@jshookmcp/jshook

English | 中文

An MCP server that gives AI agents 600+ tools across 34 domains for JavaScript analysis and security research — browser automation, CDP debugging, network interception, JS hooks, LLM-powered code analysis, process/memory forensics, WASM reverse engineering, source-map reconstruction, AST transforms, and composite workflows in a single server.

Quick Links

• **📖 Documentation · 🚀 Getting Started · ⚙️ Configuration · 📚 Tool Reference**

🚀 Quick Start

No global install needed — add to your MCP client config and you're ready:

Claude Desktop / Cursor (`claude_desktop_config.json`):

{
  "mcpServers": {
    "jshook": {
      "command": "npx",
      "args": ["-y", "@jshookmcp/jshook@latest"],
      "env": {
        "MCP_TOOL_PROFILE": "search",
        "npm_config_omit": "optional"
      }
    }
  }
}

*(Windows: use `npx.cmd` absolute path if `npx` is not found)*

This lightweight configuration skips optional ONNX, Z3, Binaryen, Camoufox, and Playwright

packages. Remove `npm_config_omit` when those full-profile runtimes are required.

Share one daemon across multiple agents

The default stdio configuration starts one full jshook process per MCP host. To share the

embedding model, browser runtime, and caches, start one local Streamable HTTP daemon:

pnpm build
pnpm daemon

Vector search defaults to off for per-client stdio processes and on (lazy-loaded) for the shared

HTTP daemon. Set `SEARCH_VECTOR_ENABLED=false` when lexical search is sufficient.

Then point every MCP client at `http://127.0.0.1:3000/mcp` using its HTTP/URL server

configuration. Each client receives its own MCP session and response route while heavyweight

runtime resources remain in one process. Keep the default loopback bind; set `MCP_AUTH_TOKEN`

before exposing the endpoint beyond localhost.

🌟 Highlights

• 🤖 AI-Driven Analysis — LLM-powered deobfuscation, crypto detection, AST comprehension
• ⚡ Search-First Context Efficiency — `search` profile ≈ 3K tokens vs `full` ≈ 40K+ tokens
• 🎯 Progressive Tiers — `search` → `workflow` → `full`, activate on demand
• 🌐 Full-Stack Browser Automation — Chromium/Camoufox + CDP + anti-detection + CAPTCHA handling
• 🔁 Runtime Recovery and Session Isolation — HTTP sessions restore activated domains, browser attach state, coverage state, and isolate browser-side session state per client
• 🧭 Schema-First Meta Tools — `describe_tool`, validated `call_tool`, and `coverage_report` reduce parameter errors and make tool coverage visible
• 📡 Network Interception — HTTP/2 frame building, MiTM capture, GraphQL, Burp Suite bridge
• 🛠️ Reverse Engineering Toolchain — WASM disassembly, binary analysis, Frida, Ghidra/IDA bridges
• 🧰 Process & Memory Forensics — Native FFI scanning, hardware breakpoints, PE introspection
• 🧩 Dynamic Extensibility — Hot-reload plugins, declarative workflows, auto-discovered domains

Recent Runtime Notes

• HTTP transport now multiplexes independent MCP sessions and restores runtime state after reconnects.
• `proxy_start` auto-generates a local HTTPS interception CA when needed.
• Browser CAPTCHA solving is now explicit-input driven: pass `taskKind`, `siteKey`, `imageBase64`, `callbackName`, and `responseSelector` as needed. Built-in widget/page signature probing is intentionally not used.

Architecture

• Runtime Registry — Domains auto-discovered via `manifest.ts`; add a domain by creating one file
• Lazy Initialization — Handlers instantiated on first call, not at startup
• BM25 + Vector Search — `search_tools` meta-tool with hybrid ranking and adaptive weights
• MCP ToolAnnotations — Every tool carries `readOnlyHint` / `destructiveHint` / `idempotentHint` / `openWorldHint`

Registry Snapshot

The built-in surface below is generated from the runtime registry and checked in CI.

• Package version: `0.3.5`
• Built-in Tools: `716`
• Domains: `adb-bridge`, `binary-instrument`, `boringssl-inspector`, `browser`, `canvas`, `coordination`, `core`, `cross-domain`, `dart-inspector`, `debugger`, `encoding`, `exploit-dev`, `extension-registry`, `graphql`, `instrumentation`, `maintenance`, `memory`, `mojo-ipc`, `native-bridge`, `native-emulator`, `network`, `platform`, `process`, `protocol-analysis`, `proxy`, `sourcemap`, `streaming`, `syscall-hook`, `tasks`, `trace`, `transform`, `v8-inspector`, `wasm`, `webgpu`, `workflow`
• Note: this snapshot is generated from the runtime registry; do not edit the counts by hand.

> **View the complete Tool Reference ↗**

Project Stats