English | 中文
MCP-сервер (Model Context Protocol) с каталогом встроенных инструментов на основе реестра времени выполнения для анализа JavaScript и безопасности с помощью ИИ. Он объединяет автоматизацию браузера, отладку через Chrome DevTools Protocol, мониторинг сети, интеллектуальные JavaScript-хуки, анализ кода с помощью LLM, инспекцию процессов и памяти, инструменты WASM, восстановление source-map, преобразования AST и составные рабочие процессы в одном сервере.
Related MCP server: JS Reverse Strong MCP
Используйте jshookmcp мгновенно с Claude Desktop или Cursor без глобальной установки.
Конфигурация Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"jshook": {
"command": "npx",
"args": ["-y", "@jshookmcp/jshook@latest"],
"env": {
"JSHOOK_BASE_PROFILE": "search"
}
}
}
}(Примечание для пользователей Windows: если npx не найден, укажите абсолютный путь к npx.cmd)
🤖 Анализ на базе ИИ: Используйте LLM для интеллектуальной деобфускации JavaScript, обнаружения криптографических алгоритмов и понимания кода на уровне AST.
⚡ Эффективность контекста с приоритетом поиска: search_tools на базе BM25 + динамические ускорения сокращают дельту инициализации схемы инструментов jshook с ~40.0K+ токенов (full) до ~3.0K (search) (подсчет на стороне сервера Claude; исключая базовый промпт Claude Code).
🎯 Прогрессивные уровни возможностей: Три встроенных профиля (search/workflow/full), где search является базовым уровнем по умолчанию для масштабирования возможностей по требованию.
🌐 Полностековая автоматизация: Бесшовная оркестрация браузеров Chromium/Camoufox, отладка CDP и перехват сети как атомарные действия.
🛡️ Продвинутая защита от отладки: Встроенные механизмы обхода операторов debugger, проверок времени и строгих методов снятия отпечатков headless-ботов.
🧩 Динамическая расширяемость: «Горячая» перезагрузка плагинов и рабочих процессов из локальных директорий без перекомпиляции основного сервера.
🔧 Расширяемость без настройки: Автоматическое обнаружение доменов через manifest.ts, ленивая инициализация обработчиков и контракты B-Skeleton для плагинов/рабочих процессов.
🛠️ Инструментарий обратной разработки: Интегрированная дизассемблия WASM, анализ энтропии бинарных файлов, сканирование памяти и мосты для Burp Suite/Ghidra/IDA Pro.
JSHookMCP предоставляет более 360 атомарных инструментов в 36 доменах, наделяя ИИ-оркестраторы непревзойденными возможностями:
🕸️ Автоматизация браузера и обратная разработка: Инъекция Chromium/Camoufox без настройки, оркестрация CDP (Chrome DevTools Protocol) и обход оценки iframe.
📡 Перехват и подмена сети: Построение фреймов HTTP/2, захват трафика MiTM, интроспекция GraphQL и мост Burp Suite.
🧠 AST и семантический анализ: Деобфускация с помощью LLM, дизассемблия WebAssembly (WASM), восстановление Source Map и визуализация энтропии бинарных файлов.
🧰 Криминалистика процессов и памяти: Инструментарий Frida, сканирование памяти, разыменование указателей и строгая защита от отладки.
🔌 Динамическая расширяемость: Плагины B-Skeleton с «горячей» перезагрузкой и декларативные конвейеры WorkflowContract.
[!TIP] Бенчмарк эффективности контекста: Дельта инициализации схемы встроенных инструментов (подсчет на стороне сервера Claude):
search≈ 3.0K токенов противfull≈ 40.0K+ токенов.
Прогрессивное обнаружение инструментов: Мета-инструмент search_tools (ранжирование BM25) + activate_tools / activate_domain + повышение уровня на основе профиля (boost_profile)
Поведение уровня поиска: search_tools только ищет и ранжирует результаты; он не запускает автоматически activate_tools и не запускает boost_profile. Рекомендуемая цепочка: search_tools -> activate_tools / activate_domain -> boost_profile только при необходимости
Не повышайте уровень для одного инструмента: activate_tools может регистрировать конкретные инструменты из разных уровней, начиная с текущего базового; boost_profile лучше использовать, когда вы планируете многократно использовать широкое семейство связанных инструментов
Ленивая инициализация доменов: Классы обработчиков создаются через Proxy при первом вызове, а не во время запуска
Самообнаружение доменов: Сканирование манифеста во время выполнения (domains/*/manifest.ts) заменяет жестко закодированные импорты; добавляйте новые домены, создавая один файл манифеста
Контракты B-Skeleton: Контракты расширяемости для плагинов (PluginContract), рабочих процессов (WorkflowContract) и наблюдаемости (InstrumentationContract)
Аннотации инструментов MCP: Каждый инструмент содержит семантические аннотации (readOnlyHint, destructiveHint, idempotentHint, openWorldHint), позволяющие ИИ-оркестраторам оценивать безопасность инструмента и побочные эффекты перед вызовом
Приведенная ниже поверхность инструментов генерируется из реестра времени выполнения и проверяется в CI.
Версия пакета: 0.3.0
Встроенные инструменты: 387
Домены: adb-bridge, antidebug, binary-instrument, boringssl-inspector, browser, canvas, coordination, core, cross-domain, debugger, encoding, evidence, extension-registry, graphql, hooks, instrumentation, macro, maintenance, memory, mojo-ipc, network, platform, process, protocol-analysis, proxy, sandbox, shared-state-board, skia-capture, sourcemap, streaming, syscall-hook, trace, transform, v8-inspector, wasm, workflow
Примечание: этот снимок генерируется из реестра времени выполнения; не редактируйте счетчики вручную.
Activate all tools in a domain at once. Domains: . Use reload_extensions first to include external plugin/workflow domains.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to activate (e.g. "debugger", "network") | |
| ttlMinutes | No | Auto-deactivate after N minutes (default: 30, set 0 for no expiry) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must bear the burden of disclosing behavior. The description only states the basic action and a prerequisite, but does not mention any side effects, permissions, or reversibility of activation. It also has a broken placeholder 'Domains: .'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (2 sentences), but includes a confusing broken fragment 'Domains: .' which detracts from conciseness. It is front-loaded with the main action but ends with an incomplete thought.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description should provide more context, such as the list of available domains or what 'activation' entails. It fails to do so, leaving the user uncertain about the domains that can be activated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters, so the description does not need to add much. It does not elaborate on the parameters beyond the schema, so it meets the baseline for no added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Activate all tools in a domain at once.' It distinguishes from siblings like 'activate_tools' (which likely activates individual tools) by specifying it operates on a whole domain. However, the incomplete sentence 'Domains: .' reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a prerequisite: 'Use reload_extensions first...', which implies when to use it. But it does not explicitly contrast with alternatives like 'activate_tools' or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Dynamically register specific tools by name, regardless of current base tier. Use after search_tools to enable exactly the tools you need. In search-tier sessions this is usually enough; you do not need boost_profile just to use a few exact tools. Activated tools appear in the tool list immediately. If tools do not appear after activation, use call_tool to invoke them directly.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes | Array of tool names to activate (from search_tools results) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description discloses that activation makes tools appear immediately and suggests direct invocation if not. Lacks details on side effects or permissions, but adequately covers expected behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Multiple sentences but no waste; core action front-loaded. Could be slightly shorter, but structure is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple input, no output schema, the description explains activation behavior, usage pattern, and recovery step, making it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds context by referencing search_tools as source for names, reinforcing parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool dynamically registers tools by name, and distinguishes from siblings like search_tools and call_tool. It also compares to boost_profile, providing clear purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use after search_tools, notes it's usually enough without boost_profile, and provides fallback using call_tool if activation fails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute an already-active tool by name. Use this when activate_tools/activate_domain registered a tool but your client did not refresh its tool list. Does not auto-activate inactive tools.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The tool name to execute (from search_tools or describe_tool results) | |
| args | No | Arguments object to pass to the tool |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must fully disclose behaviors. It only states it executes active tools and does not auto-activate, omitting error handling, auth needs, rate limits, or what happens if tool not found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with main purpose and usage context, no wasted words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers core purpose and limitation but lacks details on error cases, return value, or validation of args. Given no output schema, more behavioral context would be helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage for both parameters (name and args), so the description adds little beyond schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'execute' and resource 'already-active tool', and distinguishes from sibling tools like activate_tools and deactivate_tools by specifying it does not auto-activate inactive tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes when to use (after activation when client didn't refresh) and implies when not to use (tool not active). Could mention alternatives like activate_tools for inactive tools, but is still clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Remove previously activated tools to free context. Only affects tools added via activate_tools, not base profile tools.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes | Array of tool names to deactivate |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool removes tools and frees context, but does not mention side effects, permissions, or reversibility. The behavioral transparency is adequate but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action, and contains no unnecessary words. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema (one required array parameter) and no output schema, the description adequately explains the tool's effect and scope. It is complete for the tool's straightforward purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a description for the 'names' parameter: 'Array of tool names to deactivate'. The overall description adds context that these are tools activated via activate_tools, but this is already implied by the tool's purpose. The schema does the heavy lifting, so the description adds limited additional meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool removes previously activated tools to free context, specifying the verb 'remove' and the resource 'previously activated tools'. It distinguishes from siblings by clarifying it only affects tools added via activate_tools, not base profile tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that the tool only affects tools added via activate_tools, not base profile tools, providing clear guidance on when to use it. It implies it is the counterpart to activate_tools, but does not explicitly mention alternatives or when not to use it beyond that scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get detailed information about a specific tool, including its input schema. Use this to see the exact parameters a tool expects before calling it.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Tool name to describe |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description accurately states it retrieves tool info and input schema, but offers no additional behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with purpose, no redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Sufficient for a simple tool with one parameter and no output schema; could mention return format but not essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter 'name' already described in schema (100% coverage); description adds no extra meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'Get' and resource 'detailed information about a specific tool', distinct from sibling tools like call_tool or search_tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly suggests using before calling another tool to inspect parameters, but lacks explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
One-stop tool router: accepts a natural language task description, returns recommended tools and next actions. Automatically detects workflow patterns, recommends activation order, and provides example arguments. Use this instead of search_tools when you want guided tool discovery with actionable next steps.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | Natural language description of the task you want to accomplish | |
| context | No | Optional context hints for routing |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description fully carries behavioral disclosure. It explains that the tool detects workflow patterns, recommends activation order, and provides example arguments, going beyond simple I/O to explain internal processing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with clear front-loading: first sentence defines purpose, second sentence adds usage guidance. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description mentions 'returns recommended tools and next actions' but lacks details on output format, structure, or how to interpret results. For a tool whose primary output is recommendations, this is a notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for 'task' and 'context'. Description does not add further semantic detail beyond what schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states tool is a router that accepts a task description and returns recommended tools/actions. It explicitly distinguishes from sibling search_tools, providing specific verb+resource: natural language task to tool recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this instead of search_tools when you want guided tool discovery with actionable next steps', providing clear context for when to use this tool. Could be stronger by stating conditions for using alternatives like search_tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search 0 tools across 0 capability domains. This includes built-in tools plus any loaded plugin/workflow tools (0 currently loaded). In search-tier sessions, call this before assuming a capability is unavailable. Use activate_tools for exact matches, activate_domain for an entire domain. Domains: . Query tip: before searching, distill your intent into key concepts (action verb + target + domain). Pass distilled keywords, not full sentences — the search engine works on token matching, not semantic understanding.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Before calling, distill your intent into 2-5 key concepts: what action, on what target, in which domain. Pass only those distilled keywords — not the original user request. | |
| top_k | No | Max results to return (default: 10, max: 30) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description adds behavioral context: it explains how the search engine works ('token matching, not semantic understanding') and provides a query formulation tip. However, it does not disclose potential limitations or exact return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with multiple sentences. While each sentence provides useful information, it is slightly verbose and could be more streamlined. However, it is still relatively concise and front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has two parameters, no output schema, and no annotations, the description covers purpose, usage guidance, query optimization, and sibling differentiation. It lacks details on result structure or pagination, but overall it is fairly complete for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters documented. The description adds value beyond schema by providing guidance on how to construct the query parameter (distill intent into key concepts) and clarifying the default and max for top_k. This adds meaning not present in the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as searching tools across capability domains, including built-in and plugin/workflow tools. It distinguishes itself from sibling tools like activate_tools and activate_domain by specifying that it is for searching, not activating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises when to use this tool: 'In search-tier sessions, call this before assuming a capability is unavailable.' It also provides alternatives: 'Use activate_tools for exact matches, activate_domain for an entire domain.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.3.0activate_domainactivate_toolscall_tooldeactivate_toolsdescribe_toolroute_toolsearch_toolsScored across 7 tools
Tools have mostly distinct purposes, but activate_domain and activate_tools overlap in activation functionality, and route_tool overlaps with search_tools in discovery. Descriptions help differentiate.
All tools follow a consistent verb_noun pattern (e.g., activate_domain, search_tools), making predictions easy.
7 tools is well-scoped for a tool management server, covering all necessary operations without being excessive.
Covers activation, deactivation, search, description, routing, and calling. No obvious gaps in the tool management lifecycle.
Anonymous webhook capture, inspection, waiting, and response configuration for AI agents.
Provides style context & tokens to design or restyle web UIs in any framework
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Universal AI API Orchestrator — 1,554 tools, 96 services. One install.
