English | 中文
AI支援によるJavaScript解析およびセキュリティ解析のための、ランタイムレジストリ駆動型カタログを備えたMCP（Model Context Protocol）サーバーです。ブラウザ自動化、Chrome DevTools Protocolデバッグ、ネットワーク監視、インテリジェントなJavaScriptフック、LLMによるコード解析、プロセスおよびメモリ検査、WASMツール、ソースマップ再構築、AST変換、複合ワークフローを単一のサーバーに統合しています。
Related MCP server: JS Reverse Strong MCP
グローバルにインストールすることなく、Claude DesktopやCursorでjshookmcpをすぐに使用できます。
Claude Desktop設定 (claude_desktop_config.json):
{
"mcpServers": {
"jshook": {
"command": "npx",
"args": ["-y", "@jshookmcp/jshook@latest"],
"env": {
"JSHOOK_BASE_PROFILE": "search"
}
}
}
}(Windowsユーザーへの注意: npxが見つからない場合は、npx.cmdへの絶対パスを指定してください)
🤖 AI駆動型解析: LLMを活用して、インテリジェントなJavaScriptの難読化解除、暗号アルゴリズムの検出、ASTレベルのコード理解を実現します。
⚡ 検索ファーストのコンテキスト効率: BM25駆動の search_tools + 動的ブーストにより、jshookのツールスキーマ初期化デルタを約40.0K+トークン（full）から約3.0K（search）に削減します（Claudeサーバー側のカウント。Claude Codeのベースプロンプトを除く）。
🎯 段階的な機能階層: 3つの組み込みプロファイル（search/workflow/full）があり、searchがオンデマンドで機能を拡張するためのデフォルトのベース階層となります。
🌐 フルスタック自動化: Chromium/Camoufoxブラウザ、CDPデバッグ、ネットワークインターセプトをシームレスにアトミックなアクションとしてオーケストレーションします。
🛡️ 高度なアンチデバッグ: debugger文、タイミングチェック、厳格なヘッドレスボットのフィンガープリント技術に対する組み込みの回避策を備えています。
🧩 動的な拡張性: コアサーバーを再コンパイルすることなく、ローカルディレクトリからプラグインやワークフローをホットリロードします。
🔧 ゼロ配線の拡張性: manifest.tsによるドメインの自動検出、ハンドラーの遅延インスタンス化、プラグイン/ワークフロー用のB-Skeletonコントラクト。
🛠️ リバースエンジニアリングツールチェーン: 統合されたWASM逆アセンブル、バイナリのエントロピー解析、メモリ内スキャン、Burp Suite/Ghidra/IDA Proへのブリッジ。
JSHookMCPは36ドメインにわたる360以上の原子ツールを公開しており、AIオーケストレーターに比類のない機能を提供します:
🕸️ ブラウザ自動化とリバースエンジニアリング: 設定不要のChromium/Camoufoxインジェクション、CDP（Chrome DevTools Protocol）オーケストレーション、iframe評価のバイパス。
📡 ネットワークインターセプトとスプーフィング: 高度なHTTP/2フレーム構築、MiTMトラフィックキャプチャ、GraphQLイントロスペクション、Burp Suiteブリッジ。
🧠 ASTとセマンティック解析: LLMによる難読化解除、WebAssembly (WASM) 逆アセンブル、ソースマップ再構築、バイナリのエントロピー可視化。
🧰 プロセスとメモリのフォレンジック: ネイティブFridaインストゥルメンテーション、メモリスキャン、ポインタ逆参照、厳格なアンチデバッグ緩和策。
🔌 動的な拡張性: ホットリロード可能なB-Skeletonプラグインと宣言的な WorkflowContract パイプライン。
[!TIP] コンテキスト効率のベンチマーク: 組み込みツールスキーマの初期化デルタ（Claudeサーバー側のカウント）:
search≈ 3.0Kトークン vsfull≈ 40.0K+トークン。
段階的なツール検出: search_tools メタツール（BM25ランキング） + activate_tools / activate_domain + プロファイルベースの階層アップグレード (boost_profile)
検索階層の動作: search_tools は検索と結果のランキングのみを行い、activate_tools や boost_profile を自動実行しません。推奨されるチェーン: search_tools -> activate_tools / activate_domain -> boost_profile (必要な場合のみ)
単一ツールのためにブーストしない: activate_tools は現在のベース階層から階層をまたいで正確なツールを登録できます。boost_profile は、関連するツールの広範なファミリーを繰り返し再利用することが予想される場合に適しています。
ドメインの遅延初期化: ハンドラークラスは起動時ではなく、最初の呼び出し時にProxyを介してインスタンス化されます。
ドメインの自己検出: ランタイムマニフェストスキャン (domains/*/manifest.ts) がハードコードされたインポートを置き換えます。単一のマニフェストファイルを作成することで新しいドメインを追加できます。
B-Skeletonコントラクト: プラグイン (PluginContract)、ワークフロー (WorkflowContract)、および可観測性 (InstrumentationContract) のための拡張性コントラクト。
MCP ToolAnnotations: すべてのツールはセマンティックアノテーション (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) を保持しており、AIオーケストレーターが呼び出し前にツールの安全性と副作用について推論できるようにします。
以下の組み込みサーフェスはランタイムレジストリから生成され、CIでチェックされています。
パッケージバージョン: 0.3.0
組み込みツール: 387
ドメイン: adb-bridge, antidebug, binary-instrument, boringssl-inspector, browser, canvas, coordination, core, cross-domain, debugger, encoding, evidence, extension-registry, graphql, hooks, instrumentation, macro, maintenance, memory, mojo-ipc, network, platform, process, protocol-analysis, proxy, sandbox, shared-state-board, skia-capture, sourcemap, streaming, syscall-hook, trace, transform, v8-inspector, wasm, workflow
注: このスナップショットはランタイムレジストリから生成されています。手動でカウントを編集しないでください。
Activate all tools in a domain at once. Domains: . Use reload_extensions first to include external plugin/workflow domains.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to activate (e.g. "debugger", "network") | |
| ttlMinutes | No | Auto-deactivate after N minutes (default: 30, set 0 for no expiry) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must bear the burden of disclosing behavior. The description only states the basic action and a prerequisite, but does not mention any side effects, permissions, or reversibility of activation. It also has a broken placeholder 'Domains: .'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (2 sentences), but includes a confusing broken fragment 'Domains: .' which detracts from conciseness. It is front-loaded with the main action but ends with an incomplete thought.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description should provide more context, such as the list of available domains or what 'activation' entails. It fails to do so, leaving the user uncertain about the domains that can be activated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters, so the description does not need to add much. It does not elaborate on the parameters beyond the schema, so it meets the baseline for no added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Activate all tools in a domain at once.' It distinguishes from siblings like 'activate_tools' (which likely activates individual tools) by specifying it operates on a whole domain. However, the incomplete sentence 'Domains: .' reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a prerequisite: 'Use reload_extensions first...', which implies when to use it. But it does not explicitly contrast with alternatives like 'activate_tools' or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Dynamically register specific tools by name, regardless of current base tier. Use after search_tools to enable exactly the tools you need. In search-tier sessions this is usually enough; you do not need boost_profile just to use a few exact tools. Activated tools appear in the tool list immediately. If tools do not appear after activation, use call_tool to invoke them directly.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes | Array of tool names to activate (from search_tools results) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description discloses that activation makes tools appear immediately and suggests direct invocation if not. Lacks details on side effects or permissions, but adequately covers expected behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Multiple sentences but no waste; core action front-loaded. Could be slightly shorter, but structure is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple input, no output schema, the description explains activation behavior, usage pattern, and recovery step, making it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds context by referencing search_tools as source for names, reinforcing parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool dynamically registers tools by name, and distinguishes from siblings like search_tools and call_tool. It also compares to boost_profile, providing clear purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use after search_tools, notes it's usually enough without boost_profile, and provides fallback using call_tool if activation fails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute an already-active tool by name. Use this when activate_tools/activate_domain registered a tool but your client did not refresh its tool list. Does not auto-activate inactive tools.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The tool name to execute (from search_tools or describe_tool results) | |
| args | No | Arguments object to pass to the tool |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must fully disclose behaviors. It only states it executes active tools and does not auto-activate, omitting error handling, auth needs, rate limits, or what happens if tool not found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with main purpose and usage context, no wasted words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers core purpose and limitation but lacks details on error cases, return value, or validation of args. Given no output schema, more behavioral context would be helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage for both parameters (name and args), so the description adds little beyond schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'execute' and resource 'already-active tool', and distinguishes from sibling tools like activate_tools and deactivate_tools by specifying it does not auto-activate inactive tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes when to use (after activation when client didn't refresh) and implies when not to use (tool not active). Could mention alternatives like activate_tools for inactive tools, but is still clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Remove previously activated tools to free context. Only affects tools added via activate_tools, not base profile tools.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes | Array of tool names to deactivate |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool removes tools and frees context, but does not mention side effects, permissions, or reversibility. The behavioral transparency is adequate but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action, and contains no unnecessary words. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema (one required array parameter) and no output schema, the description adequately explains the tool's effect and scope. It is complete for the tool's straightforward purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a description for the 'names' parameter: 'Array of tool names to deactivate'. The overall description adds context that these are tools activated via activate_tools, but this is already implied by the tool's purpose. The schema does the heavy lifting, so the description adds limited additional meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool removes previously activated tools to free context, specifying the verb 'remove' and the resource 'previously activated tools'. It distinguishes from siblings by clarifying it only affects tools added via activate_tools, not base profile tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that the tool only affects tools added via activate_tools, not base profile tools, providing clear guidance on when to use it. It implies it is the counterpart to activate_tools, but does not explicitly mention alternatives or when not to use it beyond that scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get detailed information about a specific tool, including its input schema. Use this to see the exact parameters a tool expects before calling it.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Tool name to describe |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description accurately states it retrieves tool info and input schema, but offers no additional behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with purpose, no redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Sufficient for a simple tool with one parameter and no output schema; could mention return format but not essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter 'name' already described in schema (100% coverage); description adds no extra meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'Get' and resource 'detailed information about a specific tool', distinct from sibling tools like call_tool or search_tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly suggests using before calling another tool to inspect parameters, but lacks explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
One-stop tool router: accepts a natural language task description, returns recommended tools and next actions. Automatically detects workflow patterns, recommends activation order, and provides example arguments. Use this instead of search_tools when you want guided tool discovery with actionable next steps.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | Natural language description of the task you want to accomplish | |
| context | No | Optional context hints for routing |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description fully carries behavioral disclosure. It explains that the tool detects workflow patterns, recommends activation order, and provides example arguments, going beyond simple I/O to explain internal processing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with clear front-loading: first sentence defines purpose, second sentence adds usage guidance. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description mentions 'returns recommended tools and next actions' but lacks details on output format, structure, or how to interpret results. For a tool whose primary output is recommendations, this is a notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for 'task' and 'context'. Description does not add further semantic detail beyond what schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states tool is a router that accepts a task description and returns recommended tools/actions. It explicitly distinguishes from sibling search_tools, providing specific verb+resource: natural language task to tool recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this instead of search_tools when you want guided tool discovery with actionable next steps', providing clear context for when to use this tool. Could be stronger by stating conditions for using alternatives like search_tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search 0 tools across 0 capability domains. This includes built-in tools plus any loaded plugin/workflow tools (0 currently loaded). In search-tier sessions, call this before assuming a capability is unavailable. Use activate_tools for exact matches, activate_domain for an entire domain. Domains: . Query tip: before searching, distill your intent into key concepts (action verb + target + domain). Pass distilled keywords, not full sentences — the search engine works on token matching, not semantic understanding.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Before calling, distill your intent into 2-5 key concepts: what action, on what target, in which domain. Pass only those distilled keywords — not the original user request. | |
| top_k | No | Max results to return (default: 10, max: 30) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description adds behavioral context: it explains how the search engine works ('token matching, not semantic understanding') and provides a query formulation tip. However, it does not disclose potential limitations or exact return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with multiple sentences. While each sentence provides useful information, it is slightly verbose and could be more streamlined. However, it is still relatively concise and front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has two parameters, no output schema, and no annotations, the description covers purpose, usage guidance, query optimization, and sibling differentiation. It lacks details on result structure or pagination, but overall it is fairly complete for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters documented. The description adds value beyond schema by providing guidance on how to construct the query parameter (distill intent into key concepts) and clarifying the default and max for top_k. This adds meaning not present in the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as searching tools across capability domains, including built-in and plugin/workflow tools. It distinguishes itself from sibling tools like activate_tools and activate_domain by specifying that it is for searching, not activating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises when to use this tool: 'In search-tier sessions, call this before assuming a capability is unavailable.' It also provides alternatives: 'Use activate_tools for exact matches, activate_domain for an entire domain.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.3.0activate_domainactivate_toolscall_tooldeactivate_toolsdescribe_toolroute_toolsearch_toolsScored across 7 tools
Tools have mostly distinct purposes, but activate_domain and activate_tools overlap in activation functionality, and route_tool overlaps with search_tools in discovery. Descriptions help differentiate.
All tools follow a consistent verb_noun pattern (e.g., activate_domain, search_tools), making predictions easy.
7 tools is well-scoped for a tool management server, covering all necessary operations without being excessive.
Covers activation, deactivation, search, description, routing, and calling. No obvious gaps in the tool management lifecycle.
Anonymous webhook capture, inspection, waiting, and response configuration for AI agents.
Provides style context & tokens to design or restyle web UIs in any framework
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Universal AI API Orchestrator — 1,554 tools, 96 services. One install.
