# JS Reverse MCP (npm · @yuanhuakk/js-reverse-mcp)

MCP server for JavaScript reverse engineering and browser debugging.

- Trust score: 51/100 (low)
- Change this week: +51
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@yuanhuakk/js-reverse-mcp`: 51/100 (this document), [markdown](https://verifymcp.io/servers/yuanhuakk-js-reverse-mcp/yuanhuakk-js-reverse-mcp.md), [page](https://verifymcp.io/servers/yuanhuakk-js-reverse-mcp/yuanhuakk-js-reverse-mcp)

## Channel facts

- Registry: `npm`
- Package: `@yuanhuakk/js-reverse-mcp`
- Version: `2.5.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 200 of 204 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 44 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 43/100
  - AI-judged instruction clarity (poor).
  - Tool/resource definitions use about 7784 tokens (~86/item across 90 items; 90 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 83/100
  - 97% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 55% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add yuanhuakk-js-reverse-mcp -- npx -y @yuanhuakk/js-reverse-mcp
```

### Codex

```bash
codex mcp add yuanhuakk-js-reverse-mcp -- npx -y @yuanhuakk/js-reverse-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "yuanhuakk-js-reverse-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@yuanhuakk/js-reverse-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add yuanhuakk-js-reverse-mcp --command npx --arg -y --arg @yuanhuakk/js-reverse-mcp
```

### Hermes

```yaml
mcp_servers:
  yuanhuakk-js-reverse-mcp:
    command: "npx"
    args: ["-y", "@yuanhuakk/js-reverse-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "yuanhuakk-js-reverse-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@yuanhuakk/js-reverse-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-06 (score 51, +22)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 97
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: poor
- [functional] First check of Tool coverage: 55
- [functional] First check of Schema quality: fail

### 2026-08-02 (score 29, +29)

- [security regression] GHSA-frvp-7c67-39w9 affects this package: medium
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- [functional] Capabilities: Protocol version not yet verified: our sandbox run of this package did not complete, so we never saw its MCP handshake.
- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 0, 0)

- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.

### 2026-07-31 (score 0, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 0, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-29 (score 18, −4)

- [functional regression] Dependency health: partial → unverified

### 2026-07-27 (score 22, +3)

- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.

### 2026-07-26 (score 19)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (90)

### `analyze_target` (~143 tokens)

一键式逆向流程：采集代码、执行安全与加密分析、可选反混淆，并关联 hook 时间线。

Input parameters:

- `autoInjectHooks` (boolean)
- `autoReplayActions` (array)
- `collect` (object)
- `correlationWindowMs` (integer)
- `hookPreset` (string)
- `maxCorrelatedFlows` (integer)
- `maxFingerprints` (integer)
- `runDeobfuscation` (boolean)
- `topN` (integer)
- `url` (string, required)
- `useAI` (boolean)
- `waitAfterHookMs` (integer)

### `analyze_websocket_messages` (~91 tokens)

分析 WebSocket 消息并按模式/指纹对其分组。在直播流场景中理解二进制/protobuf 消息类型时尤为关键。为每种消息类型返回统计信息和样本索引。

Input parameters:

- `direction` (string): Only analyze messages in this direction.
- `wsid` (number, required): The wsid of the WebSocket connection to analyze.

### `auto_patch_env` (~265 tokens)

闭环自动补环境：反复运行 rebuild 包 → 抓取 first divergence → 按补丁注册表自动写回 env.js → 重跑，直到复现成功、跑通无报错，或达到迭代上限（默认 6，符合「超过 6 个补丁未收敛就回浏览器取证」）。仅自动修补注册表内的低风险宿主缺口（window/self/document/navigator/location/history/screen/localStorage/sessionStorage/crypto/atob/btoa/TextEncoder/TextDecoder）；遇到注册表外的错误（fetch/XHR/自定义检测等）会停下并交回人工。需先 export_rebuild_bundle 生成产物包。

Input parameters:

- `entryRelativePath` (string)
- `envRelativePath` (string): 被自动写回补丁的 env 文件，相对 taskDir（默认 env/env.js）。
- `expected` (string): 若设置，stdout 包含该值即判定复现成功并提前停止。
- `maxIterations` (integer): 最多自动补丁轮数（默认 6）。
- `taskDir` (string, required): export_rebuild_bundle 返回的 taskDir。
- `timeout` (integer)

### `break_on_xhr` (~45 tokens)

设置一个断点，当 XHR/Fetch 请求的 URL 包含指定字符串时触发。

Input parameters:

- `url` (string, required): URL pattern to break on (partial match).

### `bypass_anti_debug` (~108 tokens)

消除常见的反调试防护，使调试/观察得以进行：在引擎层面跳过所有 debugger 暂停（破解 `debugger;` 陷阱），并注册一个预加载补丁，在后续页面加载时丢弃仅用于触发 debugger 的定时器循环。传入 off=true 可恢复正常的暂停行为。

Input parameters:

- `off` (boolean): Restore normal debugger pausing instead of bypassing.

### `check_browser_health` (~29 tokens)

在运行逆向工作流之前，检查浏览器连接状态和活动页面就绪情况。

### `check_llm_health` (~37 tokens)

检查 LLM 服务商配置，可选发起一次实时对话探测。

Input parameters:

- `liveCheck` (boolean)

### `click_element` (~23 tokens)

通过选择器点击一个元素。

Input parameters:

- `selector` (string, required)

### `collect_code` (~275 tokens)

从页面采集 JavaScript 代码，支持智能模式（summary/priority/incremental/full）。

Input parameters:

- `enableAdvancedDynamicAnalysis` (boolean): Opt-in advanced dynamic analysis report. Adds broader browser-state, async, worker, wasm, fingerprint and anti-debug sampling plus replay and Node reproduction drafts.
- `enableRuntimeSampler` (boolean): Opt-in runtime sampler. Captures lightweight stack summaries for fetch, XHR, WebSocket, crypto, time, random, btoa and atob before page scripts run.
- `includeDynamic` (boolean)
- `includeExternal` (boolean)
- `includeInline` (boolean)
- `limit` (integer)
- `maxFileSize` (integer)
- `maxSensitiveEvidenceLength` (integer): Maximum plaintext length per target-parameter evidence record (default 2000).
- `maxTotalSize` (integer)
- `pattern` (string)
- `returnMode` (string)
- `smartMode` (string)
- `targetParamSampleWindowMs` (integer): Runtime sampler correlation window for target parameter requests.
- `targetParams` (array): Opt-in target parameter tracing. Matches target names in request query, headers and body, then links them to runtime stacks and replay hints.
- `topN` (integer)
- `url` (string, required)

### `collection_diff` (~44 tokens)

对比前后两次采集到的文件摘要。

Input parameters:

- `current` (array)
- `includeUnchanged` (boolean)
- `previous` (array, required)

### `create_hook` (~85 tokens)

推荐：为 function/fetch/xhr/property/cookie/websocket/eval/timer 创建 hook 脚本。hook 在不暂停页面执行的情况下运行，相比断点是监控与拦截的首选方案。

Input parameters:

- `action` (string)
- `description` (string)
- `params` (object)
- `type` (string, required)

### `crypto_verify` (~187 tokens)

在 Node 中计算标准加密原语（md5/sha*/hmac-*/base64/hex/AES-CBC），并可选地与观测到的值进行比对——用于确认复现的签名或加密方案。

Input parameters:

- `expected` (string): If set, compare the result against this value.
- `input` (string, required): Input data (interpreted using inputEncoding).
- `inputEncoding` (string): How to read input (default: utf8).
- `iv` (string): IV for aes-*-cbc operations.
- `ivEncoding` (string)
- `key` (string): Key for hmac-* / aes-* operations.
- `keyEncoding` (string)
- `op` (string, required): The operation to run.
- `outputEncoding` (string): Output encoding for hash/hmac/encrypt (default: hex).

### `delete_session_state` (~31 tokens)

按 sessionId 删除一个内存中的会话快照。

Input parameters:

- `sessionId` (string, required)

### `deobfuscate_code` (~54 tokens)

AI 辅助的 JavaScript 反混淆。

Input parameters:

- `aggressive` (boolean)
- `code` (string, required)
- `renameVariables` (boolean)
- `useAI` (boolean)

### `detect_crypto` (~39 tokens)

从 JavaScript 源码中检测加密算法与加密库。

Input parameters:

- `code` (string, required)
- `useAI` (boolean)

### `diff_env_requirements` (~54 tokens)

将本地运行时的失败与观察到的浏览器能力进行对比，并给出下一步的环境修补建议。

Input parameters:

- `observedCapabilities` (array)
- `runtimeError` (string, required)

### `dump_session_state` (~56 tokens)

将已保存的会话快照导出为 JSON，可选择写入文件。

Input parameters:

- `encrypt` (boolean)
- `path` (string)
- `pretty` (boolean)
- `sessionId` (string, required)

### `evaluate_on_callframe` (~84 tokens)

在暂停时，于指定调用帧的上下文中执行一段 JavaScript 表达式。可借此查看变量并在暂停的作用域中执行代码。

Input parameters:

- `expression` (string, required): The JavaScript expression to evaluate.
- `frameIndex` (integer): The call frame index to evaluate in (0 = top frame, default: 0).

### `evaluate_script` (~113 tokens)

在当前选中的页面内执行一个 JavaScript 函数。返回结果以 JSON 形式给出，
因此返回值必须可被 JSON 序列化。

Input parameters:

- `function` (string, required): A JavaScript function declaration to be executed by the tool in the currently selected page. Example without arguments: `() => {   return document.title }` or `async () => {   return await fetch("exa…

### `export_rebuild_bundle` (~215 tokens)

根据观察到的逆向证据导出本地 Node 复现产物包。

Input parameters:

- `autoGenerate` (boolean)
- `capture` (object)
- `entryCode` (string)
- `envBaseline` (string): autoGenerate 时的补环境基线：minimal=零依赖手搓壳（默认，适合强指纹检测目标）；jsdom=jsdom DOM 基线 + core-js + 保真覆盖层（适合 DOM 操作密集目标）。
- `envCode` (string)
- `goal` (string, required)
- `maxEvidenceItems` (integer)
- `notes` (array)
- `polyfillsCode` (string)
- `targetActionDescription` (string)
- `targetFunctionNames` (array)
- `targetKeywords` (array)
- `targetUrl` (string, required)
- `targetUrlPatterns` (array)
- `taskId` (string, required)
- `taskSlug` (string, required)

### `export_session_report` (~38 tokens)

将当前逆向会话导出为 JSON 或 Markdown。

Input parameters:

- `format` (string)
- `includeHookData` (boolean)

### `find_clickable_elements` (~32 tokens)

查找可点击的按钮/链接，可选按文本过滤。

Input parameters:

- `filterText` (string)

### `find_in_script` (~149 tokens)

在指定脚本中查找字符串，返回其精确的行/列位置以及周围上下文。非常适合在整段代码挤在一行的压缩文件中设置断点。

Input parameters:

- `caseSensitive` (boolean): Whether the search is case-sensitive (default: true).
- `contextChars` (integer): Number of characters to show before and after the match (default: 100).
- `occurrence` (integer): Which occurrence to find (1 = first, 2 = second, etc.).
- `query` (string, required): The string to find in the script.
- `scriptId` (string, required): The script ID to search in (from list_scripts).

### `get_console_message` (~52 tokens)

按 ID 获取单条控制台消息。可通过调用 list_console_messages 获取全部消息。

Input parameters:

- `msgid` (number, required): The msgid of a console message on the page from the listed console messages

### `get_coverage` (~133 tokens)

收集自 start_coverage 以来累积的 JS 执行覆盖率，报告实际运行过的函数，按脚本分组并按调用次数排序。返回相对上一次 get_coverage 调用的增量。

Input parameters:

- `maxFunctionsPerScript` (integer): Maximum executed functions to list per script (default: 40).
- `maxScripts` (integer): Maximum number of scripts to report (default: 30).
- `stop` (boolean): Stop and disable coverage after collecting (default: false).
- `urlFilter` (string): Only include scripts whose URL contains this substring.

### `get_dom_structure` (~34 tokens)

获取当前页面的 DOM 树结构。

Input parameters:

- `includeText` (boolean)
- `maxDepth` (integer)

### `get_hook_data` (~64 tokens)

获取某个 hook 或全部 hook 捕获的数据。支持原始（raw）视图和用于降噪的摘要（summary）视图。

Input parameters:

- `hookId` (string)
- `maxRecords` (integer)
- `view` (string)

### `get_network_request` (~66 tokens)

按可选的 reqid 获取某个网络请求；省略时返回 DevTools 网络面板中当前选中的请求。

Input parameters:

- `reqid` (number): The reqid of the network request. If omitted returns the currently selected request in the DevTools Network panel.

### `get_paused_info` (~75 tokens)

获取当前暂停状态的信息，包括调用栈、当前位置和作用域变量。命中断点后用它来了解执行上下文。

Input parameters:

- `includeScopes` (boolean): Whether to include scope variables (default: true).
- `maxScopeDepth` (integer): Maximum scope depth to traverse (default: 2).

### `get_performance_metrics` (~19 tokens)

通过 Performance API 获取页面性能指标。

### `get_request_initiator` (~132 tokens)

获取发起某个网络请求的 JavaScript 调用栈，便于追踪是哪段代码触发了 API 调用。

Input parameters:

- `goal` (string): Optional reverse-engineering goal for the task artifact.
- `requestId` (integer, required): The request ID (from list_network_requests) to get the initiator for.
- `targetUrl` (string): Optional target page URL associated with the reverse task.
- `taskId` (string): Optional reverse task ID for writing durable evidence artifacts.
- `taskSlug` (string): Optional reverse task slug used when opening the task artifact directory.

### `get_script_source` (~166 tokens)

通过 scriptId 获取 JavaScript 脚本的源代码。支持按行号范围（普通文件）或字符偏移（压缩成单行的文件）读取。请先用 `list_scripts` 查找 scriptId。

Input parameters:

- `endLine` (integer): End line number (1-based). Use for multi-line files.
- `length` (integer): Number of characters to return when using offset (default: 1000).
- `offset` (integer): Character offset to start from (0-based). Use for minified single-line files.
- `scriptId` (string, required): The script ID (from list_scripts) to get the source code for.
- `startLine` (integer): Start line number (1-based). Use for multi-line files.

### `get_storage` (~54 tokens)

获取浏览器存储数据，包括 cookies、localStorage 和 sessionStorage。

Input parameters:

- `filter` (string): Optional filter string to match against keys/names.
- `type` (string): Which storage to retrieve (default: all).

### `get_websocket_message` (~76 tokens)

通过 frame 索引获取单条 WebSocket 消息。请先使用 get_websocket_messages 或 analyze_websocket_messages 找到 frame 索引。

Input parameters:

- `frameIndex` (integer, required): The frame index (0-based) to retrieve.
- `wsid` (number, required): The wsid of the WebSocket connection.

### `get_websocket_messages` (~183 tokens)

获取某个 WebSocket 连接的消息。重要：对于二进制/protobuf 消息（如直播流），请先使用 analyze_websocket_messages 了解消息类型，再通过 groupId 参数筛选特定类型。默认模式仅显示摘要。

Input parameters:

- `direction` (string): Filter by direction: "sent" or "received".
- `groupId` (string): Filter by group ID (A, B, C, ...). Get group IDs from analyze_websocket_messages first.
- `pageIdx` (integer): Page number (0-based).
- `pageSize` (integer): Messages per page. Defaults to 10.
- `show_content` (boolean): Set to true to show full message payload. Default false (summary only) to avoid large binary output.
- `wsid` (number, required): The wsid of the WebSocket connection.

### `hook_function` (~170 tokens)

逆向推荐方式：hook 一个 JavaScript 函数，在不暂停执行的情况下记录它的调用、参数和返回值。在自动化流程中比断点更可靠。监控函数时请将其作为默认方式。

Input parameters:

- `hookId` (string): Custom identifier for this hook. Used to unhook later. Defaults to target name.
- `logArgs` (boolean): Whether to log function arguments (default: true).
- `logResult` (boolean): Whether to log return value (default: true).
- `logStack` (boolean): Whether to log call stack (default: false).
- `target` (string, required): The function to hook. Can be: global function name ("fetch"), object method ("XMLHttpRequest.prototype.open"), or path ("window.app.api.request").

### `inject_hook` (~26 tokens)

将已有的 hook 注入到当前页面。

Input parameters:

- `hookId` (string, required)

### `inject_preload_script` (~71 tokens)

注册一段 JavaScript 代码，使其在后续文档加载时、页面脚本执行之前运行。可用于预加载脚本的钩子、环境修补以及早期插桩。

Input parameters:

- `script` (string, required): JavaScript source to register for future document loads.

### `inject_stealth` (~31 tokens)

向当前页面注入反检测 stealth 脚本。

Input parameters:

- `preset` (string)

### `inspect_object` (~114 tokens)

深度检查一个 JavaScript 对象，展示它的属性、原型链和方法。便于理解对象结构。

Input parameters:

- `depth` (integer): How deep to inspect nested objects (default: 2).
- `expression` (string, required): JavaScript expression to evaluate and inspect (e.g., "window.app", "document.body", "myObject").
- `showMethods` (boolean): Whether to show methods (default: true).
- `showPrototype` (boolean): Whether to show prototype chain (default: true).

### `inspect_wasm` (~115 tokens)

检查页面实例化的 WebAssembly 模块。action="install" 会 hook WebAssembly.instantiate 以记录导出/导入（请在 WASM 运行之前调用——如果它在加载时实例化则需重新加载）；action="report" 列出捕获的模块及其导出和导入的名称/类型。

Input parameters:

- `action` (string): "install" the capture hook, or "report" captured modules.
- `max` (integer): Max modules to list.

### `list_breakpoints` (~25 tokens)

列出当前调试会话中所有生效的断点。

### `list_console_messages` (~123 tokens)

列出当前选中页面自上次导航以来的所有控制台消息。

Input parameters:

- `includePreservedMessages` (boolean): Set to true to return the preserved messages over the last 3 navigations.
- `pageIdx` (integer): Page number to return (0-based). When omitted, returns the first page.
- `pageSize` (integer): Maximum number of messages to return. When omitted, returns all requests.
- `types` (array): Filter messages to only return messages of the specified resource types. When omitted or empty, returns all messages.

### `list_frames` (~48 tokens)

以树状结构列出当前页面中的所有 frame（包括 iframe），显示 frame 索引、名称和 URL。使用 select_frame 可将执行上下文切换到指定 frame。

### `list_hooks` (~18 tokens)

列出所有生效的函数 hook。

### `list_network_requests` (~123 tokens)

列出当前选中页面自上次导航以来的所有网络请求。

Input parameters:

- `includePreservedRequests` (boolean): Set to true to return the preserved requests over the last 3 navigations.
- `pageIdx` (integer): Page number to return (0-based). When omitted, returns the first page.
- `pageSize` (integer): Maximum number of requests to return. When omitted, returns all requests.
- `resourceTypes` (array): Filter requests to only return requests of the specified resource types. When omitted or empty, returns all requests.

### `list_pages` (~18 tokens)

获取浏览器中已打开的页面列表。

### `list_scripts` (~69 tokens)

列出当前页面已加载的所有 JavaScript 脚本，返回 scriptId、URL 和 source map 信息。在设置断点或搜索之前用它来查找脚本。

Input parameters:

- `filter` (string): Optional filter string to match against script URLs (case-insensitive partial match).

### `list_session_states` (~24 tokens)

列出内存中所有已保存的会话快照。

### `list_stealth_features` (~23 tokens)

列出可用的 stealth 功能开关。

### `list_stealth_presets` (~23 tokens)

列出可用的 stealth 预设。

### `list_websocket_connections` (~134 tokens)

列出所有 WebSocket 连接。获取到 wsid 后，请先使用 analyze_websocket_messages(wsid) 了解消息模式，再查看单条消息。

Input parameters:

- `includePreservedConnections` (boolean): Set to true to return the preserved connections over the last 3 navigations.
- `pageIdx` (integer): Page number to return (0-based). When omitted, returns the first page.
- `pageSize` (integer): Maximum number of connections to return. When omitted, returns all connections.
- `urlFilter` (string): Filter connections by URL. Only connections containing this substring will be returned.

### `load_session_state` (~55 tokens)

从 JSON 字符串或文件加载会话快照到内存。

Input parameters:

- `overwrite` (boolean)
- `path` (string)
- `sessionId` (string)
- `snapshotJson` (string)

### `monitor_events` (~169 tokens)

监控指定元素或 window 上的 DOM 事件，事件将记录到控制台。

Input parameters:

- `events` (array): Specific events to monitor (e.g., ["click", "keydown"]). If not specified, monitors common events.
- `goal` (string): Optional reverse-engineering goal for the task artifact.
- `monitorId` (string): Custom ID for this monitor. Used to stop monitoring later.
- `selector` (string): CSS selector for element to monitor, or "window"/"document" (default: window).
- `targetUrl` (string): Optional target page URL associated with the reverse task.
- `taskId` (string): Optional reverse task ID for writing durable evidence artifacts.
- `taskSlug` (string): Optional reverse task slug used when opening the task artifact directory.

### `navigate_page` (~126 tokens)

将当前选中的页面导航到某个 URL，或执行后退/前进/重新加载操作。等待 DOMContentLoaded 事件（而非整页加载完成）。默认超时为 10 秒。

Input parameters:

- `ignoreCache` (boolean): Whether to ignore cache on reload.
- `timeout` (integer): Maximum wait time in milliseconds. If set to 0, the default timeout will be used.
- `type` (string): Navigate the page by URL, back or forward in history, or reload.
- `url` (string): Target URL (only type=url)

### `new_page` (~79 tokens)

创建一个新页面并导航到指定 URL。等待 DOMContentLoaded 事件（而非整页加载完成）。默认超时为 10 秒。

Input parameters:

- `timeout` (integer): Maximum wait time in milliseconds. If set to 0, the default timeout will be used.
- `url` (string, required): URL to load in a new page.

### `pause` (~24 tokens)

在当前位置暂停 JavaScript 执行，用于中断正在运行的代码。

### `query_ast` (~196 tokens)

对脚本（通过 scriptId 或原始代码）执行结构化 AST 查询。kind 取值："calls"（对某个被调用者的调用表达式）、"members"（成员访问，如 localStorage.getItem）、"functions"（函数声明/表达式）、"strings"（匹配某个正则的字符串字面量）。在定位签名/加密逻辑时比文本搜索更精确。

Input parameters:

- `code` (string): Raw JS source to analyse instead of a scriptId.
- `kind` (string, required): What to search for.
- `max` (integer): Max matches (default: 100).
- `name` (string): Name to match for calls/members/functions (substring of the path/name).
- `pattern` (string): Regex to match string literal values (for kind="strings").
- `scriptId` (string): Script to analyse (from list_scripts).

### `query_dom` (~41 tokens)

通过 CSS 选择器查询一个或多个元素。

Input parameters:

- `all` (boolean)
- `limit` (integer)
- `selector` (string, required)

### `record_reverse_evidence` (~106 tokens)

将结构化的逆向证据追加写入任务产物日志。

Input parameters:

- `channel` (string)
- `entry` (object, required)
- `goal` (string, required)
- `targetActionDescription` (string)
- `targetFunctionNames` (array)
- `targetKeywords` (array)
- `targetUrl` (string, required)
- `targetUrlPatterns` (array)
- `taskId` (string, required)
- `taskSlug` (string, required)

### `remove_breakpoint` (~54 tokens)

根据 ID 移除断点。可用 `list_breakpoints` 查看当前生效的断点。

Input parameters:

- `breakpointId` (string, required): The breakpoint ID to remove (from list_breakpoints or set_breakpoint).

### `remove_hook` (~25 tokens)

按 id 移除一个 hook。

Input parameters:

- `hookId` (string, required)

### `remove_xhr_breakpoint` (~37 tokens)

移除一个 XHR/Fetch 断点。

Input parameters:

- `url` (string, required): The URL pattern to remove breakpoint for.

### `replay_request` (~204 tokens)

在页面上下文中（携带真实 cookie/origin）重新发送一个 HTTP 请求，可选改写 url/method/headers/body，并返回响应。用于端到端验证已复现的签名或参数：以通过 reqid 捕获的请求（来自 list_network_requests）为基础，覆盖其中的签名字段。

Input parameters:

- `body` (string): Request body override (ignored for GET/HEAD).
- `credentials` (string): Fetch credentials mode (default: include — sends the page cookies).
- `headers` (object): Header overrides merged over the captured headers.
- `maxBodyChars` (integer): Max response body characters to return (default: 4000).
- `method` (string): HTTP method override (default: original or GET).
- `reqid` (integer): Base the replay on this captured request (from list_network_requests).
- `url` (string): Request URL. Required without reqid; overrides the captured URL otherwise.

### `restore_session_state` (~51 tokens)

将先前保存的会话快照恢复到当前页面。

Input parameters:

- `clearStorageBeforeRestore` (boolean)
- `navigateToSavedUrl` (boolean)
- `sessionId` (string, required)

### `resume` (~28 tokens)

在断点暂停后继续执行 JavaScript，一直运行到下一个断点或执行结束。

### `risk_panel` (~67 tokens)

综合分析器、加密检测器与 hook 信号构建统一的风险评分。

Input parameters:

- `code` (string)
- `hookId` (string)
- `includeHookSignals` (boolean)
- `topN` (integer)
- `useAI` (boolean)

### `run_rebuild` (~177 tokens)

在 Node 中运行已导出的复现产物包，报告产出的值以及首个分歧点。在 export_rebuild_bundle 之后使用：它会执行 <taskDir>/env/entry.js，捕获 stdout（结果）和首个运行时错误（stderr）。ReferenceError/TypeError 正是下一个需要修补的环境缺口。可选地将输出与期望值进行比对。

Input parameters:

- `entryRelativePath` (string): Entry script path relative to taskDir (default: env/entry.js).
- `expected` (string): If set, checks whether stdout contains this value (confirms reproduction).
- `taskDir` (string, required): The taskDir returned by export_rebuild_bundle.
- `timeout` (integer): Maximum run time in milliseconds (default: 15000).

### `save_session_state` (~64 tokens)

将当前页面的会话状态（cookies/localStorage/sessionStorage）保存为内存快照。

Input parameters:

- `includeCookies` (boolean)
- `includeLocalStorage` (boolean)
- `includeSessionStorage` (boolean)
- `sessionId` (string)

### `search_in_scripts` (~47 tokens)

使用正则模式在已采集的脚本缓存中搜索。

Input parameters:

- `limit` (integer)
- `maxTotalSize` (integer)
- `pattern` (string, required)

### `search_in_sources` (~200 tokens)

在所有已加载的 JavaScript 源码中搜索字符串或正则表达式，返回匹配行及其 scriptId、URL 和行号。可用 `get_script_source` 配合 startLine/endLine 查看匹配处的完整上下文。

Input parameters:

- `caseSensitive` (boolean): Whether the search should be case-sensitive.
- `excludeMinified` (boolean): Skip minified files (files with very long lines). Default: true.
- `isRegex` (boolean): Whether to treat the query as a regular expression.
- `maxLineLength` (integer): Maximum characters per line preview (default: 150). Set to 0 for full lines.
- `maxResults` (integer): Maximum number of results to return (default: 30).
- `query` (string, required): The search query (string or regex pattern).
- `urlFilter` (string): Only search scripts whose URL contains this string (case-insensitive).

### `select_frame` (~64 tokens)

选择一个 frame（通过 list_frames 中的索引）作为 evaluate_script、hook_function、inspect_object 等在页面中运行 JavaScript 的工具的执行上下文。

Input parameters:

- `frameIdx` (integer, required): The frame index from list_frames. 0 = main frame.

### `select_page` (~43 tokens)

选择一个页面作为后续工具调用的上下文。

Input parameters:

- `pageIdx` (number, required): The index of the page to select. Call list_pages to list pages.

### `set_breakpoint` (~175 tokens)

在 JavaScript 文件的指定行设置断点，代码执行到该处时会触发。注意：监控函数调用时优先使用 `hook_function` 或 `create_hook`——断点需要配合暂停/继续执行，在自动化流程中容易出错。仅在需要查看函数内部局部变量时才使用断点。

Input parameters:

- `columnNumber` (integer): Optional column number (0-based).
- `condition` (string): Optional condition expression. The breakpoint only triggers when this evaluates to true.
- `isRegex` (boolean): Whether to treat the URL as a regex pattern.
- `lineNumber` (integer, required): The line number to set the breakpoint (1-based).
- `url` (string, required): The URL of the JavaScript file (can be a partial match or regex pattern).

### `set_breakpoint_on_text` (~191 tokens)

通过搜索指定代码（函数名、语句等）并自动定位其精确位置来设置断点，普通文件和压缩文件都适用。注意：监控函数调用时优先使用 `hook_function`——它能在不暂停执行的情况下捕获参数/返回值。仅在需要查看某个具体代码位置的局部变量时才使用本工具。

Input parameters:

- `condition` (string): Optional condition expression. Breakpoint only triggers when this evaluates to true.
- `occurrence` (integer): Which occurrence to break on (1 = first, 2 = second, etc.).
- `text` (string, required): The code text to find and set breakpoint on (e.g., "function myFunc", "fetchData(", "apiCall").
- `urlFilter` (string): Only search in scripts whose URL contains this string (case-insensitive).

### `set_user_agent` (~27 tokens)

为当前活动页面设置自定义 user-agent。

Input parameters:

- `userAgent` (string, required)

### `snapshot_scope` (~170 tokens)

在 JavaScript 执行暂停时，捕获一份有数量限制且已脱敏的作用域快照。命中断点后用它记录 local/closure/this/global 变量的名称、类型和安全预览值，用于动态数据流分析。

Input parameters:

- `goal` (string): Optional reverse-engineering goal for the task artifact.
- `includeGlobal` (boolean)
- `maxFrames` (integer)
- `maxStringLength` (integer)
- `maxVariablesPerScope` (integer)
- `targetUrl` (string): Optional target page URL associated with the reverse task.
- `taskId` (string): Optional reverse task ID for writing durable evidence artifacts.
- `taskSlug` (string): Optional reverse task slug used when opening the task artifact directory.

### `start_coverage` (~93 tokens)

启动精确的 JS 执行覆盖率，用于定位签名/加密代码。重要：只有在本次调用之后编译的脚本才会被插桩——请在目标页面加载之前调用 start_coverage（随后再 navigate_page），或者之后重新加载已打开的页面。然后触发相应行为，再调用 get_coverage 查看哪些函数被执行。

### `step_into` (~24 tokens)

步入下一个函数调用，用于进入并调试函数体。

### `step_out` (~28 tokens)

步出当前函数，一直执行到该函数返回。用它快速退出一个函数。

### `step_over` (~39 tokens)

单步跳过到下一条语句，把函数调用当作一步执行。用它在不进入函数体的情况下逐行执行代码。

### `stop_monitor` (~29 tokens)

停止一个事件监控。

Input parameters:

- `monitorId` (string, required): The monitor ID to stop.

### `summarize_code` (~52 tokens)

对单个代码文件、多个文件或项目级上下文进行摘要。

Input parameters:

- `code` (string)
- `files` (array)
- `mode` (string)
- `url` (string)

### `take_screenshot` (~135 tokens)

对页面或元素进行截图。

Input parameters:

- `filePath` (string): The absolute path, or a path relative to the current working directory, to save the screenshot to instead of attaching it to the response.
- `format` (string): Type of format to save the screenshot as. Default is "png"
- `fullPage` (boolean): If set to true takes a screenshot of the full page instead of the currently visible viewport. Incompatible with uid.
- `quality` (number): Compression quality for JPEG and WebP formats (0-100). Higher values mean better quality but larger file sizes. Ignored for PNG format.

### `trace_function` (~250 tokens)

根据源代码中的函数名追踪对该函数的调用。适用于任意函数，包括模块内部函数（webpack/rollup 打包的）。使用"日志点"（条件断点）在不暂停执行的情况下记录参数。

Input parameters:

- `functionName` (string, required): The function name to trace. Will search for "function NAME" or "NAME = function" or "NAME(" patterns.
- `goal` (string): Optional reverse-engineering goal for the task artifact.
- `logArgs` (boolean): Whether to log function arguments (default: true).
- `logThis` (boolean): Whether to log "this" context (default: false).
- `pause` (boolean): Whether to actually pause execution (default: false, just logs).
- `targetUrl` (string): Optional target page URL associated with the reverse task.
- `taskId` (string): Optional reverse task ID for writing durable evidence artifacts.
- `taskSlug` (string): Optional reverse task slug used when opening the task artifact directory.
- `traceId` (string): Custom ID for this trace. Used to identify in logs.
- `urlFilter` (string): Only search in scripts matching this URL pattern.

### `type_text` (~37 tokens)

向输入元素中输入文本。

Input parameters:

- `delay` (integer)
- `selector` (string, required)
- `text` (string, required)

### `understand_code` (~49 tokens)

结合 AI 与静态分析解析代码的结构、业务逻辑与安全性。

Input parameters:

- `code` (string, required)
- `focus` (string)
- `useAI` (boolean)

### `unhook_function` (~36 tokens)

移除先前安装的函数 hook。

Input parameters:

- `hookId` (string, required): The hook ID to remove (from hook_function).

### `wait_for_element` (~32 tokens)

等待选择器对应的元素出现。

Input parameters:

- `selector` (string, required)
- `timeout` (integer)

### `watch_property` (~154 tokens)

通过点分路径监视对象属性（如 window.config.token、navigator.userAgent）。action="install" 会用 getter/setter 包装该属性，记录每次读/写及其调用栈（设置 pause=true 可在访问时进入 debugger 暂停）；action="report" 列出捕获到的访问。请在该属性被访问之前安装——如果它在加载时被读取则需重新加载。

Input parameters:

- `action` (string)
- `max` (integer): Max records to report.
- `path` (string, required): Dotted property path, e.g. "window.foo.bar".
- `pause` (boolean): Break in the debugger on each access (install only).

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/yuanhuakk-js-reverse-mcp/yuanhuakk-js-reverse-mcp#diagnostics

## Score history

- 2026-08-07: 51
- 2026-08-06: 51
- 2026-08-05: 29
- 2026-08-04: 29
- 2026-08-03: 29
- 2026-08-02: 29
- 2026-08-01: 0
- 2026-07-31: 0
- 2026-07-30: 0
- 2026-07-29: 18
- 2026-07-27: 22
- 2026-07-26: 19

## Links

- npm package: https://www.npmjs.com/package/@yuanhuakk/js-reverse-mcp
- Socket report: https://socket.dev/npm/package/@yuanhuakk/js-reverse-mcp
- Changelog RSS feed: https://verifymcp.io/servers/yuanhuakk-js-reverse-mcp/yuanhuakk-js-reverse-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/yuanhuakk-js-reverse-mcp/yuanhuakk-js-reverse-mcp.json
- HTML version of this page: https://verifymcp.io/servers/yuanhuakk-js-reverse-mcp/yuanhuakk-js-reverse-mcp