zhizhuodemao/js-reverse-mcp

What it solves

This project provides an AI-native Model Context Protocol (MCP) server designed for JavaScript reverse engineering. It enables AI coding assistants (like Claude, Cursor, and Copilot) to act as analysts by allowing them to debug, locate, save, and analyze JavaScript behavior within web pages. Unlike standard DevTools APIs, it reorganizes browser capabilities into tools specifically optimized for an AI agent's continuous reasoning and operational flow.

How it works

The server acts as a bridge between an AI agent and a browser instance. It uses a specialized fork of Patchright to provide stealth capabilities at the protocol level and can optionally integrate with CloakBrowser for source-level fingerprint patching to bypass advanced anti-bot detections.

Key architectural choices include:

• Agent Primitives: Tools are designed as high-level primitives (e.g., list_network_requests with file export) rather than simple menu mappings, preventing the AI from getting stuck in invalid steps.
• Local File Integration: It allows agents to save scripts and network data to local files, treating the host filesystem as an analysis workbench to avoid overloading the chat context with large amounts of code.
• Stealth Layers: It employs "silent navigation" (delaying CDP activation) and a custom Patchright fork to reduce automation signatures without relying on page-level JS injection.

Who it’s for

It is built for developers and security researchers who use AI assistants to perform JavaScript reverse engineering, analyze network protocols (including WebSockets), and bypass anti-scraping/anti-bot protections on complex websites.

Highlights

• AI-Native Toolset: 24 specialized tools for page navigation, script analysis, breakpoint management, network/WebSocket inspection, and browser state control.
• Advanced Anti-Detection: Includes a custom Patchright fork for protocol stealth and an optional --cloak mode for deep C++ source-level fingerprint patching.
• Contextual Debugging: Supports setting breakpoints based on text search, inspecting call frames, and stepping through code with source context returned to the agent.
• State Management: Ability to clear site-specific data (cookies, storage) to reproduce risk-control flows and cookie generation processes.
• Persistent Sessions: Supports persistent login states via profiles and the ability to connect to existing Chrome instances or third-party fingerprint browsers via CDP endpoints.