JS Reverse MCP

What does this agent do, and when should you use it?

JS Reverse MCP is a JavaScript reverse-engineering MCP server that exposes headed Chrome debugging, breakpoints, network inspection, WebSocket analysis, and browser-state controls to AI coding assistants. Instead of mirroring Chrome DevTools menus, it packages Chrome DevTools Protocol and Patchright behavior into 24 tools designed for sequential agent decisions. Its default execution model uses the installed Google Chrome, a visible window, a persistent profile, and Patchright protocol-level stealth; an optional CloakBrowser mode adds source-level fingerprint patches for more heavily protected sites. Results can be returned through MCP or exported as script source, raw request data, and binary material for subsequent local analysis. It runs through npx or a locally built Node.js entry point and documents direct MCP setup for Claude Code, Codex, Cursor, and VS Code Copilot.

A workflow starts with new_page, then uses list_scripts, search_in_sources, get_script_source, and save_script_source to locate and preserve JavaScript. set_breakpoint_on_text and break_on_xhr create breakpoints; after execution pauses, get_paused_info reports call stacks and scope variables, while evaluate_script runs code in either the page or a paused call frame and step or pause_or_resume controls execution. For traffic analysis, list_network_requests indexes, inspects, or exports request material, get_request_initiator retrieves the JavaScript initiator stack, and get_websocket_messages groups connections and messages. clear_site_data removes cookies, origin storage, and sessionStorage for the current site, with an option to clear the global HTTP cache, so initialization and risk-control flows can be replayed. Additional tools select pages and frames, click visible elements, take screenshots, and inspect console messages; outputFile, filePath, and localFilePath parameters connect browser evidence with local files.

1. A security researcher or frontend analyst needs to find encryption, signing, or sensor logic inside minified scripts and break on matching source text.
2. A developer needs to trigger a page action and inspect runtime arguments, scope variables, call stacks, and nearby source at the pause point.
3. A protocol analyst needs the initiator stack, headers, bodies, responses, or Set-Cookie data for selected XHR and Fetch requests.
4. An engineer investigating a real-time web application needs to enumerate WebSocket connections, identify message patterns, and inspect individual frames.
5. A researcher studying cookie or risk-control initialization needs to clear site state, reload repeatedly, and export the decisive requests.
6. A debugger blocked by automation detection needs Patchright stealth by default and an optional CloakBrowser fingerprint-patching mode for harder targets.

How do you install or deploy this agent?

The documented runtime is Node.js 20.19 or newer plus the stable release of Google Chrome. The standard server setup does not require API credentials. The shortest installation path is an npx-backed MCP configuration:

{
  "mcpServers": {
    "js-reverse": {
      "command": "npx",
      "args": ["js-reverse-mcp"]
    }
  }
}

Register it in Claude Code with:

claude mcp add js-reverse npx js-reverse-mcp

For Codex, run:

codex mcp add js-reverse -- npx js-reverse-mcp

A local source installation is also documented:

git clone https://github.com/zhizhuodemao/js-reverse-mcp.git
cd js-reverse-mcp
npm install
npm run build

Point the MCP client at the resulting Node.js entry point:

{
  "mcpServers": {
    "js-reverse": {
      "command": "node",
      "args": ["/your/path/js-reverse-mcp/build/src/index.js"]
    }
  }
}

For --cloak, pre-download the optional browser binary, which is approximately 200 MB:

npx cloakbrowser install

Then configure the MCP arguments as ["js-reverse-mcp", "--cloak"].

How do you use this agent?

After the MCP server starts, call new_page with the target URL. Initial navigation deliberately keeps CDP quiet, so a complete traffic capture requires calling list_network_requests to activate collectors, running navigate_page(type="reload"), and listing the requests again. Inspect a key request by reqid or supply outputFile to export raw headers, bodies, or query data. For script work, proceed through list_scripts, search_in_sources, and set_breakpoint_on_text; trigger the relevant page behavior, then use get_paused_info, evaluate_script, and step after the breakpoint is hit. To replay cookie or risk-control initialization, run clear_site_data(confirm=true), reload, and export the requests that set cookies or submit sensor data. In production or shared environments, pass one or more --allowedRoots options to constrain host-file access.

What are this agent's strengths and limitations?

How does this agent compare with similar options?

Key facts side by side with the most closely related agents.

How does FollowAgents rate this agent?

Recent releases

Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.

1. v4.0.5 2026-09-03
   Release notes excerpt

   Full Changelog: https://github.com/zhizhuodemao/js-reverse-mcp/compare/v4.0.4...v4.0.5

   View on GitHub ↗
2. v4.0.3 2026-08-20
   Release notes excerpt

   Full Changelog: https://github.com/zhizhuodemao/js-reverse-mcp/compare/v4.0.2...v4.0.3

   View on GitHub ↗
3. v4.0.2 2026-08-20
   Release notes excerpt

   Full Changelog: https://github.com/zhizhuodemao/js-reverse-mcp/compare/v4.0.1...v4.0.2

   View on GitHub ↗

FAQ