zhizhuodemao/js-reverse-mcp

MCPcommunity
zhizhuodemaoApache-2.0Updated 4mo agoGitHub

为 AI Agent 设计的 JS 逆向 MCP Server，内置反检测，基于 chrome-devtools-mcp 重构 | JS reverse engineering MCP server with agent-first tool design and built-in anti-detection. Rebuilt from chrome-devtools-mcp.

JavaScript 逆向工程 MCP 服务器，让你的 AI 编码助手（如 Claude、Cursor、Copilot）能够调试和分析网页中的 JavaScript 代码。 基于 Patchright 协议层反检测，对强反爬站点可选启用 CloakBrowser 源码层指纹模式。有头模式 + 持久化登录态 + 零 JS 注入 —— 看起来、行为都像一个真实的 Chrome。 默认有头调试：看得到浏览器，下断点、单步、看调用栈 —— 真正的逆向流程 持久化登录态：cookies / localStorage 跨会话保留 双层反检测：Patchright 在 CDP 协议层规避 、 等泄露点；可选 启用 CloakBrowser 二进制，再加 49 个 C++ 源码层指纹 patch（canvas / WebGL / audio / GPU / 字体） 脚本分析：列出所有加载的…

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →
2kGitHub stars
261Forks
4mo agoLast update
Package
Authorzhizhuodemao
LicenseApache-2.0
Sourcegithub
GitHubzhizhuodemao/js-reverse-mcp
SBOMCycloneDX 1.6 ↓
Trust Status
B
60/100Good
✓Listed in Forge index+10/10
—Publisher identity verified+0/30
→ Publisher: run `forge publish` from the repo to claim ownership
—Domain verification+0/10
→ Not currently available for this listing type — the domain-verification check only runs for npm-backed packages today, so this row cannot be earned here yet regardless of what's hosted at the domain.
✓Prompt-injection scan · clean+30/30
✓Obfuscation / exfil scan · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusCommunity-indexed
PublisherUnverified
SignatureUnsigned
Domain—
Provenance—
DependenciesNot audited
Tool surface25 tools · 2 privileged
Security scan✓ CleanvHEAD · 3mo agoHow well does this scan work?
EvalsNone
IndexedMay 24, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

25 tools · 2 privileged
Statically extracted from the published packagevHEAD · 3mo ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

internal-pdf-viewerNo description published

This tool published no description. Forge does not invent one.

mhjfbmdgcfjbbpaeojofohoefgiehjaiNo description published

This tool published no description. Forge does not invent one.

internal-nacl-pluginNo description published

This tool published no description. Forge does not invent one.

js-reverseNo description published

This tool published no description. Forge does not invent one.

list_console_messagesNo description published

This tool published no description. Forge does not invent one.

list_scriptsNo description published

This tool published no description. Forge does not invent one.

get_script_sourceNo description published

This tool published no description. Forge does not invent one.

save_script_sourceNo description published

This tool published no description. Forge does not invent one.

search_in_sourcesNo description published

This tool published no description. Forge does not invent one.

remove_breakpointprivilegedNo description published

This tool published no description. Forge does not invent one.

list_breakpointsNo description published

This tool published no description. Forge does not invent one.

get_request_initiatorNo description published

This tool published no description. Forge does not invent one.

get_paused_infoNo description published

This tool published no description. Forge does not invent one.

pause_or_resumeNo description published

This tool published no description. Forge does not invent one.

stepNo description published

This tool published no description. Forge does not invent one.

set_breakpoint_on_textNo description published

This tool published no description. Forge does not invent one.

break_on_xhrNo description published

This tool published no description. Forge does not invent one.

select_frameNo description published

This tool published no description. Forge does not invent one.

list_network_requestsNo description published

This tool published no description. Forge does not invent one.

select_pageNo description published

This tool published no description. Forge does not invent one.

new_pageNo description published

This tool published no description. Forge does not invent one.

navigate_pageNo description published

This tool published no description. Forge does not invent one.

take_screenshotNo description published

This tool published no description. Forge does not invent one.

evaluate_scriptprivilegedNo description published

This tool published no description. Forge does not invent one.

get_websocket_messagesNo description published

This tool published no description. Forge does not invent one.

0 of 25 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

JavaScript 逆向工程 MCP 服务器，让你的 AI 编码助手（如 Claude、Cursor、Copilot）能够调试和分析网页中的 JavaScript 代码。 基于 Patchright 协议层反检测，对强反爬站点可选启用 CloakBrowser 源码层指纹模式。有头模式 + 持久化登录态 + 零 JS 注入 —— 看起来、行为都像一个真实的 Chrome。 默认有头调试：看得到浏览器，下断点、单步、看调用栈 —— 真正的逆向流程 持久化登录态：cookies / localStorage 跨会话保留 双层反检测：Patchright 在 CDP 协议层规避 、 等泄露点；可选 启用 CloakBrowser 二进制，再加 49 个 C++ 源码层指纹 patch（canvas / WebGL / audio / GPU / 字体） 脚本分析：列出所有加载的 JS，搜索代码，获取/保存源码 断点调试：设置/移除断点，支持条件断点，压缩代码中精确定位 执行控制：暂停/恢复，单步 over/into/out，响应带源码上下文 网络分析：请求调用栈、XHR…

Alternatives
Comparing tool surfaces…

Tools exposed

25 tools · 2 privileged · observed by static extraction. A tool surface is what one scan read on one day, not a live capability list.

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

No dependency coverage

This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.