# JS Reverse MCP

> An MCP server that lets AI coding assistants debug, trace, and save JavaScript behavior in web pages through headed Chrome with breakpoints and network analysis.

JS Reverse MCP is an open-source MCP server, published by GitHub user zhizhuodemao, that lets AI coding assistants such as Claude, Cursor, and Copilot work through JavaScript reverse-engineering tasks in a real browser. It exposes 24 tools covering pages, scripts, breakpoints, network and WebSocket traffic, browser state, and script evaluation. The latest listed release is v4.0.5.

## What It Is

The project is an MCP server for JavaScript analysis in web pages. Rather than mirroring Chrome DevTools menus, it reorganizes scripts, breakpoints, network requests, WebSocket messages, browser state, and local file I/O into tools designed for an agent to reason across several steps. It runs a headed Chrome browser with a persistent login profile by default.

## Debugging and Analysis Workflow

An agent can open a page, list loaded scripts, search all sources for strings or regexes, and fetch or save full script source to local files, including large, minified, or WASM files. It can set breakpoints by searching code text (useful for minified code) or by XHR/Fetch URL pattern, then inspect the call stack and scope variables, step through code, and evaluate expressions in the paused call frame.

On the network side, it lists requests, shows initiators' JavaScript call stacks, identifies Set-Cookie headers, and exports raw headers, bodies, and query data to files. It also groups WebSocket messages for protocol analysis. A clear-site-data tool resets cookies and storage so cookie generation and risk-control initialization can be replayed after a reload.

## Anti-Detection Options

By default it uses a dedicated Patchright fork maintained for this MCP, which applies protocol-level stealth without injecting JavaScript from the wrapper. For sites with strong fingerprinting, a `--cloak` flag switches to the CloakBrowser binary, which applies source-level fingerprint patches. The README notes the goal is to reduce known shared implementation traits, not to promise undetectability.

## Setup and Safety

It requires Node.js v20.19 or newer and stable Chrome, and runs via npx from an MCP client configuration. Setup commands are documented for Claude Code, Codex, Cursor, and VS Code Copilot. Options include `--isolated` for a temporary profile, `--browserUrl` to attach to an existing Chrome, and `--allowedRoots` to restrict local file access. The README warns that the tool exposes browser content to the MCP client and should not be used on pages with sensitive information.

## Features
- 24 MCP tools designed for AI agent workflows
- Script listing, search, and source saving
- Breakpoints by code text or XHR/Fetch URL
- Paused call frame evaluation and stepping
- Network request inspection and raw export
- Request initiator call stacks
- WebSocket message analysis
- Clear site data for cookie and risk-control replay
- Headed Chrome with persistent login profile
- Dedicated Patchright fork for protocol-level stealth
- Optional CloakBrowser mode via --cloak
- Isolated profile mode and attach to existing Chrome via CDP
- Allowed roots restriction for local file access

## Integrations
Claude Code, Codex, Cursor, VS Code Copilot, Chrome, Patchright, CloakBrowser, AdsPower, BitBrowser

## Platforms
WINDOWS, MACOS, LINUX, API, VSC_EXTENSION, CLI

## Pricing
Open Source

## Version
v4.0.5

## Links
- Website: https://github.com/zhizhuodemao/js-reverse-mcp
- Documentation: https://github.com/zhizhuodemao/js-reverse-mcp
- Repository: https://github.com/zhizhuodemao/js-reverse-mcp
- EveryDev.ai: https://www.everydev.ai/tools/js-reverse-mcp