jshook

// Overview

jshook (repository `vmoranv/jshookmcp`, npm package `@jshookmcp/jshook`) is a reverse-engineering workspace for AI agents, delivered as a single Model Context Protocol server. Its README describes it as closer to "an operating system for front-end reverse engineering": an agent can hook a web page, capture its network traffic, deobfuscate the JavaScript bundle, disassemble WebAssembly and instrument a native process without leaving one tool surface. The registry snapshot in the README lists 735 built-in tools across 36 domains, from `browser`, `network` and `proxy` to `wasm`, `memory`, `syscall-hook` and `adb-bridge`.

Exposing that many tools would normally flood a model's context, so jshook is built search-first. A `search` profile loads only about 3K tokens of tool metadata and lets the agent find what it needs through a `search_tools` meta-tool with BM25 plus hybrid vector ranking; a `workflow` profile adds composite scripts; the `full` profile exposes every tool at around 109K tokens. Meta tools such as `describe_tool` and `call_tool` return JSON Schemas and validate arguments before a call, and every tool carries MCP annotations like `readOnlyHint` and `destructiveHint`.

Under the hood it drives Chromium and Camoufox over CDP with anti-detection presets, runs a MITM proxy with an auto-generated HTTPS interception CA, disassembles WASM through wabt and Binaryen, and bridges to Frida, Ghidra and IDA. It runs over stdio for a single MCP host or as a shared Streamable HTTP daemon that several agents can use at once, with per-client session isolation and state restored after reconnects. The project is written in TypeScript, licensed AGPL-3.0, and its release notes declare it a dual-use tool.

// What it does

• Profile ladder — `search` (~3K tokens of metadata), `workflow` (composite scripts) and `full` (all 735 tools) — so agents only load the schemas a task needs
• Browser automation with Chromium and Camoufox via CDP: attach to existing targets, anti-detection presets, script injection and an explicit-input CAPTCHA solver
• Network interception: MITM proxy with an auto-generated HTTPS CA, HTTP/1.1 and HTTP/2 frame building, WebSocket capture, GraphQL helpers and a Burp Suite bridge
• JavaScript analysis: LLM-powered deobfuscation, crypto routine detection, AST transforms and source-map reconstruction
• Binary and native work: wabt WASM disassembly, Frida, Ghidra and IDA bridges, hardware breakpoints, memory scanning, PE introspection and APK triage with jadx
• Hot-reload plugins, declarative YAML workflows and auto-discovered domains, over stdio or a shared Streamable HTTP daemon

// Getting started

No global install is needed: the README's quick start adds jshook to an MCP client config and runs it through npx. Building from source needs Node.js 22.22.2+ and pnpm 10.x. Commands below come from the project's README.

{
  "mcpServers": {
    "jshook": {
      "command": "npx",
      "args": ["-y", "@jshookmcp/jshook@latest"],
      "env": {
        "MCP_TOOL_PROFILE": "search",
        "npm_config_omit": "optional"
      }
    }
  }
}

{
  "env": {
    "MCP_TOOL_PROFILE": "workflow"
  }
}

pnpm install
pnpm build
pnpm daemon

pnpm start           # run the built server from dist/
pnpm dev             # run from source under tsx watch
pnpm test            # Vitest unit suites

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Reach for it when an agent needs to deobfuscate and understand a minified JavaScript bundle on a live page
• Reach for it to capture and replay an authentication or GraphQL flow through a MITM proxy
• Reach for it when reversing a WASM crypto routine or hooking a function in a running process with Frida
• Reach for it to triage a suspicious Android APK with static analysis and jadx decompilation

// How jshook compares

jshook alongside other open-source security agents tools AI/TLDR tracks, ranked by GitHub stars.