JS Reverse MCP

JS Reverse MCP is an open-source MCP server, published by GitHub user zhizhuodemao, that lets AI coding assistants such as Claude, Cursor, and Copilot work through JavaScript reverse-engineering tasks in a real browser. It exposes 24 tools covering pages, scripts, breakpoints, network and WebSocket traffic, browser state, and script evaluation. The latest listed release is v4.0.5.

What It Is

The project is an MCP server for JavaScript analysis in web pages. Rather than mirroring Chrome DevTools menus, it reorganizes scripts, breakpoints, network requests, WebSocket messages, browser state, and local file I/O into tools designed for an agent to reason across several steps. It runs a headed Chrome browser with a persistent login profile by default.

Debugging and Analysis Workflow

An agent can open a page, list loaded scripts, search all sources for strings or regexes, and fetch or save full script source to local files, including large, minified, or WASM files. It can set breakpoints by searching code text (useful for minified code) or by XHR/Fetch URL pattern, then inspect the call stack and scope variables, step through code, and evaluate expressions in the paused call frame.

On the network side, it lists requests, shows initiators' JavaScript call stacks, identifies Set-Cookie headers, and exports raw headers, bodies, and query data to files. It also groups WebSocket messages for protocol analysis. A clear-site-data tool resets cookies and storage so cookie generation and risk-control initialization can be replayed after a reload.

Anti-Detection Options

By default it uses a dedicated Patchright fork maintained for this MCP, which applies protocol-level stealth without injecting JavaScript from the wrapper. For sites with strong fingerprinting, a --cloak flag switches to the CloakBrowser binary, which applies source-level fingerprint patches. The README notes the goal is to reduce known shared implementation traits, not to promise undetectability.

Setup and Safety

It requires Node.js v20.19 or newer and stable Chrome, and runs via npx from an MCP client configuration. Setup commands are documented for Claude Code, Codex, Cursor, and VS Code Copilot. Options include --isolated for a temporary profile, --browserUrl to attach to an existing Chrome, and --allowedRoots to restrict local file access. The README warns that the tool exposes browser content to the MCP client and should not be used on pages with sensitive information.