MiniApp CDP MCP

English | Chinese

WeChat MiniApp reverse engineering MCP server, allowing your AI coding assistant (such as Claude, Cursor, Antigravity) to directly debug and analyze JavaScript code in WeChat MiniApps (including WeChat DevTools or PC WeChat MiniApps) via the Chrome DevTools Protocol (CDP).

Features

• Multi-target Debugging: Seamlessly switch between AppService (logic layer) and WebView (rendering layer) targets.

• Network Interception: Capture, monitor, and filter XHR/Fetch requests initiated by the MiniApp.

• Breakpoint Debugging: Set/remove code breakpoints and XHR breakpoints, with support for precise positioning in minified/obfuscated code.

• Execution Control: Pause/resume execution, step debugging (over/into/out), and return source code context.

• Script Analysis: List all loaded JS scripts, search code, and retrieve/save source code.

• Runtime Inspection: Evaluate expressions at breakpoints, and inspect call stacks and scope variables.

• WebSocket Analysis: Monitor WebSocket connections and message patterns.

Related MCP server: JS Reverse MCP

System Requirements

• Python 3.11 or newer

• uv (Required, ultra-fast Python package and environment manager)

• Running WeChat DevTools (with debug port enabled) or PC WeChat MiniApp (with remote debugging mechanism enabled)

Prerequisite 1: Enable MiniApp Debug Port

Before using this MCP, you need to expose the WeChat MiniApp's CDP debug port using an injection tool. Depending on your OS and WeChat version, you can choose one of the following open-source tools to perform the Hook and port exposure (usually exposed on port 62000):

• WMPFDebugger-arm (For macOS ARM architecture)

• WMPFDebugger

• WeChatOpenDevTools-Python

Prerequisite 2: Install uv

This project achieves zero-configuration "out-of-the-box" usage via uvx. If you haven't installed uv yet, please execute the following command based on your system:

macOS / Linux:

curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Quick Start (uvx zero-install)

No need to clone the code locally; you can directly leverage uv's capabilities by adding the following to your AI assistant's MCP configuration file:

{
  "mcpServers": {
    "miniapp-cdp": {
      "command": "uvx",
      "args": ["--from", "miniapp-cdp", "miniapp-cdp-mcp"]
    }
  }
}

Claude Desktop

Modify ~/Library/Application Support/Claude/claude_desktop_config.json and add the configuration above.

Cursor

Go to Cursor Settings -> Features -> MCP -> Add new MCP server:

• Type: command

• Name: miniapp-cdp

• Command: uvx --from miniapp-cdp miniapp-cdp-mcp

Local Installation (Optional)

If you want to modify or develop locally:

git clone https://github.com/yourusername/miniapp-cdp-py.git
cd miniapp-cdp-py
uv sync

Then use the local execution method in your MCP configuration:

{
  "mcpServers": {
    "miniapp-cdp": {
      "command": "uv",
      "args": ["run", "run_mcp_server.py"],
      "cwd": "/你的路径/miniapp-cdp-py"
    }
  }
}

Tool List

Target and Context Management

Network and WebSocket

Script Analysis

Breakpoints and Execution Control

Inspection Tools

Usage Examples

Basic MiniApp Reverse Engineering Workflow

1. Connection and Target Switching

列出所有小程序目标，并切换到 AppService (逻辑层) 线程

2. Finding Target Functions and Code

在所有脚本中搜索包含 "encrypt" 的代码，并获取相关脚本的上下文源码

3. Setting Breakpoints

在加密函数的具体执行语句（如 return 处）设置断点

4. Triggering and Analysis

在小程序上点击触发网络请求，断点命中后，检查参数、调用栈以及密钥的生成逻辑

Intercepting and Analyzing Network Requests

抓取最新发出的网络请求列表，并找出特定的加密请求（如带有 mina_edata 参数的请求），
随后获取该请求的发起者调用栈 (Initiator) 定位加密入口。

Practical Cases

The examples/ directory in the project contains some practical scripts derived from reverse engineering using this tool (e.g., vipshop_decrypt_demo.py), demonstrating how to analyze complex multi-layer encryption algorithms of MiniApps via MCP and perfectly restore them in Python.

Security Notice

This tool exposes the underlying runtime context of the MiniApp to the MCP client, allowing for the inspection, debugging, and modification of any data in the application's memory. Do not use this tool for illegal purposes; it is intended solely for personal learning, security research, and legally authorized reverse engineering analysis.

Acknowledgments

This project is built on cdp-use. cdp-use provides a low-level WebSocket interaction layer that is highly optimized and abstracted for Agent scenarios, greatly simplifying the communication complexity of the raw CDP protocol.

License

MIT License