M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
J

JS Reverse MCP

Community
An AI-agent-first MCP server for JavaScript reverse engineering and browser debugging.
How to install ↓ Compare GitHub source repository ↗
Category
Browser #8 of 32
Stars
★ 3.0k Very popular
Transport
stdio (local process)
Runtime
Node.js 20.19+ · Prebuilt binary
Credentials
No credential needed
License
Apache-2.0
Last commit
Tools
24
59FMRS · C

The source describes an Apache-2.0 stdio MCP Server located at the repository root with 24 tools for JavaScript reverse engineering and browser debugging. No server manifest was cached, and the project is not identified as an official server maintained by an upstream browser or protocol owner.

Strongest · Documentation 15/20 Weakest · Security and permissions 9/20

Reliability
10/20
Security and permissions
9/20
Maintenance
11/20
Documentation
15/20
Setup experience
14/20
Why each score
Reliability 10/20
The README describes fairly complete startup, debugging, and failure-handling flows, but the server manifest is not cached and the supplied material contains no CI, committed tests, or executable evidence for the MCP initialization and tool-list handshake. Dependence on system Chrome, Node.js, optional CloakBrowser downloads, and external CDP endpoints also creates additional failure modes, so the score stays below the static-review ceiling of 12.
Security and permissions 9/20
The documentation explicitly discloses exposure of browser content, cookies, scripts, network data, and local files to the MCP client, and describes controls such as allowedRoots, real-path boundary checks, restrictive log permissions, and explicit confirmation for clearing network data. However, local file access is unrestricted by default, the persistent profile retains login state, evaluate_script can execute page JavaScript, and allowedRoots is optional. Least privilege and sensitive-data isolation are therefore incomplete. The supplied material does not establish a red-line risk.
Maintenance 11/20
The repository is not archived, declares Apache-2.0, and documents a maintainer-provided offline routing evaluation with 30 contracts. However, the material provides no commit history, release record, dependency-update policy, issue-response evidence, or security-reporting channel. The 9 open issues are only a limited discovery signal and do not demonstrate sustained maintenance, so points are deducted.
Documentation 15/20
The README covers installation, mainstream MCP client configuration, tool categories, workflows, parameters, profiles, file access, anti-detection modes, troubleshooting, and security warnings. It also discloses the approximate CloakBrowser download size and that model evaluations may incur costs. The missing manifest, incomplete authentication details, incomplete parameter constraints, platform coverage, and lack of verifiable implementation evidence prevent a full score.
Setup experience 14/20
The project provides npx, local-build instructions, and configuration examples for Claude Code, Codex, Cursor, and VS Code Copilot, with clear Node.js and Chrome prerequisites. The default path is short, but it requires a prepared runtime and Chrome; --cloak adds a binary download, while --browserUrl, third-party-browser CDP setup, and local-file permission configuration may be fragile. Full marks are therefore not justified.

Static review · not runListed 2026-07-29

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesWrites / deletes local filesRuns commands or codeUses the networkControls a browser

Best for

  • Developers who need an AI agent to carry out a continuous JavaScript reverse-engineering workflow.
  • Analysis tasks requiring a headed browser, persistent login state, and replayable local artifacts.
  • Research involving relationships among scripts, breakpoints, network traffic, and WebSockets.

Not for

  • Generic browsing or simple automation that does not require reverse-engineering capabilities.
  • Users seeking a general-purpose scraping framework or a guarantee of bypassing every site defense.
  • Sensitive environments where the MCP client must not access browser content or host files.

Required permissions

  • It can inspect, debug, and modify data in the browser.
  • evaluate_script.localFilePath and outputFile/filePath parameters can make the MCP process read or write host files.
  • Without --allowedRoots, local-file access is unrestricted; the option can constrain permitted directories.
  • The default profile persists cookies and localStorage; --isolated uses a temporary profile.

Risks and side effects

  • Browser contents are exposed to the MCP client; do not use it on pages containing sensitive information.
  • Unrestricted local-file access may expose or modify host files.
  • Verbose debugging logs may reveal pages, cookies, scripts, or credentials; the README advises against DEBUG=* .
  • With --cloak, first launch may silently download about 200 MB, and its profile is physically separate from the default profile.

Setup

Before you start

Runtime：Node.js 20.19+ · Prebuilt binary

MCP_ROUTING_EVAL_API_KEY optionalsecret API key for the eval endpoint; optional for unauthenticated local endpoints, remote endpoints must use HTTPS.
Other optional settings (5)
MCP_ROUTING_EVAL_ENDPOINT optional Maintainer-only routing eval: an OpenAI-compatible Chat Completions endpoint; not needed for normal use.
MCP_ROUTING_EVAL_MODEL optional Model name for real-model routing evals; only set when running evals.
MCP_ROUTING_EVAL_TIMEOUT_MS optional Optional per-request timeout in milliseconds for evals.
MCP_ROUTING_EVAL_MIN_PASS_RATE optional Optional pass-rate threshold (0,1] for cross-model comparisons; default requires 100%.
DEBUG optional Set to DEBUG=mcp:* for verbose debug logs; never use DEBUG=* as browser protocol logs may leak pages, cookies, scripts and credentials.

Requires Node.js v20.19 or later and stable Chrome. Add the npx configuration to an MCP client, or clone the repository, run npm install and npm run build, then launch build/src/index.js with node. For local-file operations, --allowedRoots is recommended.

.mcp.json 
{"mcpServers":{"js-reverse":{"command":"npx","args":["js-reverse-mcp"]}}}

Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "js-reverse": {
      "command": "npx",
      "args": [
        "js-reverse-mcp"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add js-reverse -- npx js-reverse-mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

The MCP client's tool list should show 24 tools including select_page, list_scripts and evaluate_script; or prompt "Open https://example.com and list all loaded JavaScript scripts" — a returned script list confirms the connection works.

Troubleshooting

  1. After first opening a page, call list_network_requests to activate collectors, reload, and inspect requests again.
  2. If anti-bot systems block access, try --isolated first and then consider --cloak.
  3. Before using --cloak, run npx cloakbrowser install to pre-download the binary.
  4. --browserUrl must be a CDP HTTP endpoint responding to /json/version, not a vendor-private Local API.
  5. For local-file issues, check --allowedRoots; for connection issues, verify Node.js, Chrome, and the CDP endpoint.

Things to try

Once connected, you can ask your AI assistant things like:

  • Open https://example.com and list all loaded JavaScript scripts
  • Search all scripts for code containing "encrypt" and save the script source to a local file
  • Set a breakpoint at the encryption function entry, trigger the action, then inspect arguments, call stack and scope variables
  • List WebSocket connections, analyze message patterns and inspect messages of a specific type

Tools 24

select_page read-only
List open pages or select a debugging context.
new_page writes
Create a page and navigate to a URL.
navigate_page writes
Navigate, go back, go forward, or reload a page.
select_frame read-only
List or select an iframe execution context.
click_element writes
Strictly match and click one visible element in the current frame.
take_screenshot read-only
Capture a page screenshot.
list_scripts read-only
List JavaScript scripts loaded by the page.
get_script_source read-only
Get a source fragment by line range or character offset.
Show 16 more tools
save_script_source writes
Save a complete script source to a local file.
search_in_sources read-only
Search all scripts for a string or regular expression.
set_breakpoint_on_text writes
Set a breakpoint by searching code text, including minified code.
break_on_xhr writes
Set an XHR/Fetch breakpoint by URL pattern.
remove_breakpoint destructive
Remove breakpoints by ID, URL, or all breakpoints.
list_breakpoints read-only
List active breakpoints.
get_paused_info read-only
Get pause state, call stack, and scope variables.
pause_or_resume writes
Pause or resume execution.
step writes
Step over, into, or out and return location and source context.
list_network_requests read-only
List requests, inspect details, or export raw request materials.
clear_network_requests destructive
After explicit confirmation, clear collected requests and body cache.
get_request_initiator read-only
Get the JavaScript call stack that initiated a request.
get_websocket_messages read-only
List WebSocket connections, analyze message patterns, or inspect message details.
clear_site_data destructive
Clear current-site cookies, origin storage, and sessionStorage, with optional global HTTP cache clearing.
evaluate_script writes
Execute JavaScript in the page or paused context, with result saving and local input-file support.
list_console_messages read-only
List console messages or retrieve one message by ID.

Use cases

Locate and analyze JavaScript functions in web pages.
Investigate runtime behavior with breakpoints, call stacks, scope variables, and stepping.
Capture, inspect, and export requests, cookies, response content, and WebSocket messages.
Clear site state and replay cookie or anti-bot initialization flows.
Move analysis materials between the page, browser network data, and local files.

Supported clients

Claude Code
Cursor
VS Code
Codex

Listed from the project's documentation, not tested by this site.

Overview

JS Reverse MCP organizes headed Chrome debugging, JavaScript source analysis, breakpoints and call-frame execution, network and WebSocket inspection, browser-state replay, and local file I/O into tools for continuous AI-agent reasoning. Patchright protocol-level stealth is enabled by default, with optional CloakBrowser source-level fingerprinting.

Similar servers

Compare with other MCP servers

Source revision bf7dc506e874 Data synced 2026-10-19 Read the FMRS scoring method