JSHookMCP

JSHookMCP (published as @jshookmcp/jshook) is an open-source MCP server by vmoranv that gives AI agents a reverse-engineering workspace for JavaScript, browsers, network traffic, WASM, and native processes. The README describes 735 built-in tools across 36 domains, released under AGPL-3.0, with the latest release listed as v0.4.2.

What It Is

JSHookMCP is a TypeScript Model Context Protocol server that runs through a single npx command in MCP clients such as Claude Desktop or Cursor. It covers browser automation (Chromium and Camoufox via CDP), network capture and protocol analysis, JavaScript hooking and deobfuscation, debugging, WASM disassembly, Frida/Ghidra/IDA bridges, Android APK analysis, and declarative workflows.

Profile-aware tool loading

To avoid loading every tool schema into the model context, tools load in tiers selected by the MCP_TOOL_PROFILE environment variable: search, workflow, and full. The README states the search profile uses about 3K tokens of metadata, while the full profile exposes all tools at roughly 109K tokens. Meta tools such as search_tools, describe_tool, call_tool, and coverage_report help agents discover and validate tools.

Transport and extensibility

The server supports stdio and Streamable HTTP transports. A shared local HTTP daemon can serve multiple agents, with per-client session isolation and restoration of activated domains and browser state after reconnects. Hot-reload plugins and declarative workflows (parallel, branch, retry, fallback) extend the tool surface.

Typical workflows

Documented scenarios include deobfuscating a minified bundle, capturing and replaying OAuth flows through a MITM proxy, reversing WASM crypto routines, triaging APKs, and hooking functions in live processes with Frida. The cross-platform native FFI layer supports Windows, macOS, and Linux.