English | 中文
How to install jshookmcp?
vmoranv/jshookmcp
$git clone https://github.com/vmoranv/jshookmcpInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install jshookmcp by running `git clone https://github.com/vmoranv/jshookmcp`, then use it for the current task and follow its documentation at https://github.com/vmoranv/jshookmcp.
README.md
| 1 | # @jshookmcp/jshook |
| 2 | |
| 3 | [](LICENSE) |
| 4 | [](https://nodejs.org/) |
| 5 | [](https://www.typescriptlang.org/) |
| 6 | [](https://modelcontextprotocol.io/) |
| 7 | [](https://pnpm.io/) |
| 8 | |
| 9 | English | [中文](./README.zh.md) |
| 10 | |
| 11 | An MCP server that gives AI agents **600+ tools across 34 domains** for JavaScript analysis and security research — browser automation, CDP debugging, network interception, JS hooks, LLM-powered code analysis, process/memory forensics, WASM reverse engineering, source-map reconstruction, AST transforms, and composite workflows in a single server. |
| 12 | |
| 13 | ## Quick Links |
| 14 | |
| 15 | - **[📖 Documentation](https://vmoranv.github.io/jshookmcp/)** · **[🚀 Getting Started](https://vmoranv.github.io/jshookmcp/guide/getting-started.html)** · **[⚙️ Configuration](https://vmoranv.github.io/jshookmcp/guide/configuration.html)** · **[📚 Tool Reference](https://vmoranv.github.io/jshookmcp/reference/)** |
| 16 | |
| 17 | ## 🚀 Quick Start |
| 18 | |
| 19 | No global install needed — add to your MCP client config and you're ready: |
| 20 | |
| 21 | **Claude Desktop / Cursor (`claude_desktop_config.json`)**: |
| 22 | |
| 23 | ```json |
| 24 | { |
| 25 | "mcpServers": { |
| 26 | "jshook": { |
| 27 | "command": "npx", |
| 28 | "args": ["-y", "@jshookmcp/jshook@latest"], |
| 29 | "env": { |
| 30 | "MCP_TOOL_PROFILE": "search", |
| 31 | "npm_config_omit": "optional" |
| 32 | } |
| 33 | } |
| 34 | } |
| 35 | } |
| 36 | ``` |
| 37 | |
| 38 | *(Windows: use `npx.cmd` absolute path if `npx` is not found)* |
| 39 | |
| 40 | This lightweight configuration skips optional ONNX, Z3, Binaryen, Camoufox, and Playwright |
| 41 | packages. Remove `npm_config_omit` when those full-profile runtimes are required. |
| 42 | |
| 43 | ### Share one daemon across multiple agents |
| 44 | |
| 45 | The default stdio configuration starts one full jshook process per MCP host. To share the |
| 46 | embedding model, browser runtime, and caches, start one local Streamable HTTP daemon: |
| 47 | |
| 48 | ```bash |
| 49 | pnpm build |
| 50 | pnpm daemon |
| 51 | ``` |
| 52 | |
| 53 | Vector search defaults to off for per-client stdio processes and on (lazy-loaded) for the shared |
| 54 | HTTP daemon. Set `SEARCH_VECTOR_ENABLED=false` when lexical search is sufficient. |
| 55 | |
| 56 | Then point every MCP client at `http://127.0.0.1:3000/mcp` using its HTTP/URL server |
| 57 | configuration. Each client receives its own MCP session and response route while heavyweight |
| 58 | runtime resources remain in one process. Keep the default loopback bind; set `MCP_AUTH_TOKEN` |
| 59 | before exposing the endpoint beyond localhost. |
| 60 | |
| 61 | ## 🌟 Highlights |
| 62 | |
| 63 | - 🤖 **AI-Driven Analysis** — LLM-powered deobfuscation, crypto detection, AST comprehension |
| 64 | - ⚡ **Search-First Context Efficiency** — `search` profile ≈ 3K tokens vs `full` ≈ 40K+ tokens |
| 65 | - 🎯 **Progressive Tiers** — `search` → `workflow` → `full`, activate on demand |
| 66 | - 🌐 **Full-Stack Browser Automation** — Chromium/Camoufox + CDP + anti-detection + CAPTCHA handling |
| 67 | - 🔁 **Runtime Recovery and Session Isolation** — HTTP sessions restore activated domains, browser attach state, coverage state, and isolate browser-side session state per client |
| 68 | - 🧭 **Schema-First Meta Tools** — `describe_tool`, validated `call_tool`, and `coverage_report` reduce parameter errors and make tool coverage visible |
| 69 | - 📡 **Network Interception** — HTTP/2 frame building, MiTM capture, GraphQL, Burp Suite bridge |
| 70 | - 🛠️ **Reverse Engineering Toolchain** — WASM disassembly, binary analysis, Frida, Ghidra/IDA bridges |
| 71 | - 🧰 **Process & Memory Forensics** — Native FFI scanning, hardware breakpoints, PE introspection |
| 72 | - 🧩 **Dynamic Extensibility** — Hot-reload plugins, declarative workflows, auto-discovered domains |
| 73 | |
| 74 | ## Recent Runtime Notes |
| 75 | |
| 76 | - HTTP transport now multiplexes independent MCP sessions and restores runtime state after reconnects. |
| 77 | - `proxy_start` auto-generates a local HTTPS interception CA when needed. |
| 78 | - Browser CAPTCHA solving is now explicit-input driven: pass `taskKind`, `siteKey`, `imageBas |
Related
6 picksType
- chrome-devtools-mcpMCP server for Chrome DevToolsJul 2026
- lean-lsp-mcpLean Theorem Prover MCPJul 2026
- desktopcommandermcpMCP server for terminal commands, file operations, and process managementJul 2026
- langfuse-mcpLangfuse MCP server for accessing and analyzing telemetry data via natural languageJun 2026
- mcp_debugPostman for your MCP server with a Claude chat that calls your toolsJun 2025
- tauri-plugin-mcpAllows AI agents (e.g., Cursor, Claude Code) to debug within Tauri apps via screenshot capture, window management, DOM access, and simulated user inputs.Jul 2026
