jshookmcp packages 735 analysis tools across 36 domains into one MCP server, letting authorized agents hook pages, capture traffic, and disassemble WASM without schema overload.

vmoranv/jshookmcp is a TypeScript project, licensed AGPL-3.0 and sitting at roughly 2,036 stars, that bills itself as an operating system for front-end reverse engineering rather than yet another thin MCP wrapper. Instead of exposing five hand-rolled functions, it publishes 735 tools organized into 36 self-discovered domains — spanning browser automation, network interception, JS hooking, WASM disassembly, process forensics, and APK triage — all behind a single Model Context Protocol server. The README is unusually explicit about the design problem it solves: dumping 735 tool schemas into an LLM context would consume around 109K tokens in the full profile, so the entire architecture is built around progressive disclosure. The search profile loads only about 3K tokens of metadata, measured by the authors on 2026-10-10, and that figure is honestly flagged as scaling with the catalog.

The profile ladder is the most interesting engineering decision here. An agent starts in search, where a meta-tool called search_tools uses BM25 plus optional hybrid vector ranking to find the right capability; it promotes to workflow when it needs composite scripts, and only escalates to full when every tool is genuinely required. A coverage_report meta-tool shows what is currently active on demand. This is a pragmatic answer to a real operational problem anyone who has run large MCP servers against modern models will recognize: context windows are finite, and schema bloat degrades reasoning quality long before you hit the hard limit. The vector search is lazy-loaded and only enabled by default on the shared HTTP daemon, with SEARCH_VECTOR_ENABLED=false available when lexical ranking suffices.

The second architectural pillar is runtime recovery and session isolation. Over Streamable HTTP, the server restores activated domains, browser attach state, and coverage state after a reconnect — meaning a dropped session does not cost you an hour of browser instrumentation work. Browser-side state is isolated per client, so two agents sharing the same daemon cannot trample each other's CDP sessions. The deployment story follows from this: a default stdio config spawns one process per MCP host, but pnpm build followed by pnpm daemon starts a shared local daemon at http://127.0.0.1:3000/mcp, letting multiple clients share one embedding model, browser runtime, and cache. The README sensibly instructs you to keep the loopback bind and set MCP_AUTH_TOKEN before ever exposing the endpoint beyond localhost — advice worth heeding given the power of the tool surface.

Browser automation covers both Chromium and Camoufox via CDP, with attach-to-existing-target support, anti-detection presets, popup/download/permission interceptors, and JS/CSS injection at three document phases. The CAPTCHA solver is notably scoped: the README stresses it takes explicit input rather than performing built-in page or feature probing, which reads as a deliberate attempt to keep the tool on the analysis side of the line rather than the bulk-automation side. The network stack complements this with an auto-generated self-signed HTTPS interception CA, HTTP/1.1 and HTTP/2 frame building, WebSocket capture, GraphQL introspection helpers, and a Burp Suite bridge — the ingredients an authorized analyst needs to understand how a web application actually talks.

The reverse-engineering core is where jshookmcp separates itself from string-search toys. WASM modules go through wabt with wasm2wat, wasm-decompile, wasm-objdump, and wasm2c transpilation, plus Binaryen wasm-opt, a pure-TypeScript section parser, name-section recovery, function-level binary diffing, obfuscation detection, and function- and basic-block-level instrumentation. JavaScript analysis includes LLM-powered deobfuscation, crypto routine detection, AST comprehension, source-map reconstruction, and scriptlet extraction with replay. The README pointedly contrasts this with 'a single regex call wrapped as a tool,' and the tool inventory — wasm_dump through generate_hooks through memory_breakpoint — backs the claim up.

Below the browser layer sits a genuine native stack. A Frida bridge exposes frida_spawn, frida_attach_interceptor, frida_run_script, and frida_enumerate_functions; Ghidra and IDA bridges, syscall hooking, TLS keylog tooling, native FFI scanning, hardware breakpoints, PE introspection, and guarded memory read/write round out process forensics. Android support is equally substantive: APK static triage, manifest dump and query, apktool decode/build, jadx decompilation with code search, DEX scanning, APK signing, unidbg emulation, and runtime DEX dump. For defenders, this is the toolchain shape you want when triaging a suspicious APK or a packed browser extension in a lab VM.

The use-case table in the README maps cleanly onto authorized workflows: skim a minified bundle via search_tools → deobfuscate → search_in_scripts → understand_code; reverse a WASM crypto routine via wasm_dump → wasm_disassemble → generate_hooks → memory_breakpoint; triage a suspicious APK end to end; or audit a Node process for credential exposure using process_list and filtered memory scanning. Every scenario is an analysis pattern — understanding code, verifying behavior, documenting findings — rather than an attack chain, which fits the documentary framing of the project even though its capabilities overlap with offensive tradecraft.

Extensibility is handled through hot-reload plugins, declarative workflows, and auto-discovered domains, so the 735-tool count is a moving target rather than a frozen surface. Meta tools enforce hygiene at the protocol level: describe_tool returns the JSON Schema for any capability, call_tool validates arguments before invocation, and every tool ships with standard hints — readOnlyHint, destructiveHint, idempotentHint, openWorldHint — letting a cautious agent refuse destructive calls unprompted. A background task queue with progress, cancellation, and async modes, plus multi-agent coordination, addresses the reality that long-running instrumentation jobs outlive a single turn.

Installation is deliberately minimal: add npx -y @jshookmcp/jshook@latest to your claude_desktop_config.json with MCP_TOOL_PROFILE set to search, and the lightweight configuration skips optional ONNX, Z3, Binaryen, Camoufox, and Playwright packages via npm_config_omit. The project requires Node 22.22.2+ or 24.15+, builds with pnpm 10.x under strict TypeScript, and publishes bilingual English/Chinese documentation — a signal of an actively maintained, professionally run codebase. Note the npm package badge is annotated as pending publication, so verify registry availability before standardizing on it.

Caveats worth flagging: the README carries a residential-proxy sponsor placement, which tells you something about the intended audience for the anti-detection features, and capabilities like TLS keylogging, MITM CA generation, and memory write primitives are powerful enough that this belongs in a lab or a clearly scoped engagement, not on a daily-driver machine pointed at arbitrary targets. The AGPL-3.0 license also matters for anyone embedding it into commercial tooling. Within an authorized context — your own applications, contracted assessments, malware triage — jshookmcp is one of the more coherent attempts yet to make deep reverse engineering legible to LLM agents without burning the context budget that makes them useful.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• pentest-tools for quick reconnaissance and web checks during authorized tests


• pentestagent for autonomous black-box security testing


• emba for firmware security analysis of embedded Linux devices