M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
J

JSHookMCP

Community
An MCP server giving AI agents 600+ tools across 34 domains for JavaScript analysis and security research — browser automation, CDP debugging, network interception, JS hooks, LLM-powered code analysis, and workflow orchestration.
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #315 of 438
Stars
★ 2.0k Very popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Node.js 22.12+
Credentials
No credential needed
License
AGPL-3.0
Last commit
Tools
5
44FMRS · D

jshookmcp is a powerful but highly specialized MCP server for JavaScript security and reverse engineering. It offers a comprehensive toolset and flexible configuration, but requires technical expertise and has a steep learning curve. Despite sensitive features, the project is AGPL-3.0 licensed and community-driven, making it a professional and effective solution.

Strongest · Setup experience 12/20 Weakest · Reliability 5/20

Reliability
5/20
Security and permissions
5/20
Maintenance
10/20
Documentation
12/20
Setup experience
12/20
Why each score
Reliability 5/20
The manifest is internally coherent (schema, name, version 0.3.5, npm package @jshookmcp/jshook, and matching repository/homepage), and the README describes a plausible stdio plus HTTP-daemon MCP server with profile-based tool loading. However, this review received only the README and the manifest; no source code, tool definitions, tests, or CI workflow files were provided, so the 668 declared tools cannot be confirmed to exist and the init/tool-list handshake cannot be verified. Error handling and edge cases are undocumented. Points are deducted for the absence of any verifiable execution evidence; the claim that the registry snapshot is 'checked in CI' is unverifiable, and uncertainty lowers rather than raises the score.
Security and permissions 5/20
No install example contains real tokens or secrets; the only auth value shown is the variable name MCP_AUTH_TOKEN. The daemon documents a loopback bind and per-client session isolation, which are positive data-boundary signals. But this is a dual-use security-analysis toolset (MITM proxy, process/memory scanning, syscall hooks, browser instrumentation, exploit-dev domain), and the supplied material shows no least-privilege defaults, no confirmation gates for destructive operations, no credential-handling policy, and no data-flow disclosure; the claimed destructiveHint annotations are unverifiable. Heavily deducted for missing permission/confirmation/scoping evidence. No clear red-line violation is evident from the material itself: no malware, credential theft, covert exfiltration, or default irreversible remote commands, and the install examples contain no real secrets.
Maintenance 10/20
Positive signals: the repository is not archived, has an AGPL-3.0 license, uses semver-style versioning (0.3.5), references a CI-checked generated registry snapshot, includes recent runtime notes, and points to a docs site. Deducted because the material contains no commit history, release dates, dependency-update evidence, issue-response evidence, security-response channel, or governance documentation, so the maintenance cadence cannot be verified. Star count is treated only as a discovery signal and adds no points.
Documentation 12/20
The README is reasonably layered: copy-paste client configs for Claude Desktop/Cursor, a Windows npx.cmd note, environment-variable explanations (MCP_TOOL_PROFILE, npm_config_omit, SEARCH_VECTOR_ENABLED, MCP_AUTH_TOKEN), daemon setup and usage, architecture notes, a generated tool/domain registry snapshot, plus links to a Chinese translation and to docs, getting-started, configuration, and tool-reference pages. Deducted because all tool parameters live behind external links not supplied for this review; there is no troubleshooting section, no cost or usage-limit disclosure despite LLM-powered features, and no runtime error semantics.
Setup experience 12/20
Setup is concrete and few-step: a copy-paste npx-based client config for a mainstream client, an env var to skip heavy optional native dependencies by default, a Windows workaround, and a documented HTTP-daemon alternative for URL-based clients with bind and auth notes; the Node 22.12+ requirement is explicit. Deducted because the provided material contains no real CI workflows or committed tests proving the install path works, so the score must stay well under the 15-point static ceiling; optional native packages (ONNX/Z3/Binaryen/Camoufox/Playwright) may still make installs fragile on some platforms, and the @latest pin is not reproducible.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesWrites / deletes local filesRuns commands or codeUses the networkControls a browser

Best for

  • Security researchers specializing in JavaScript and reverse engineering
  • Developers needing browser automation and network debugging
  • Teams leveraging AI agents for dynamic code analysis
  • MCP users needing progressive tool profiles to optimize context

Not for

  • General applications needing simple API access
  • Users uninterested in reverse engineering or browser automation
  • Those needing a minimal server without extra dependencies (use the search profile to reduce resource usage)

Required permissions

  • Access to browser debugging interfaces (CDP)
  • Starting a local HTTP server bound to 127.0.0.1
  • Generating and managing local HTTPS certificates for traffic interception
  • Optional download of heavy dependencies (e.g., ONNX, Z3) when using full profiles

Risks and side effects

  • Anti-detection and CAPTCHA features may violate third-party terms of service
  • Network interception could be misused; ensure lawful use
  • Running many tools may consume significant system resources
  • Exposing the HTTP endpoint without MCP_AUTH_TOKEN could allow unauthorized access

Setup

Before you start

Runtime：Node.js 22.12+

MCP_AUTH_TOKEN optionalsecret Auth token required before exposing the HTTP endpoint beyond localhost; not needed for local-only use.
Other optional settings (2)
MCP_TOOL_PROFILE optional Controls the tool profile loaded (search/workflow/full); docs default to search to reduce token usage.
SEARCH_VECTOR_ENABLED optional Set to false to use lexical (BM25) search only; vector search is lazily enabled by default in the HTTP daemon.
  1. Ensure Node.js 22.12+ and npm are installed.\n2. Add the service configuration as shown in install_config to your MCP client config (e.g., Claude Desktop or Cursor).\n3. Restart the client to load the server.\n4. For full profiles, remove npm_config_omit and restart.
claude_desktop_config.json 
{
  "mcpServers": {
    "jshook": {
      "command": "npx",
      "args": [
        "-y",
        "@jshookmcp/jshook@latest"
      ],
      "env": {
        "MCP_TOOL_PROFILE": "search",
        "npm_config_omit": "optional"
      }
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "jshook": {
      "command": "npx",
      "args": [
        "-y",
        "@jshookmcp/jshook@latest"
      ],
      "env": {
        "MCP_TOOL_PROFILE": "search",
        "npm_config_omit": "optional"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add jshook -e MCP_TOOL_PROFILE=search -e npm_config_omit=optional -- npx -y @jshookmcp/jshook@latest

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After installing, the client's tool list should show search_tools, describe_tool, call_tool, and coverage_report; or ask it to "list available JS analysis tools" — a successful search_tools response confirms the connection.

Troubleshooting

  1. If npx is not recognized, ensure Node.js 22.12+ is installed and check PATH (on Windows, use the absolute path to npx.cmd).
  2. If browser features fail, ensure optional dependencies like Playwright are installed by removing `npm_config_omit`.
  3. For certificate errors, check that the proxy-generated CA is trusted by your system.
  4. If connection fails, verify the command and arguments in the MCP client configuration.

Things to try

Once connected, you can ask your AI assistant things like:

  • Search for tools that can intercept browser network requests
  • Use describe_tool to show the parameters of the browser automation tools
  • Start a local proxy to capture HTTPS traffic
  • Generate a coverage_report of the currently available tools

Tools 5

search_tools read-only
Search for available tools by keywords, with hybrid BM25 and vector ranking.
describe_tool read-only
Get detailed description and parameters for a specified tool.
call_tool writes
Call a specified tool with validated parameters.
coverage_report read-only
Generate a coverage report showing which registered tools have been used.
proxy_start writes
Start a local proxy that auto-generates an HTTPS interception CA, enabling network capture and MITM analysis.

Use cases

JavaScript deobfuscation and crypto-algorithm detection
Browser automation with anti-detection and CAPTCHA handling
Network interception, HTTP/2 frame analysis, GraphQL debugging
WebAssembly reverse engineering and binary analysis
Process and memory forensics for security research

Supported clients

Claude Desktop
Cursor

Listed from the project's documentation, not tested by this site.

Overview

jshookmcp is an MCP server that provides AI agents with 600+ built-in tools across 34 domains for JavaScript analysis and security research. It integrates browser automation, CDP debugging, network interception, JS hooks, LLM-powered code analysis, process/memory forensics, WASM reverse engineering, source-map reconstruction, AST transforms, and composite workflows. A progressive tool profile (search → workflow → full) optimizes context consumption. Requires Node.js 22.12+ and uses strict TypeScript.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 853e4d53ad8d Data synced 2026-10-12 Read the FMRS scoring method