handler.
    server.tool(
      'js.find_endpoints',
      {
        description: 'Extract API endpoints, URLs, and paths from JavaScript code',
        inputSchema: {
          type: 'object',
          properties: {
            source: { type: 'string', description: 'JavaScript source code' },
          },
          required: ['source'],
        },
      },
      async ({ source }: any): Promise<ToolResult> => {
        try {
          // Find full URLs
          const urlRegex = /\bhttps?:\/\/[\w\-\.:%]+[\w\-\/_\.\?\=\%\&\#]*/g;
          const urls = Array.from(new Set(source.match(urlRegex) || []));
    
          // Find relative paths
          const pathRegex = /["'`](\/[-a-zA-Z0-9_@:\/\.]+)["'`]/g;
          const paths: string[] = [];
          let match: RegExpExecArray | null;
          while ((match = pathRegex.exec(source)) !== null) {
            paths.push(match[1]);
          }
    
          // Find API endpoints (common patterns)
          const apiRegex = /(?:api|endpoint|url|path)[\s:=]+["'`]([^"'`]+)["'`]/gi;
          const apiEndpoints: string[] = [];
          while ((match = apiRegex.exec(source)) !== null) {
            apiEndpoints.push(match[1]);
          }
    
          const uniquePaths = Array.from(new Set(paths));
          const uniqueApis = Array.from(new Set(apiEndpoints));
    
          return formatToolResult(true, {
            urls,
            paths: uniquePaths,
            apiEndpoints: uniqueApis,
            summary: {
              totalUrls: urls.length,
              totalPaths: uniquePaths.length,
              totalApis: uniqueApis.length,
            },
          });
        } catch (error: any) {
          return formatToolResult(false, null, error.message);
        }
      }
    );
  • src/index.ts:36-36 (registration)
    Top-level call to registerJsTools(server), which triggers the registration of the 'js.find_endpoints' tool along with other JS tools.
    registerJsTools(server);
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states what the tool does ('Extract API endpoints, URLs, and paths') but doesn't describe how it behaves—for example, whether it returns raw strings, structured data, handles errors, or has performance constraints like rate limits. This leaves significant gaps for an agent to understand the tool's operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core action and target. It wastes no words and directly communicates the tool's function without unnecessary elaboration, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (extracting structured data from code), lack of annotations, and no output schema, the description is incomplete. It doesn't explain what the output looks like (e.g., list of strings, JSON objects), error handling, or any behavioral nuances, leaving the agent with insufficient context to use the tool effectively beyond basic invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, with the single parameter 'source' documented as 'JavaScript source code'. The description adds no additional semantic context beyond this, such as examples of valid input or output format. Since schema coverage is high, the baseline score of 3 is appropriate, as the description doesn't compensate but also doesn't detract.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Extract') and target resources ('API endpoints, URLs, and paths'), and specifies the source material ('from JavaScript code'). However, it doesn't explicitly differentiate from sibling tools like js.extract_secrets or js.analyze, which might have overlapping domains in code analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, such as needing valid JavaScript code, or compare it to similar tools like js.extract_secrets for different extraction purposes or js.analyze for broader code analysis.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/telmon95/VulneraMCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server