JS Reverse MCP
NPM · @YUANHUAKK/JS-REVERSE-MCP · SCANNED SEP 20
MCP server for JavaScript reverse engineering and browser debugging.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 48 of 190 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 87 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability76
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 8848 tokens (~92/item across 96 items; 96 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage84
- 97% of tools have a non-trivial description (not blank, and not just the tool's name).Partial
- 58% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_session_state" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 96 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the JS Reverse MCP server?
JS Reverse MCP runs locally as an npm package, launched with npx -y @yuanhuakk/js-reverse-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @yuanhuakk/js-reverse-mcp
claude mcp add yuanhuakk-jsreverser-mcp -- npx -y @yuanhuakk/js-reverse-mcp
{
"mcpServers": {
"yuanhuakk-jsreverser-mcp": {
"command": "npx",
"args": [
"-y",
"@yuanhuakk/js-reverse-mcp"
]
}
}
} {
"servers": {
"yuanhuakk-jsreverser-mcp": {
"command": "npx",
"args": [
"-y",
"@yuanhuakk/js-reverse-mcp"
]
}
}
} codex mcp add yuanhuakk-jsreverser-mcp -- npx -y @yuanhuakk/js-reverse-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"yuanhuakk-jsreverser-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@yuanhuakk/js-reverse-mcp"
],
"enabled": true
}
}
} openclaw mcp add yuanhuakk-jsreverser-mcp --command npx --arg -y --arg @yuanhuakk/js-reverse-mcp
mcp_servers:
yuanhuakk-jsreverser-mcp:
command: "npx"
args: ["-y", "@yuanhuakk/js-reverse-mcp"] {
"McpServers": {
"yuanhuakk-jsreverser-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@yuanhuakk/js-reverse-mcp"
]
}
}
} assistant mcp add yuanhuakk-jsreverser-mcp -t stdio -c npx -a -y @yuanhuakk/js-reverse-mcp
{
"mcpServers": {
"yuanhuakk-jsreverser-mcp": {
"command": "npx",
"args": [
"-y",
"@yuanhuakk/js-reverse-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 −2
- Stability: pass → 0.83 functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 −3
- Stability: pass → 0.77 functional
- 10 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@yuanhuakk/js-reverse-mcp@3.0.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 190 packages
| Packages resolved | 190 |
|---|---|
| Stale | 48 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
list_pages ~18
获取浏览器中已打开的页面列表。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_scripts ~69
列出当前页面已加载的所有 JavaScript 脚本，返回 scriptId、URL 和 source map 信息。在设置断点或搜索之前用它来查找脚本。
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Optional filter string to match against script URLs (case-insensitive partial match). |
No output schema declared.
No examples provided.
list_session_states ~24
列出内存中所有已保存的会话快照。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_stealth_features ~23
列出可用的 stealth 功能开关。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_stealth_presets ~23
列出可用的 stealth 预设。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_websocket_connections ~134
列出所有 WebSocket 连接。获取到 wsid 后，请先使用 analyze_websocket_messages(wsid) 了解消息模式，再查看单条消息。
| Name | Type | Req | Description |
|---|---|---|---|
| includePreservedConnections | boolean | – | Set to true to return the preserved connections over the last 3 navigations. |
| pageIdx | integer | – | Page number to return (0-based). When omitted, returns the first page. |
| pageSize | integer | – | Maximum number of connections to return. When omitted, returns all connections. |
| urlFilter | string | – | Filter connections by URL. Only connections containing this substring will be returned. |
No output schema declared.
No examples provided.
load_session_state ~55
从 JSON 字符串或文件加载会话快照到内存。
| Name | Type | Req | Description |
|---|---|---|---|
| overwrite | boolean | – | – |
| path | string | – | – |
| sessionId | string | – | – |
| snapshotJson | string | – | – |
No output schema declared.
No examples provided.
monitor_events ~169
监控指定元素或 window 上的 DOM 事件，事件将记录到控制台。
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | – | Specific events to monitor (e.g., ["click", "keydown"]). If not specified, monitors common events. |
| goal | string | – | Optional reverse-engineering goal for the task artifact. |
| monitorId | string | – | Custom ID for this monitor. Used to stop monitoring later. |
| selector | string | – | CSS selector for element to monitor, or "window"/"document" (default: window). |
| targetUrl | string | – | Optional target page URL associated with the reverse task. |
| taskId | string | – | Optional reverse task ID for writing durable evidence artifacts. |
| taskSlug | string | – | Optional reverse task slug used when opening the task artifact directory. |
No output schema declared.
No examples provided.
navigate_page ~126
将当前选中的页面导航到某个 URL，或执行后退/前进/重新加载操作。等待 DOMContentLoaded 事件（而非整页加载完成）。默认超时为 10 秒。
| Name | Type | Req | Description |
|---|---|---|---|
| ignoreCache | boolean | – | Whether to ignore cache on reload. |
| timeout | integer | – | Maximum wait time in milliseconds. If set to 0, the default timeout will be used. |
| type | string | – | Navigate the page by URL, back or forward in history, or reload. |
| url | string | – | Target URL (only type=url) |
No output schema declared.
No examples provided.
neutralize_debugger ~167
外科手术式绕过 `debugger` 陷阱：对每个 `debugger` 语句位置下 condition=false 断点（等价 DevTools「Never pause here」），V8 静默跳过目标的 debugger。与 `bypass_anti_debug` 的 setSkipAllPauses 全跳过不同——本工具只中和 debugger，**保留你自己设的断点可用**，适合一边绕反调试一边下断点观察。已加载脚本立即处理，未来脚本自动处理。传 off=true 移除全部中和断点并恢复。
| Name | Type | Req | Description |
|---|---|---|---|
| off | boolean | – | 移除所有 debugger 中和断点，恢复正常暂停行为。 |
No output schema declared.
No examples provided.
new_page ~79
创建一个新页面并导航到指定 URL。等待 DOMContentLoaded 事件（而非整页加载完成）。默认超时为 10 秒。
| Name | Type | Req | Description |
|---|---|---|---|
| timeout | integer | – | Maximum wait time in milliseconds. If set to 0, the default timeout will be used. |
| url | string | yes | URL to load in a new page. |
No output schema declared.
No examples provided.
pause ~24
在当前位置暂停 JavaScript 执行，用于中断正在运行的代码。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
query_ast ~196
对脚本（通过 scriptId 或原始代码）执行结构化 AST 查询。kind 取值："calls"（对某个被调用者的调用表达式）、"members"（成员访问，如 localStorage.getItem）、"functions"（函数声明/表达式）、"strings"（匹配某个正则的字符串字面量）。在定位签名/加密逻辑时比文本搜索更精确。
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | Raw JS source to analyse instead of a scriptId. |
| kind | string | yes | What to search for. |
| max | integer | – | Max matches (default: 100). |
| name | string | – | Name to match for calls/members/functions (substring of the path/name). |
| pattern | string | – | Regex to match string literal values (for kind="strings"). |
| scriptId | string | – | Script to analyse (from list_scripts). |
No output schema declared.
No examples provided.
query_dom ~41
通过 CSS 选择器查询一个或多个元素。
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | – |
| limit | integer | – | – |
| selector | string | yes | – |
No output schema declared.
No examples provided.
reconstruct_jsvmp_trace ~172
把 instrument_jsvmp 探针回传的 opcode 流（从 window.<probe>Buffer 读回）重建成结构化 jsvmp 指令流：opcode 直方图（热点 handler）、执行顺序序列、以及 opcode→handler 源码映射（提供 dispatcherSource 时）。
| Name | Type | Req | Description |
|---|---|---|---|
| dispatcherSource | string | – | dispatcher 源码；提供则填充 opcode→handler 源码映射。 |
| maxSequence | integer | – | 序列保留的最大长度，默认 500。 |
| minCases | integer | – | 提取 handler 时的最小 case 数，默认 8。 |
| opcodes | array | yes | 按执行顺序回传的 opcode 流（window.<probe>Buffer 的内容）。 |
No output schema declared.
No examples provided.
record_reverse_evidence ~106
将结构化的逆向证据追加写入任务产物日志。
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | – |
| entry | object | yes | – |
| goal | string | yes | – |
| targetActionDescription | string | – | – |
| targetFunctionNames | array | – | – |
| targetKeywords | array | – | – |
| targetUrl | string | yes | – |
| targetUrlPatterns | array | – | – |
| taskId | string | yes | – |
| taskSlug | string | yes | – |
No output schema declared.
No examples provided.
remove_breakpoint ~54
根据 ID 移除断点。可用 `list_breakpoints` 查看当前生效的断点。
| Name | Type | Req | Description |
|---|---|---|---|
| breakpointId | string | yes | The breakpoint ID to remove (from list_breakpoints or set_breakpoint). |
No output schema declared.
No examples provided.
remove_hook ~25
按 id 移除一个 hook。
| Name | Type | Req | Description |
|---|---|---|---|
| hookId | string | yes | – |
No output schema declared.
No examples provided.
remove_xhr_breakpoint ~37
移除一个 XHR/Fetch 断点。
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The URL pattern to remove breakpoint for. |
No output schema declared.
No examples provided.
replay_request ~204
在页面上下文中（携带真实 cookie/origin）重新发送一个 HTTP 请求，可选改写 url/method/headers/body，并返回响应。用于端到端验证已复现的签名或参数：以通过 reqid 捕获的请求（来自 list_network_requests）为基础，覆盖其中的签名字段。
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | Request body override (ignored for GET/HEAD). |
| credentials | string | – | Fetch credentials mode (default: include — sends the page cookies). |
| headers | object | – | Header overrides merged over the captured headers. |
| maxBodyChars | integer | – | Max response body characters to return (default: 4000). |
| method | string | – | HTTP method override (default: original or GET). |
| reqid | integer | – | Base the replay on this captured request (from list_network_requests). |
| url | string | – | Request URL. Required without reqid; overrides the captured URL otherwise. |
No output schema declared.
No examples provided.
restore_session_state ~51
将先前保存的会话快照恢复到当前页面。
| Name | Type | Req | Description |
|---|---|---|---|
| clearStorageBeforeRestore | boolean | – | – |
| navigateToSavedUrl | boolean | – | – |
| sessionId | string | yes | – |
No output schema declared.
No examples provided.
resume ~28
在断点暂停后继续执行 JavaScript，一直运行到下一个断点或执行结束。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
risk_panel ~67
综合分析器、加密检测器与 hook 信号构建统一的风险评分。
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| hookId | string | – | – |
| includeHookSignals | boolean | – | – |
| topN | integer | – | – |
| useAI | boolean | – | – |
No output schema declared.
No examples provided.
run_rebuild ~177
在 Node 中运行已导出的复现产物包，报告产出的值以及首个分歧点。在 export_rebuild_bundle 之后使用：它会执行 <taskDir>/env/entry.js，捕获 stdout（结果）和首个运行时错误（stderr）。ReferenceError/TypeError 正是下一个需要修补的环境缺口。可选地将输出与期望值进行比对。
| Name | Type | Req | Description |
|---|---|---|---|
| entryRelativePath | string | – | Entry script path relative to taskDir (default: env/entry.js). |
| expected | string | – | If set, checks whether stdout contains this value (confirms reproduction). |
| taskDir | string | yes | The taskDir returned by export_rebuild_bundle. |
| timeout | integer | – | Maximum run time in milliseconds (default: 15000). |
No output schema declared.
No examples provided.
save_session_state ~64
将当前页面的会话状态（cookies/localStorage/sessionStorage）保存为内存快照。
| Name | Type | Req | Description |
|---|---|---|---|
| includeCookies | boolean | – | – |
| includeLocalStorage | boolean | – | – |
| includeSessionStorage | boolean | – | – |
| sessionId | string | – | – |
No output schema declared.
No examples provided.
search_in_scripts ~47
使用正则模式在已采集的脚本缓存中搜索。
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| maxTotalSize | integer | – | – |
| pattern | string | yes | – |
No output schema declared.
No examples provided.
search_in_sources ~200
在所有已加载的 JavaScript 源码中搜索字符串或正则表达式，返回匹配行及其 scriptId、URL 和行号。可用 `get_script_source` 配合 startLine/endLine 查看匹配处的完整上下文。
| Name | Type | Req | Description |
|---|---|---|---|
| caseSensitive | boolean | – | Whether the search should be case-sensitive. |
| excludeMinified | boolean | – | Skip minified files (files with very long lines). Default: true. |
| isRegex | boolean | – | Whether to treat the query as a regular expression. |
| maxLineLength | integer | – | Maximum characters per line preview (default: 150). Set to 0 for full lines. |
| maxResults | integer | – | Maximum number of results to return (default: 30). |
| query | string | yes | The search query (string or regex pattern). |
| urlFilter | string | – | Only search scripts whose URL contains this string (case-insensitive). |
No output schema declared.
No examples provided.
select_frame ~64
选择一个 frame（通过 list_frames 中的索引）作为 evaluate_script、hook_function、inspect_object 等在页面中运行 JavaScript 的工具的执行上下文。
| Name | Type | Req | Description |
|---|---|---|---|
| frameIdx | integer | yes | The frame index from list_frames. 0 = main frame. |
No output schema declared.
No examples provided.
select_page ~43
选择一个页面作为后续工具调用的上下文。
| Name | Type | Req | Description |
|---|---|---|---|
| pageIdx | number | yes | The index of the page to select. Call list_pages to list pages. |
No output schema declared.
No examples provided.
set_breakpoint ~175
在 JavaScript 文件的指定行设置断点，代码执行到该处时会触发。注意：监控函数调用时优先使用 `hook_function` 或 `create_hook`——断点需要配合暂停/继续执行，在自动化流程中容易出错。仅在需要查看函数内部局部变量时才使用断点。
| Name | Type | Req | Description |
|---|---|---|---|
| columnNumber | integer | – | Optional column number (0-based). |
| condition | string | – | Optional condition expression. The breakpoint only triggers when this evaluates to true. |
| isRegex | boolean | – | Whether to treat the URL as a regex pattern. |
| lineNumber | integer | yes | The line number to set the breakpoint (1-based). |
| url | string | yes | The URL of the JavaScript file (can be a partial match or regex pattern). |
No output schema declared.
No examples provided.
set_breakpoint_on_text ~191
通过搜索指定代码（函数名、语句等）并自动定位其精确位置来设置断点，普通文件和压缩文件都适用。注意：监控函数调用时优先使用 `hook_function`——它能在不暂停执行的情况下捕获参数/返回值。仅在需要查看某个具体代码位置的局部变量时才使用本工具。
| Name | Type | Req | Description |
|---|---|---|---|
| condition | string | – | Optional condition expression. Breakpoint only triggers when this evaluates to true. |
| occurrence | integer | – | Which occurrence to break on (1 = first, 2 = second, etc.). |
| text | string | yes | The code text to find and set breakpoint on (e.g., "function myFunc", "fetchData(", "apiCall"). |
| urlFilter | string | – | Only search in scripts whose URL contains this string (case-insensitive). |
No output schema declared.
No examples provided.
set_user_agent ~27
为当前活动页面设置自定义 user-agent。
| Name | Type | Req | Description |
|---|---|---|---|
| userAgent | string | yes | – |
No output schema declared.
No examples provided.
snapshot_scope ~170
在 JavaScript 执行暂停时，捕获一份有数量限制且已脱敏的作用域快照。命中断点后用它记录 local/closure/this/global 变量的名称、类型和安全预览值，用于动态数据流分析。
| Name | Type | Req | Description |
|---|---|---|---|
| goal | string | – | Optional reverse-engineering goal for the task artifact. |
| includeGlobal | boolean | – | – |
| maxFrames | integer | – | – |
| maxStringLength | integer | – | – |
| maxVariablesPerScope | integer | – | – |
| targetUrl | string | – | Optional target page URL associated with the reverse task. |
| taskId | string | – | Optional reverse task ID for writing durable evidence artifacts. |
| taskSlug | string | – | Optional reverse task slug used when opening the task artifact directory. |
No output schema declared.
No examples provided.
start_coverage ~93
启动精确的 JS 执行覆盖率，用于定位签名/加密代码。重要：只有在本次调用之后编译的脚本才会被插桩——请在目标页面加载之前调用 start_coverage（随后再 navigate_page），或者之后重新加载已打开的页面。然后触发相应行为，再调用 get_coverage 查看哪些函数被执行。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
step_into ~24
步入下一个函数调用，用于进入并调试函数体。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
step_out ~28
步出当前函数，一直执行到该函数返回。用它快速退出一个函数。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
step_over ~39
单步跳过到下一条语句，把函数调用当作一步执行。用它在不进入函数体的情况下逐行执行代码。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
stop_monitor ~29
停止一个事件监控。
| Name | Type | Req | Description |
|---|---|---|---|
| monitorId | string | yes | The monitor ID to stop. |
No output schema declared.
No examples provided.
summarize_code ~52
对单个代码文件、多个文件或项目级上下文进行摘要。
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| files | array | – | – |
| mode | string | – | – |
| url | string | – | – |
No output schema declared.
No examples provided.
take_screenshot ~135
对页面或元素进行截图。
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | – | The absolute path, or a path relative to the current working directory, to save the screenshot to instead of attaching it to the response. |
| format | string | – | Type of format to save the screenshot as. Default is "png" |
| fullPage | boolean | – | If set to true takes a screenshot of the full page instead of the currently visible viewport. Incompatible with uid. |
| quality | number | – | Compression quality for JPEG and WebP formats (0-100). Higher values mean better quality but larger file sizes. Ignored for PNG format. |
No output schema declared.
No examples provided.
trace_function ~250
根据源代码中的函数名追踪对该函数的调用。适用于任意函数，包括模块内部函数（webpack/rollup 打包的）。使用"日志点"（条件断点）在不暂停执行的情况下记录参数。
| Name | Type | Req | Description |
|---|---|---|---|
| functionName | string | yes | The function name to trace. Will search for "function NAME" or "NAME = function" or "NAME(" patterns. |
| goal | string | – | Optional reverse-engineering goal for the task artifact. |
| logArgs | boolean | – | Whether to log function arguments (default: true). |
| logThis | boolean | – | Whether to log "this" context (default: false). |
| pause | boolean | – | Whether to actually pause execution (default: false, just logs). |
| targetUrl | string | – | Optional target page URL associated with the reverse task. |
| taskId | string | – | Optional reverse task ID for writing durable evidence artifacts. |
| taskSlug | string | – | Optional reverse task slug used when opening the task artifact directory. |
| traceId | string | – | Custom ID for this trace. Used to identify in logs. |
| urlFilter | string | – | Only search in scripts matching this URL pattern. |
No output schema declared.
No examples provided.
type_text ~37
向输入元素中输入文本。
| Name | Type | Req | Description |
|---|---|---|---|
| delay | integer | – | – |
| selector | string | yes | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
understand_code ~49
结合 AI 与静态分析解析代码的结构、业务逻辑与安全性。
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | – |
| focus | string | – | – |
| useAI | boolean | – | – |
No output schema declared.
No examples provided.
unhook_function ~36
移除先前安装的函数 hook。
| Name | Type | Req | Description |
|---|---|---|---|
| hookId | string | yes | The hook ID to remove (from hook_function). |
No output schema declared.
No examples provided.
wait_for_element ~32
等待选择器对应的元素出现。
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | yes | – |
| timeout | integer | – | – |
No output schema declared.
No examples provided.
watch_property ~154
通过点分路径监视对象属性（如 window.config.token、navigator.userAgent）。action="install" 会用 getter/setter 包装该属性，记录每次读/写及其调用栈（设置 pause=true 可在访问时进入 debugger 暂停）；action="report" 列出捕获到的访问。请在该属性被访问之前安装——如果它在加载时被读取则需重新加载。
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| max | integer | – | Max records to report. |
| path | string | yes | Dotted property path, e.g. "window.foo.bar". |
| pause | boolean | – | Break in the debugger on each access (install only). |
No output schema declared.
No examples provided.
What is the JS Reverse MCP server?
JS Reverse MCP is listed in the public MCP registry as io.github.YuanHuakk/JSReverser-MCP. MCP server for JavaScript reverse engineering and browser debugging. This page covers its npm package (@yuanhuakk/js-reverse-mcp).
Is the JS Reverse MCP server safe to use?
JS Reverse MCP scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the JS Reverse MCP server expose?
JS Reverse MCP exposes 96 tools: analyze_target, analyze_websocket_messages, auto_patch_env, break_on_xhr, bypass_anti_debug, and 91 more. Their descriptions and schemas cost roughly 8,848 tokens of context every time the server is loaded.
Is the JS Reverse MCP server still maintained?
JS Reverse MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the JS Reverse MCP server under?
JS Reverse MCP declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.