JS Reverse MCP

English | 中文

An AI-first / AI-native JavaScript reverse engineering MCP Server that lets your AI coding assistant (such as Claude, Cursor, Copilot) continuously debug, locate, save, and review JavaScript behavior in web pages like an analyst.

It doesn't hand the Chrome DevTools API to the model as-is. Instead, it reorganizes scripts, breakpoints, network, WebSocket, browser state, and local file I/O into tools suited for an AI Agent's continuous reasoning and operation. Anti-detection is part of that capability: by default it uses a Patchright fork that is recompiled, published, and independently maintained for this MCP to provide protocol-level stealth, with an optional CloakBrowser source-level fingerprint mode for heavily anti-scraping sites.

☁️ 赞助 · Sponsored by IPWO

IPWO residential proxies support flexible proxy configuration, letting developers choose the appropriate network environment for different tasks, for web access, request testing, region-specific content analysis, and automated workflows.

For projects involving JS reverse engineering, browser debugging, and web network analysis, residential proxies can also serve as a supplementary network environment option, helping developers more flexibly meet access and testing needs across different regions.

👉 Free trial entry, 10% discount code: 0204

Related MCP server: Chrome DevTools MCP

☁️ 赞助 · Sponsored by Infistar.cc 无限星河

js-reverse-mcp × Infistar.cc 无限星河｜All-model API · Stable AI-assisted debugging

Thanks to Infistar.cc 无限星河 for sponsoring and providing model service support for js-reverse-mcp!

• ⚡ Stably handles complex debugging tasks: enterprise-grade high-concurrency channels and multi-node redundancy, priced as low as 10% of official channels, reducing rate limits, 429s, and long-task disconnects.

• 🧠 One API Key for mainstream models: supports ChatGPT, Claude, Gemini, Kimi, GLM, DeepSeek and more, compatible with AI coding tools such as Claude Code, Codex, and Cursor.

• 🔎 Supports authorized debugging and security research: suitable for multi-step tasks such as script retrieval, breakpoint analysis, network request tracing, call stack inspection, and code logic understanding.

• 📦 Exclusive benefit for project users: register via the exclusive referral link and complete your first call to receive $5 worth of test credits / first-recharge exclusive discount.

Positioning: model API configuration support for Claude Code / Codex.

Features

• AI-native tool design: tool granularity, output boundaries, and error messages are all designed around Agent decision-making, avoiding pushing the model toward invalid next steps

• Reviewable workflow: script source code, raw network data, and binary results can all be exported to local files and then used as input for subsequent analysis

• Breakpoint context execution: while paused, you can evaluate directly in the call frame, inspect scope variables, step through execution, and get source context back

• Script analysis: list all loaded JS, search code, fetch/save source, auto-format large minified scripts

• Network and WebSocket analysis: request call stacks, XHR breakpoints, Set-Cookie identification, raw body/header export, WebSocket message grouping

• Browser state replay: clear the current site's cookies / cache / storage / sessionStorage, combined with reload to reproduce cookie and risk-control flows

• Headed by default + persistent login state: you can see the browser, and cookies / localStorage persist across sessions

• Dedicated Patchright kernel: by default depends on a Patchright fork independently maintained by this project, continuously fixing known shared implementation fingerprints from upstream

• Optional anti-detection layer: dedicated Patchright protocol-level stealth is enabled by default; for heavily anti-scraping sites you can add --cloak to use the CloakBrowser binary

Dedicated Patchright fork

js-reverse-mcp no longer depends directly on Patchright's public distribution package. Instead, it uses @zhizhuodemao/patchright, compiled and published specifically for this MCP. This fork is continuously maintained in a separate repository and evolves with this MCP's actual detection samples.

• No longer depends directly on Patchright's public distribution package

• Protocol-level adjustments for confirmed upstream shared implementation fingerprints, recompiled and republished

• Anti-detection adjustments do not rely on page-level JS injection

• Retains original capabilities such as evaluate, locator, and page control

• The fork is continuously maintained in a dedicated repository for this MCP

The public documentation only describes design boundaries and does not go into internal detection samples or implementation details. The goal of the dedicated fork is to reduce confirmed shared implementation fingerprints, not to promise that browser automation is absolutely undetectable.

System Requirements

• Node.js v20.19 or newer

• Chrome stable

Quick Start (npx)

No installation needed. Just add the following to your MCP client configuration:

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": ["js-reverse-mcp"]
    }
  }
}

Claude Code

claude mcp add js-reverse npx js-reverse-mcp

If you don't have a usable model API yet, or need to configure a custom API address, see: Claude Code / Codex third-party model API configuration tutorial.

Codex

codex mcp add js-reverse -- npx js-reverse-mcp

If you don't have a usable model API yet, or need to configure a custom API address, see: Claude Code / Codex third-party model API configuration tutorial.

Cursor

Go to Cursor Settings -> MCP -> New MCP Server and use the configuration above.

VS Code Copilot

code --add-mcp '{"name":"js-reverse","command":"npx","args":["js-reverse-mcp"]}'

Local Installation (Optional)

git clone https://github.com/zhizhuodemao/js-reverse-mcp.git
cd js-reverse-mcp
npm install
npm run build

Then use the local path in your MCP configuration:

{
  "mcpServers": {
    "js-reverse": {
      "command": "node",
      "args": ["/你的路径/js-reverse-mcp/build/src/index.js"]
    }
  }
}

AI-first Design

The core goal of this project is not "being able to operate a browser," but letting an AI Agent reliably complete a full round of real JS reverse engineering tasks: open the page, pass risk control, locate the script, save the source, set breakpoints, trigger behavior, inspect runtime state, export network materials, reproduce state, and then continue reasoning.

Several design orientations run through the code:

• Tools are Agent primitives, not DevTools menu mappings: list_network_requests can list an index, look up details by reqid, and export precise materials via outputFile; evaluate_script can execute in the page, execute in a breakpoint call frame, and accept a localFilePath input.

• Output must guide the next step: list output stays short and scannable; detail output has boundaries; long results prompt for export; pending requests explicitly prompt to resume execution first, so the Agent doesn't wait for a response that will never complete.

• Local files are the analysis workbench: save_script_source, list_network_requests(..., outputFile), and evaluate_script(..., localFilePath) let the Agent move back and forth between the browser, network, and local files, instead of stuffing large code blocks or binary data into the chat context.

• State can be cleaned, flows can be replayed: the default profile preserves login state; --isolated provides a one-time clean environment; clear_site_data only clears state related to the current site, used to repeatedly reproduce cookie generation, risk-control initialization, and request chains.

• Anti-detection serves the debugging chain: CDP silent navigation, real viewport, Google referer, the dedicated Patchright fork, and CloakBrowser all aim to let the Agent enter the target page and continue analysis, rather than turning the project into a general-purpose crawler framework.

Anti-detection Mechanisms (Supporting Capability)

Anti-detection is one of js-reverse-mcp's underlying supporting capabilities. The wrapper layer (this MCP itself) does zero JS injection and no Object.defineProperty hacks (those are detection signals in themselves). All anti-detection lives in two non-overlapping layers:

A few additional navigation-level measures (active in both modes):

• CDP silent navigation — Network.enable / Debugger.enable are not activated when the page loads; request/console collection only goes through Playwright listeners until a tool explicitly needs CDP

• Google Referer — new_page defaults to referer: https://www.google.com/

• Real viewport — Playwright's default fake 1280×720 viewport is disabled; the browser shows the real screen size

When to enable --cloak: only when the above isn't enough and you're being blocked by site fingerprinting. See docs/cloak.md for details.

Tool List (24 tools)

Page & Navigation

Script Analysis

Breakpoints & Execution Control

Network & WebSocket

Browser State

Inspection Tools

Usage Examples

Basic JS Reverse Engineering Flow

1. Open the target page

打开 https://example.com 并列出所有加载的 JS 脚本

2. Find the target function

在所有脚本中搜索包含 "encrypt" 的代码

3. Set a breakpoint

在加密函数入口处设置断点

4. Trigger and analyze

在页面上触发操作，断点命中后检查参数、调用栈和作用域变量

WebSocket Protocol Analysis

列出 WebSocket 连接，分析消息模式，查看特定类型的消息内容

Agent-Recommended Full Capture Flow

Because the navigation phase deliberately keeps CDP silent, the Network / Debugger domains are not opened immediately when first entering the target page. The recommended flow is to pass risk control first, then refresh to capture:

1. new_page 打开目标页
2. 调用 list_network_requests 激活 collectors
3. navigate_page(type="reload") 刷新页面
4. 再次 list_network_requests 查看完整请求
5. 对关键 reqid 使用 outputFile 导出原始材料

Cookie / Risk-Control Replay Flow

1. clear_site_data(confirm=true) 清理当前站点状态
2. navigate_page(type="reload") 重新触发初始化
3. list_network_requests 找到设置 cookie 或提交 sensor 的请求
4. 导出 requestBody / responseHeaders / responseBody
5. 用 evaluate_script + localFilePath 在页面上下文中复算或验证

Configuration Options

The CLI stays minimal; all flags are optional. The defaults work for 99% of scenarios. When local files are involved, it's recommended to use --allowedRoots to limit the directories the Agent can read and write.

Example Configurations

Default — system Chrome + persistent login state (recommended for most debugging scenarios):

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": ["js-reverse-mcp"]
    }
  }
}

--cloak — heavily anti-scraping sites (Cloudflare Turnstile / DataDome / FingerprintJS protection):

Strongly recommended: pre-download the binary first (one-time, ~30–60 seconds). If you skip this, the first launch with --cloak will silently download ~200MB, which looks like the MCP is stuck:

npx cloakbrowser install

(The cloakbrowser package is already installed via optionalDependencies; this command just triggers its built-in binary download logic, with a progress bar)

{
  "mcpServers": {
    "js-reverse-cloak": {
      "command": "npx",
      "args": ["js-reverse-mcp", "--cloak"]
    }
  }
}

Two parallel instances — two MCP instances with physically isolated profiles, switch based on the target site:

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": ["js-reverse-mcp"]
    },
    "js-reverse-cloak": {
      "command": "npx",
      "args": ["js-reverse-mcp", "--cloak"]
    }
  }
}

--isolated — a fresh profile every time (cookies/localStorage not preserved):

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": ["js-reverse-mcp", "--isolated"]
    }
  }
}

Connecting to a Running Chrome / Third-Party Fingerprint Browser

--browserUrl only accepts a CDP endpoint (an HTTP endpoint that responds to /json/version), not vendor-private Local APIs. How to get the CDP port for local Chrome, AdsPower, BitBrowser, etc. is in the dedicated document:

📖 docs/cdp-endpoint.md — How to get the CDP debugging port

Shortest path (local Chrome):

# 先关掉所有 Chrome 窗口，然后
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
  --remote-debugging-port=9222 --user-data-dir=/tmp/chrome-debug

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": ["js-reverse-mcp", "--browserUrl", "http://127.0.0.1:9222"]
    }
  }
}

For fingerprint browsers (AdsPower, BitBrowser, etc.), the CDP port changes randomly on every launch; you must start the browser via the vendor's Local API and then extract it. The steps and example scripts are in the document above.

Troubleshooting

Blocked by Anti-Scraping Systems

If you're blocked on certain sites (e.g., Zhihu returns 40362, Cloudflare challenge loops):

1. Try --isolated first — use a fresh profile to rule out residual state pollution:

   "args": ["js-reverse-mcp", "--isolated"]

2. If that doesn't work, enable --cloak — enable platform-specific source-level fingerprint patches:

   "args": ["js-reverse-mcp", "--cloak"]

3. As a last resort, manually clear the persistent profile (this loses login state):

   rm -rf ~/.cache/chrome-devtools-mcp/chrome-profile

When you should and shouldn't enable --cloak, see docs/cloak.md.

Agent Routing Evaluation (Maintainers)

npm run eval:routing:validate offline-validates the actual MCP tools/list, server instructions, and the 30 tool-selection contracts in evals/tool-routing.json; this command does not hit model endpoints and is part of presubmit.

Real model evaluation is explicitly opt-in and calls the OpenAI-compatible Chat Completions endpoint per item, which may incur costs:

MCP_ROUTING_EVAL_ENDPOINT=https://api.example.com/v1/chat/completions \
MCP_ROUTING_EVAL_MODEL=model-name \
MCP_ROUTING_EVAL_API_KEY=secret \
npm run eval:routing

MCP_ROUTING_EVAL_API_KEY can be omitted for local endpoints that don't require authentication; remote endpoints with credentials must use HTTPS, and HTTP is only allowed on loopback. Use MCP_ROUTING_EVAL_TIMEOUT_MS to adjust the per-request timeout. 100% pass is required by default; when comparing across models, use MCP_ROUTING_EVAL_MIN_PASS_RATE to set a (0, 1] threshold. The evaluation does not output API keys, endpoints, or endpoint error response bodies.

Security Notice

This tool exposes browser content to the MCP client, allowing inspection, debugging, and modification of any data in the browser. Do not use it on pages containing sensitive information.

evaluate_script.localFilePath and various outputFile/filePath options allow the MCP process to read or write host machine files. In production or shared environments, one or more --allowedRoots should be used to narrow access to a dedicated working directory; when not configured, the access scope is unrestricted. When --allowedRoots is enabled, file:, view-source:file:, and filesystem:file: browser pages are also rejected, preventing directory boundary bypass through browser navigation; when local pages need to be debugged, this option can only be left unconfigured in sessions that explicitly accept the risk of local file exposure.

License

Apache-2.0