English | 中文
AI 기반 JavaScript 분석 및 보안 분석을 위한 내장 도구 카탈로그를 갖춘 런타임 레지스트리 기반의 MCP(Model Context Protocol) 서버입니다. 브라우저 자동화, Chrome DevTools Protocol 디버깅, 네트워크 모니터링, 지능형 JavaScript 후킹, LLM 기반 코드 분석, 프로세스 및 메모리 검사, WASM 도구, 소스 맵 재구성, AST 변환 및 복합 워크플로우를 단일 서버에서 결합합니다.
Related MCP server: JS Reverse Strong MCP
전역적으로 아무것도 설치할 필요 없이 Claude Desktop 또는 Cursor에서 즉시 jshookmcp를 사용하세요.
Claude Desktop 설정 (claude_desktop_config.json):
{
"mcpServers": {
"jshook": {
"command": "npx",
"args": ["-y", "@jshookmcp/jshook@latest"],
"env": {
"JSHOOK_BASE_PROFILE": "search"
}
}
}
}(Windows 사용자 참고: npx를 찾을 수 없는 경우 npx.cmd의 절대 경로를 지정하세요)
🤖 AI 기반 분석: 지능형 JavaScript 난독화 해제, 암호화 알고리즘 탐지 및 AST 수준의 코드 이해를 위해 LLM을 활용합니다.
⚡ 검색 우선 컨텍스트 효율성: BM25 기반의 search_tools + 동적 부스트를 통해 jshook의 도구 스키마 초기화 델타를 약 40.0K+ 토큰(full)에서 약 3.0K(search)로 줄였습니다 (Claude 서버 측 카운트; Claude Code 기본 프롬프트 제외).
🎯 단계별 기능 계층: 세 가지 내장 프로필(search/workflow/full)을 제공하며, search는 온디맨드 기능 확장을 위한 기본 계층으로 사용됩니다.
🌐 풀스택 자동화: Chromium/Camoufox 브라우저, CDP 디버깅 및 네트워크 인터셉션을 원활하게 원자적 작업으로 오케스트레이션합니다.
🛡️ 고급 안티 디버그: debugger 문, 타이밍 검사 및 엄격한 헤드리스 봇 핑거프린팅 기술에 대한 내장 회피 기능을 제공합니다.
🧩 동적 확장성: 코어 서버를 재컴파일하지 않고도 로컬 디렉토리에서 플러그인과 워크플로우를 핫 리로드합니다.
🔧 제로 와이어링 확장성: manifest.ts를 통한 자동 도메인 검색, 지연 핸들러 인스턴스화 및 플러그인/워크플로우를 위한 B-Skeleton 계약을 지원합니다.
🛠️ 리버스 엔지니어링 툴체인: 통합 WASM 디스어셈블리, 바이너리 엔트로피 분석, 메모리 내 스캔 및 Burp Suite/Ghidra/IDA Pro를 위한 브릿지를 제공합니다.
JSHookMCP는 36개 도메인에 걸쳐 360개 이상의 원자적 도구를 노출하여 AI 오케스트레이터에게 독보적인 기능을 제공합니다:
🕸️ 브라우저 자동화 및 리버스 엔지니어링: 제로 설정 Chromium/Camoufox 주입, CDP(Chrome DevTools Protocol) 오케스트레이션 및 iframe 평가 우회.
📡 네트워크 인터셉션 및 스푸핑: 심층 HTTP/2 프레임 빌딩, MiTM 트래픽 캡처, GraphQL 인트로스펙션 및 Burp Suite 브릿지.
🧠 AST 및 의미론적 분석: LLM 기반 난독화 해제, WebAssembly(WASM) 디스어셈블리, 소스 맵 재구성 및 바이너리 엔트로피 시각화.
🧰 프로세스 및 메모리 포렌식: 네이티브 Frida 계측, 메모리 스캔, 포인터 역참조 및 엄격한 안티 디버그 완화.
🔌 동적 확장성: 핫 리로드 가능한 B-Skeleton 플러그인 및 선언적 WorkflowContract 파이프라인.
[!TIP] 컨텍스트 효율성 벤치마크: 내장 도구 스키마 초기화 델타 (Claude 서버 측 카운트):
search≈ 3.0K 토큰 vsfull≈ 40.0K+ 토큰.
점진적 도구 검색: search_tools 메타 도구(BM25 랭킹) + activate_tools / activate_domain + 프로필 기반 계층 업그레이드(boost_profile)
검색 계층 동작: search_tools는 결과 검색 및 순위 지정만 수행하며, activate_tools를 자동 실행하거나 boost_profile을 자동 실행하지 않습니다. 권장 체인: search_tools -> activate_tools / activate_domain -> boost_profile (필요한 경우에만)
단일 도구에 대한 부스트 금지: activate_tools는 현재 기본 계층에서 계층 전반의 정확한 도구를 등록할 수 있습니다. boost_profile은 관련 도구의 광범위한 제품군을 반복적으로 재사용할 것으로 예상될 때 더 좋습니다.
지연 도메인 초기화: 핸들러 클래스는 시작 시점이 아닌 첫 호출 시 Proxy를 통해 인스턴스화됩니다.
도메인 자체 검색: 런타임 매니페스트 스캔(domains/*/manifest.ts)이 하드코딩된 임포트를 대체합니다. 단일 매니페스트 파일을 생성하여 새 도메인을 추가하세요.
B-Skeleton 계약: 플러그인(PluginContract), 워크플로우(WorkflowContract) 및 관측 가능성(InstrumentationContract)을 위한 확장성 계약.
MCP ToolAnnotations: 모든 도구는 의미론적 주석(readOnlyHint, destructiveHint, idempotentHint, openWorldHint)을 포함하여 AI 오케스트레이터가 호출 전 도구의 안전성과 부작용을 추론할 수 있도록 합니다.
아래의 내장 표면은 런타임 레지스트리에서 생성되며 CI에서 확인됩니다.
패키지 버전: 0.3.0
내장 도구: 387
도메인: adb-bridge, antidebug, binary-instrument, boringssl-inspector, browser, canvas, coordination, core, cross-domain, debugger, encoding, evidence, extension-registry, graphql, hooks, instrumentation, macro, maintenance, memory, mojo-ipc, network, platform, process, protocol-analysis, proxy, sandbox, shared-state-board, skia-capture, sourcemap, streaming, syscall-hook, trace, transform, v8-inspector, wasm, workflow
참고: 이 스냅샷은 런타임 레지스트리에서 생성되었습니다. 수동으로 카운트를 편집하지 마십시오.
Activate all tools in a domain at once. Domains: . Use reload_extensions first to include external plugin/workflow domains.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to activate (e.g. "debugger", "network") | |
| ttlMinutes | No | Auto-deactivate after N minutes (default: 30, set 0 for no expiry) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must bear the burden of disclosing behavior. The description only states the basic action and a prerequisite, but does not mention any side effects, permissions, or reversibility of activation. It also has a broken placeholder 'Domains: .'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (2 sentences), but includes a confusing broken fragment 'Domains: .' which detracts from conciseness. It is front-loaded with the main action but ends with an incomplete thought.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description should provide more context, such as the list of available domains or what 'activation' entails. It fails to do so, leaving the user uncertain about the domains that can be activated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters, so the description does not need to add much. It does not elaborate on the parameters beyond the schema, so it meets the baseline for no added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Activate all tools in a domain at once.' It distinguishes from siblings like 'activate_tools' (which likely activates individual tools) by specifying it operates on a whole domain. However, the incomplete sentence 'Domains: .' reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a prerequisite: 'Use reload_extensions first...', which implies when to use it. But it does not explicitly contrast with alternatives like 'activate_tools' or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Dynamically register specific tools by name, regardless of current base tier. Use after search_tools to enable exactly the tools you need. In search-tier sessions this is usually enough; you do not need boost_profile just to use a few exact tools. Activated tools appear in the tool list immediately. If tools do not appear after activation, use call_tool to invoke them directly.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes | Array of tool names to activate (from search_tools results) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description discloses that activation makes tools appear immediately and suggests direct invocation if not. Lacks details on side effects or permissions, but adequately covers expected behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Multiple sentences but no waste; core action front-loaded. Could be slightly shorter, but structure is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple input, no output schema, the description explains activation behavior, usage pattern, and recovery step, making it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds context by referencing search_tools as source for names, reinforcing parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool dynamically registers tools by name, and distinguishes from siblings like search_tools and call_tool. It also compares to boost_profile, providing clear purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use after search_tools, notes it's usually enough without boost_profile, and provides fallback using call_tool if activation fails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute an already-active tool by name. Use this when activate_tools/activate_domain registered a tool but your client did not refresh its tool list. Does not auto-activate inactive tools.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The tool name to execute (from search_tools or describe_tool results) | |
| args | No | Arguments object to pass to the tool |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must fully disclose behaviors. It only states it executes active tools and does not auto-activate, omitting error handling, auth needs, rate limits, or what happens if tool not found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with main purpose and usage context, no wasted words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers core purpose and limitation but lacks details on error cases, return value, or validation of args. Given no output schema, more behavioral context would be helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage for both parameters (name and args), so the description adds little beyond schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'execute' and resource 'already-active tool', and distinguishes from sibling tools like activate_tools and deactivate_tools by specifying it does not auto-activate inactive tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes when to use (after activation when client didn't refresh) and implies when not to use (tool not active). Could mention alternatives like activate_tools for inactive tools, but is still clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Remove previously activated tools to free context. Only affects tools added via activate_tools, not base profile tools.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes | Array of tool names to deactivate |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool removes tools and frees context, but does not mention side effects, permissions, or reversibility. The behavioral transparency is adequate but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action, and contains no unnecessary words. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema (one required array parameter) and no output schema, the description adequately explains the tool's effect and scope. It is complete for the tool's straightforward purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a description for the 'names' parameter: 'Array of tool names to deactivate'. The overall description adds context that these are tools activated via activate_tools, but this is already implied by the tool's purpose. The schema does the heavy lifting, so the description adds limited additional meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool removes previously activated tools to free context, specifying the verb 'remove' and the resource 'previously activated tools'. It distinguishes from siblings by clarifying it only affects tools added via activate_tools, not base profile tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that the tool only affects tools added via activate_tools, not base profile tools, providing clear guidance on when to use it. It implies it is the counterpart to activate_tools, but does not explicitly mention alternatives or when not to use it beyond that scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get detailed information about a specific tool, including its input schema. Use this to see the exact parameters a tool expects before calling it.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Tool name to describe |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description accurately states it retrieves tool info and input schema, but offers no additional behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with purpose, no redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Sufficient for a simple tool with one parameter and no output schema; could mention return format but not essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter 'name' already described in schema (100% coverage); description adds no extra meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'Get' and resource 'detailed information about a specific tool', distinct from sibling tools like call_tool or search_tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly suggests using before calling another tool to inspect parameters, but lacks explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
One-stop tool router: accepts a natural language task description, returns recommended tools and next actions. Automatically detects workflow patterns, recommends activation order, and provides example arguments. Use this instead of search_tools when you want guided tool discovery with actionable next steps.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | Natural language description of the task you want to accomplish | |
| context | No | Optional context hints for routing |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description fully carries behavioral disclosure. It explains that the tool detects workflow patterns, recommends activation order, and provides example arguments, going beyond simple I/O to explain internal processing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with clear front-loading: first sentence defines purpose, second sentence adds usage guidance. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description mentions 'returns recommended tools and next actions' but lacks details on output format, structure, or how to interpret results. For a tool whose primary output is recommendations, this is a notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for 'task' and 'context'. Description does not add further semantic detail beyond what schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states tool is a router that accepts a task description and returns recommended tools/actions. It explicitly distinguishes from sibling search_tools, providing specific verb+resource: natural language task to tool recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this instead of search_tools when you want guided tool discovery with actionable next steps', providing clear context for when to use this tool. Could be stronger by stating conditions for using alternatives like search_tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search 0 tools across 0 capability domains. This includes built-in tools plus any loaded plugin/workflow tools (0 currently loaded). In search-tier sessions, call this before assuming a capability is unavailable. Use activate_tools for exact matches, activate_domain for an entire domain. Domains: . Query tip: before searching, distill your intent into key concepts (action verb + target + domain). Pass distilled keywords, not full sentences — the search engine works on token matching, not semantic understanding.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Before calling, distill your intent into 2-5 key concepts: what action, on what target, in which domain. Pass only those distilled keywords — not the original user request. | |
| top_k | No | Max results to return (default: 10, max: 30) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description adds behavioral context: it explains how the search engine works ('token matching, not semantic understanding') and provides a query formulation tip. However, it does not disclose potential limitations or exact return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with multiple sentences. While each sentence provides useful information, it is slightly verbose and could be more streamlined. However, it is still relatively concise and front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has two parameters, no output schema, and no annotations, the description covers purpose, usage guidance, query optimization, and sibling differentiation. It lacks details on result structure or pagination, but overall it is fairly complete for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters documented. The description adds value beyond schema by providing guidance on how to construct the query parameter (distill intent into key concepts) and clarifying the default and max for top_k. This adds meaning not present in the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as searching tools across capability domains, including built-in and plugin/workflow tools. It distinguishes itself from sibling tools like activate_tools and activate_domain by specifying that it is for searching, not activating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises when to use this tool: 'In search-tier sessions, call this before assuming a capability is unavailable.' It also provides alternatives: 'Use activate_tools for exact matches, activate_domain for an entire domain.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.3.0activate_domainactivate_toolscall_tooldeactivate_toolsdescribe_toolroute_toolsearch_toolsScored across 7 tools
Tools have mostly distinct purposes, but activate_domain and activate_tools overlap in activation functionality, and route_tool overlaps with search_tools in discovery. Descriptions help differentiate.
All tools follow a consistent verb_noun pattern (e.g., activate_domain, search_tools), making predictions easy.
7 tools is well-scoped for a tool management server, covering all necessary operations without being excessive.
Covers activation, deactivation, search, description, routing, and calling. No obvious gaps in the tool management lifecycle.
Anonymous webhook capture, inspection, waiting, and response configuration for AI agents.
Provides style context & tokens to design or restyle web UIs in any framework
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Universal AI API Orchestrator — 1,554 tools, 96 services. One install.
