JS Reverse MCP
Continuous browser-side JavaScript debugging and replay for AI coding assistants.
The evidence clearly discloses browser-content exposure, host-file reads and writes, persistent login state, log leakage risks, the CloakBrowser download, and live-evaluation data flow. allowedRoots resolves real paths and blocks symlink and file-URL escapes, with tests for direct, symlink, and dangling-link escapes. Network-record and site-data clearing require explicit confirmation; logs use mode 0600, and credentialed remote evaluations require HTTPS. Deductions apply because allowedRoots is off by default, leaving local file access unrestricted; the default profile retains cookies and localStorage; navigation, clicking, and arbitrary page evaluation lack a general confirmation layer; and cleared data is not recoverable. CI runs a production dependency audit, some important dependencies are exact-pinned, and tar is overridden, but ranges remain and no lockfile, SBOM, or audit result is supplied. Author, repository, third-party projects, and license are attributed, but publisher identity is unverified and stronger supply-chain identity evidence is absent.
The README, package scripts, CI, and supplied tests are highly consistent about tool behavior, supported Node versions, and release gates. Tests demonstrate concurrent CDP-session deduplication, retry after failure, stale-session detachment, listener rollback, breakpoint restoration, honest partial-removal reporting, and a targeted error for promises that cannot settle while paused. This thoroughly supports self-consistency and failure messaging. Dependency availability is deducted because operation relies on a system Chrome installation, Cloak mode may download roughly 200 MB on first use, and the supplied files do not fully establish platform coverage, download-service availability, or offline fallback.
The documentation identifies JS reversing, breakpoint debugging, network/WebSocket inspection, and cookie or risk-control replay scenarios, with separate default, isolated, cloak, and external-CDP configurations. Twenty-four tools have clear functional groupings and boundaries; destructive operations use explicit actions or confirmation, strict single-element clicking narrows ambiguity, and 30 offline routing contracts support trigger precision. Environment fit is deducted because, although Node, Chrome, and several MCP clients are covered, the referenced platform-specific Cloak and CDP documents are not included, so full platform and third-party-browser compatibility cannot be confirmed.
The README is well structured and supplies installation paths, client configurations, a tool catalog, workflow examples, configuration guidance, security notes, and troubleshooting. Package, command, and MCP names are consistent. Apache-2.0 metadata matches the complete LICENSE. Deductions apply because limitations are scattered through security and troubleshooting sections rather than comprehensively covering authorization, site-policy, and operational boundaries; version 4.0.1, tag checks, and generated release notes exist, but no standalone changelog is supplied; and maintenance responsibility is only inferable from the author field, issue URL, and release workflow, without a support policy, named team, or response commitment.
Agent-oriented short listings, bounded detail, source context, raw-material file export, and reuse of exported inputs make outputs directly useful in iterative analysis. Combining pages, scripts, breakpoints, network traffic, WebSockets, and state replay in one MCP provides substantial marginal value. Cost-benefit is deducted because the documentation discloses the optional roughly 200 MB download, persistent profiles, and potentially paid live model evaluation, but provides no quantitative resource, performance, success-rate, or comparative-alternative evidence.
Several repository claims are traceable across the README, package configuration, CI, and supplied unit tests, including presubmit gates, dependency auditing, path confinement, failure recovery, and breakpoint restoration. Deductions apply because the core anti-detection behavior, the complete implementation of all 24 tools, routing-evaluation results, and cross-platform claims lack corresponding source or result evidence in the supplied material; corroboration is entirely repository-internal; and promotional capability statements are not consistently separated into tested facts, design intentions, and inference.
- Without --allowedRoots, the agent can read or write host files without directory confinement; enable it for a dedicated working directory.
- The default profile preserves cookies and localStorage across sessions and exposes page content to the MCP client; do not use it with sensitive browser sessions.
- evaluate_script, clicking, navigation, and network interaction may alter page or remote state; use only on authorized targets and add human confirmation for high-impact actions.
- clear_site_data and manual profile deletion irreversibly remove login state; back up first or use --isolated for reproducible experiments.
- CloakBrowser may download roughly 200 MB on first launch; preinstall it and independently verify binary provenance, platform support, and current dependency-audit status.
- Anti-detection use may implicate site terms, access controls, or legal restrictions; the supplied repository material provides no authorization or compliance assurance.
What does this agent do, and when should you use it?
JS Reverse MCP is a JavaScript reverse-engineering MCP server that exposes headed Chrome debugging through tools for pages, scripts, breakpoints, network traffic, WebSockets, and browser state. Its default runtime combines the system Google Chrome, a persistent profile, and Patchright protocol-level stealth; `--isolated` creates a temporary profile, while `--cloak` switches to a custom CloakBrowser build. The server provides 24 tools designed around multi-step agent workflows, including source search and export, call-frame evaluation, stepping, raw request export, and site-state cleanup. Large scripts, network bodies, and binary results can move through local files instead of consuming the entire conversation context. It fits developers conducting interactive browser analysis or reproducing risk-control flows, but adopters must account for browser access, sensitive page exposure, and potentially broad host filesystem permissions.
A typical session starts with new_page, followed by list_scripts, search_in_sources, get_script_source, or save_script_source to locate and persist JavaScript. The client can place breakpoints with set_breakpoint_on_text or break_on_xhr, inspect stacks and scope variables through get_paused_info, evaluate code in the page or a paused call frame with evaluate_script, and continue with step or pause_or_resume. For traffic analysis, list_network_requests lists, inspects, and exports raw headers, bodies, and query data; get_request_initiator returns the JavaScript initiator stack; and get_websocket_messages examines connections and message patterns. clear_site_data removes cookies, origin storage, and sessionStorage for the current site and can optionally clear the global HTTP cache, supporting repeatable cookie and risk-control tests. Additional tools select pages and frames, click a strictly matched visible element, take screenshots, inspect console messages, and exchange analysis material through localFilePath, outputFile, and filePath.
- A security researcher or frontend engineer needs to find an encryption routine inside minified JavaScript and break on matching source text to inspect live arguments.
- A protocol analyst needs to enumerate WebSocket connections, identify recurring message patterns, and retrieve individual message payloads.
- A developer investigating cookie or anti-bot initialization needs to clear site state, reload the page, and export the requests that set cookies or submit sensor data.
- An AI coding-assistant user needs to save a large JavaScript, WASM, or binary network artifact locally and analyze it in stages.
- A researcher working against Cloudflare Turnstile, DataDome, or FingerprintJS protections needs an optional CloakBrowser mode after the default Patchright setup proves insufficient.
- A team using an existing Chrome, AdsPower, or BitBrowser instance needs to attach through a CDP HTTP endpoint that responds to
/json/version.
What are this agent's strengths and limitations?
- Its 24 tools are organized as agent-oriented workflow primitives rather than a direct copy of DevTools menus, with bounded details, compact lists, export paths, and guidance for pending requests.
- Paused execution supports call-frame evaluation, scope inspection, stack analysis, stepping, and returned source context.
- Full scripts, raw network data, and binary results can be exported to disk and consumed again through
evaluate_script(..., localFilePath). - The default headed, persistent Patchright setup is complemented by clean-session
--isolatedand source-patched--cloakmodes. - Traffic tooling covers initiator stacks, XHR/Fetch breakpoints, Set-Cookie recognition, raw header/body export, and WebSocket message analysis.
- Deployment requires Node.js 20.19+ and a browser; the default mode specifically depends on an installed Google Chrome stable release.
- The first CloakBrowser setup downloads roughly 200 MB, and its custom Chromium lacks Google services, the Web Store, and extension sync.
- The MCP client can inspect sensitive page content and modify browser data; without
--allowedRoots, host file access is not directory-restricted. - Initial navigation intentionally avoids enabling the Network and Debugger CDP domains, so complete startup traffic generally requires activating collectors and reloading.
--browserUrlaccepts only a CDP HTTP endpoint that responds to/json/version, not a vendor-specific AdsPower or BitBrowser Local API.
How do you install or deploy this agent?
Install Node.js 20.19 or newer, Google Chrome stable, and an MCP-compatible client. For an on-demand installation, add this server configuration:
{
"mcpServers": {
"js-reverse": {
"command": "npx",
"args": ["js-reverse-mcp"]
}
}
}
For Claude Code, run claude mcp add js-reverse npx js-reverse-mcp. For Codex, run codex mcp add js-reverse -- npx js-reverse-mcp. To build locally, run git clone https://github.com/zhizhuodemao/js-reverse-mcp.git, enter js-reverse-mcp, then run npm install and npm run build; configure the MCP command as node with /your/path/js-reverse-mcp/build/src/index.js as its argument. Before using --cloak, the repository recommends running npx cloakbrowser install to pre-download the roughly 200 MB browser binary. No API credential is documented for normal server operation.
How do you use this agent?
After starting the MCP server, call new_page with the target URL. Because initial navigation deliberately keeps CDP domains quiet, call list_network_requests to activate collectors, run navigate_page(type="reload"), then call list_network_requests again and export important records by reqid with outputFile. For source analysis, use list_scripts, search_in_sources, and set_breakpoint_on_text; after triggering the relevant page action, inspect the pause with get_paused_info, evaluate_script, and step. To replay a cookie or risk-control flow, run clear_site_data(confirm=true), reload, locate the request that sets a cookie or submits sensor data, and export its request body, response headers, or response body. When local-file operations are enabled, pass one or more --allowedRoots values to confine access to dedicated working directories.
How does this agent compare with similar options?
Unlike exposing the Chrome DevTools API to a model unchanged, JS Reverse MCP groups scripts, breakpoints, traffic, WebSockets, state, and local files into primitives for sustained analysis. The default Patchright mode uses the installed Google Chrome and retains access to the Web Store, extensions, and sync; --cloak instead uses a CloakBrowser binary with C++-level fingerprint patches but no Google services or Web Store. The project positions anti-detection as support for the debugging chain, not as a general-purpose crawling framework.
FAQ
Does normal operation require an API key or paid model endpoint?
When should I enable --cloak?
--isolated; use --cloak only when protocol-level stealth remains insufficient for the target site's fingerprint checks.Are login sessions persistent?
--isolated uses a temporary user-data directory that is removed on shutdown, while CloakBrowser has a physically separate persistent profile.How can host filesystem access be constrained?
--allowedRoots directories. The server resolves real paths, rejects symlink escapes, and blocks file:, view-source:file:, and filesystem:file: pages while the restriction is active.Why are requests missing after the first navigation?
list_network_requests to activate collectors and then reload with navigate_page(type="reload") to capture the fuller request sequence.