← Back to directory

JS Reverse MCP

Community

An AI-agent-first MCP server for JavaScript reverse engineering and browser debugging.

GitHub source repository ↗

★ 2.3k Stars Category · Browser Very popular

59FMRS · C

Reliability

10/20

Security and permissions

9/20

Maintenance

11/20

Documentation

15/20

Setup experience

14/20

The source describes an Apache-2.0 stdio MCP Server located at the repository root with 24 tools for JavaScript reverse engineering and browser debugging. No server manifest was cached, and the project is not identified as an official server maintained by an upstream browser or protocol owner.

Read the FMRS scoring method →

JS Reverse MCP organizes headed Chrome debugging, JavaScript source analysis, breakpoints and call-frame execution, network and WebSocket inspection, browser-state replay, and local file I/O into tools for continuous AI-agent reasoning. Patchright protocol-level stealth is enabled by default, with optional CloakBrowser source-level fingerprinting.

Tools

select_page

List open pages or select a debugging context.

new_page

Create a page and navigate to a URL.

navigate_page

Navigate, go back, go forward, or reload a page.

select_frame

List or select an iframe execution context.

click_element

Strictly match and click one visible element in the current frame.

take_screenshot

Capture a page screenshot.

list_scripts

List JavaScript scripts loaded by the page.

get_script_source

Get a source fragment by line range or character offset.

save_script_source

Save a complete script source to a local file.

search_in_sources

Search all scripts for a string or regular expression.

set_breakpoint_on_text

Set a breakpoint by searching code text, including minified code.

break_on_xhr

Set an XHR/Fetch breakpoint by URL pattern.

remove_breakpoint

Remove breakpoints by ID, URL, or all breakpoints.

list_breakpoints

List active breakpoints.

get_paused_info

Get pause state, call stack, and scope variables.

pause_or_resume

Pause or resume execution.

step

Step over, into, or out and return location and source context.

list_network_requests

List requests, inspect details, or export raw request materials.

clear_network_requests

After explicit confirmation, clear collected requests and body cache.

get_request_initiator

Get the JavaScript call stack that initiated a request.

get_websocket_messages

List WebSocket connections, analyze message patterns, or inspect message details.

clear_site_data

Clear current-site cookies, origin storage, and sessionStorage, with optional global HTTP cache clearing.

evaluate_script

Execute JavaScript in the page or paused context, with result saving and local input-file support.

list_console_messages

List console messages or retrieve one message by ID.

Setup

Requires Node.js v20.19 or later and stable Chrome. Add the npx configuration to an MCP client, or clone the repository, run npm install and npm run build, then launch build/src/index.js with node. For local-file operations, --allowedRoots is recommended.

claude_desktop_config.json

{"mcpServers":{"js-reverse":{"command":"npx","args":["js-reverse-mcp"]}}}

Generate and validate client config

Fit and risk

Best for

Developers who need an AI agent to carry out a continuous JavaScript reverse-engineering workflow.
Analysis tasks requiring a headed browser, persistent login state, and replayable local artifacts.
Research involving relationships among scripts, breakpoints, network traffic, and WebSockets.

Not for

Generic browsing or simple automation that does not require reverse-engineering capabilities.
Users seeking a general-purpose scraping framework or a guarantee of bypassing every site defense.
Sensitive environments where the MCP client must not access browser content or host files.

Required permissions

It can inspect, debug, and modify data in the browser.
evaluate_script.localFilePath and outputFile/filePath parameters can make the MCP process read or write host files.
Without --allowedRoots, local-file access is unrestricted; the option can constrain permitted directories.
The default profile persists cookies and localStorage; --isolated uses a temporary profile.

Risks and side effects

Browser contents are exposed to the MCP client; do not use it on pages containing sensitive information.
Unrestricted local-file access may expose or modify host files.
Verbose debugging logs may reveal pages, cookies, scripts, or credentials; the README advises against DEBUG=* .
With --cloak, first launch may silently download about 200 MB, and its profile is physically separate from the default profile.

Troubleshooting

After first opening a page, call list_network_requests to activate collectors, reload, and inspect requests again.
If anti-bot systems block access, try --isolated first and then consider --cloak.
Before using --cloak, run npx cloakbrowser install to pre-download the binary.
--browserUrl must be a CDP HTTP endpoint responding to /json/version, not a vendor-private Local API.
For local-file issues, check --allowedRoots; for connection issues, verify Node.js, Chrome, and the CDP endpoint.

Use cases

Locate and analyze JavaScript functions in web pages.

Investigate runtime behavior with breakpoints, call stacks, scope variables, and stepping.

Capture, inspect, and export requests, cookies, response content, and WebSocket messages.

Clear site state and replay cookie or anti-bot initialization flows.

Move analysis materials between the page, browser network data, and local files.

Supported clients

Claude CodeFull support

CursorFull support

VS Code CopilotFull support

CodexFull support

Related MCP servers

Compare with other MCP servers