Js Reverse MCP Server

JS Reverse MCP

English | 中文

A JavaScript reverse engineering MCP server that enables AI coding assistants (Claude, Cursor, Copilot) to debug and analyze JavaScript code in web pages.

Built on the Patchright anti-detection engine with multi-layered anti-bot bypass capabilities, allowing it to work on sites with bot detection such as Zhihu and Google.

Features

• Anti-detection browser: Based on Patchright (Playwright anti-detection fork), 60+ stealth launch arguments, bypasses mainstream anti-bot systems
• Script analysis: List all loaded JS scripts, search code, get/save source code
• Breakpoint debugging: Set/remove breakpoints, conditional breakpoints, precise positioning in minified code
• Function tracing: Trace any function (including module-internal functions) via logpoints
• Execution control: Pause/resume execution, step debugging (over/into/out) with source context
• Runtime inspection: Evaluate expressions at breakpoints, inspect scope variables
• Network analysis: View request initiator call stacks, set XHR breakpoints, WebSocket message analysis
• Script injection: Inject scripts that run before page load for interception and instrumentation

Requirements

• Node.js v20.19 or later
• Chrome stable

Quick Start (npx)

No installation required. Add to your MCP client configuration:

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": ["js-reverse-mcp"]
    }
  }
}

Claude Code

claude mcp add js-reverse npx js-reverse-mcp

Codex

codex mcp add js-reverse -- npx js-reverse-mcp

Cursor

Go to Cursor Settings -> MCP -> New MCP Server, and use the configuration above.

VS Code Copilot

code --add-mcp '{"name":"js-reverse","command":"npx","args":["js-reverse-mcp"]}'

Local Installation (Alternative)

git clone https://github.com/zhizhuodemao/js-reverse-mcp.git
cd js-reverse-mcp
npm install
npm run build

Then use local path in your MCP configuration:

{
  "mcpServers": {
    "js-reverse": {
      "command": "node",
      "args": ["/path/to/js-reverse-mcp/build/src/index.js"]
    }
  }
}

Anti-Detection

js-reverse-mcp includes multi-layered anti-detection measures to work on sites with bot detection:

Anti-Detection Architecture

Tools (23)

Page & Navigation

Script Analysis

Breakpoint & Execution Control

Function Tracing & Injection

Network & WebSocket

Inspection

Usage Examples

Basic JS Reverse Engineering Workflow

1. Open the target page

Open https://example.com and list all loaded JS scripts

1. Find target functions

Search all scripts for code containing "encrypt"

1. Set breakpoints

Set a breakpoint at the entry of the encryption function

1. Trigger and analyze

Trigger an action on the page, then inspect arguments, call stack and scope variables when the breakpoint hits

Trace Module-Internal Functions

Use trace_function to trace the webpack-bundled internal function "encryptData",
view arguments of each call without setting breakpoints

WebSocket Protocol Analysis

List WebSocket connections, analyze message patterns, view messages of specific types

Configuration Options

Example Configurations

Enhanced anti-detection (Canvas noise + WebRTC blocking):

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": [
        "js-reverse-mcp",
        "--hideCanvas",
        "--blockWebrtc"
      ]
    }
  }
}

Isolated mode (no persistent login, fresh profile each time):

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": [
        "js-reverse-mcp",
        "--isolated"
      ]
    }
  }
}

Connect to a Running Chrome Instance

1. Launch Chrome (close all Chrome windows first, then restart):

macOS

/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 --user-data-dir=/tmp/chrome-debug

Windows

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="%TEMP%\chrome-debug"

1. Configure MCP connection:

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": [
        "js-reverse-mcp",
        "--browser-url=http://127.0.0.1:9222"
      ]
    }
  }
}

Troubleshooting

Blocked by Anti-Bot Systems

If you are blocked when visiting certain sites (e.g. Zhihu returning error 40362):

1. Clear the contaminated profile: Delete the ~/.cache/chrome-devtools-mcp/chrome-profile directory
2. Use isolated mode: Add the --isolated flag
3. Enable Canvas noise: Add the --hideCanvas flag

Security Notice

This tool exposes browser content to MCP clients, allowing inspection, debugging, and modification of any data in the browser. Do not use it on pages containing sensitive information.

License

Apache-2.0