vmoranv/jshookmcp

What it solves

It provides AI agents with a massive, integrated toolkit for JavaScript analysis and security research. Instead of manually configuring separate tools for browser automation, network interception, and reverse engineering, this project consolidates over 600 tools into a single Model Context Protocol (MCP) server, allowing agents to perform complex security audits and forensics autonomously.

How it works

The project operates as an MCP server that can be run via npx or as a shared HTTP daemon. It uses a runtime registry to auto-discover tools across 34 domains (such as WASM, V8, and network proxying) and employs lazy initialization to keep startup fast. To manage the high volume of tools without overwhelming an LLM's context window, it uses a tiered profile system (search, workflow, full) and a hybrid search mechanism (BM25 and Vector search) to help agents find the right tool for the task.

Who it’s for

It is designed for security researchers, reverse engineers, and developers who use AI agents (like Claude Desktop or Cursor) to analyze obfuscated JavaScript, perform browser-based forensics, or conduct vulnerability research.

Highlights

• Massive Toolset: Over 600 tools covering domains from WASM disassembly and memory forensics to AST transforms and HTTP/2 interception.
• Context Efficiency: Tiered profiles and hybrid search prevent LLM context overflow by providing only the necessary tools.
• Advanced Browser Control: Integration with Chromium/Camoufox, CDP debugging, and anti-detection capabilities.
• Deep Forensics: Includes native FFI scanning, hardware breakpoints, and bridges for Ghidra and IDA.
• Flexible Deployment: Supports both standard stdio and a multiplexed HTTP daemon for sharing resources across multiple agents.