# How to Configure jshookmcp for JavaScript Runtime Analysis and Browser CDP Hooks

> Configure jshookmcp for JavaScript runtime analysis and browser CDP hooks. Install the npm package, register as an MCP server, and activate CDP debugging tools for runtime sampling and browser hooking.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-09

---

**To configure jshookmcp for JavaScript runtime analysis, install the npm package `@jshookmcp/jshook`, register it as an MCP server in your Claude configuration with the `search` profile, and activate the CDP-based debugging tools to enable runtime sampling and browser hooking.**

The `jshookmcp` server provides the **zhaoxuya520/reverse-skill** framework with unified browser automation, Chrome DevTools Protocol (CDP) integration, and JavaScript hooking capabilities. This guide walks through the exact configuration steps required to enable the "Observe → Capture → Rebuild" workflow for reverse engineering JavaScript applications.

## Prerequisites and Package Installation

Before registering the server, ensure your environment meets the Node.js runtime requirements. The `ensure_node_runtime` function (called within the bootstrap process) validates that Node is available for executing the npx commands.

Install the `jshookmcp` package using the built-in bootstrap script located at [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh). The `ensure_jshookmcp` function (lines 497-500) handles the installation and registration automatically:

```bash
bash skills/scripts/bootstrap-reverse.sh jshookmcp

```

This command executes `npx -y @jshookmcp/jshook@0.3.4` to download and cache the server binary without requiring a global npm install.

## MCP Server Registration

The bootstrap script writes a JSON entry named **jshook** into the global Claude MCP configuration file (`~/.claude.json`). The registration structure follows this exact schema:

```json
{
  "command": "npx",
  "args": ["-y", "@jshookmcp/jshook@0.3.4"],
  "env": {
    "JSHOOK_BASE_PROFILE": "search"
  }
}

```

You can verify successful registration by inspecting the configuration:

```bash
cat ~/.claude.json | jq '.mcpServers.jshook'

```

Once registered, Claude MCP exposes the server under the namespace **jshook**, automatically routing all `js-reverse_*` primitives through this server when JavaScript hooking or CDP capabilities are required.

## Profile Configuration and Environment Variables

The `JSHOOK_BASE_PROFILE` environment variable determines which tool subsets are loaded by default. The reverse-skill framework supports three distinct profiles:

- **search** (default): Loads essential browser and debugger tools on-demand, optimized for quick inspections and single-tool operations
- **workflow**: Enables multi-tool coordination for complex automation sequences
- **full**: Activates the complete tool suite including advanced AST manipulation and network interception capabilities

To switch profiles dynamically after registration, use the boost command:

```bash
mcp__jshook__boost_profile workflow

```

Profile definitions and recommendations are documented in [`skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md) (lines 106-115).

## Activating Tools and Capabilities

After registration, activate specific tools using the MCP command pattern `mcp__jshook__<action>`. First, search for available capabilities:

```bash
mcp__jshook__search_tools browser

```

Then activate the required tools for your analysis session:

```bash
mcp__jshook__activate_tools browser_evaluate_cdp_target debugger_pause sourcemap_fetch_and_parse

```

Key tools available through `jshookmcp` include:

- `browser_evaluate_cdp_target`: Opens and controls browser pages via CDP
- `debugger_pause` and `debugger_step`: Runtime breakpoint management
- `debugger_evaluate`: Inspection of paused execution contexts
- `network_intercept`: HTTP/HTTPS request and response capture
- `sourcemap_fetch_and_parse`: De-obfuscation assistance via SourceMap analysis

These capabilities are mapped to the `js-reverse` skill primitives in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 57-64), ensuring automatic tool selection when you invoke commands mentioning "JS hook", "CDP", or "SourceMap".

## Runtime Analysis Workflow

Once configured, execute the standard reverse-engineering workflow through `jshookmcp`. The framework implements a three-stage pipeline:

**1. Observe**
Open the target application and enumerate loaded scripts:

```bash
js-reverse_new_page https://example.com
js-reverse_list_scripts

```

**2. Capture**
Set breakpoints and intercept network traffic:

```bash
js-reverse_break_on_xhr /api/secret
js-reverse_get_paused_info
js-reverse_take_screenshot

```

**3. Rebuild**
Extract and analyze source maps for de-obfuscation:

```bash
mcp__jshook__sourcemap_fetch_and_parse <script_url>

```

Under the hood, `js-reverse_new_page` invokes `browser_evaluate_cdp_target`, while `js-reverse_break_on_xhr` maps to `debugger_pause` combined with network interception filters. You do not need to prepend `mcp__jshook__` manually when using the high-level `js-reverse_*` commands—the skill automatically routes to the registered server.

## Summary

- **Install** `jshookmcp` via [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh), which calls `ensure_jshookmcp` to write the MCP server configuration to `~/.claude.json`
- **Configure** the environment using `JSHOOK_BASE_PROFILE` (default: `search`, alternatives: `workflow` or `full`) to control tool availability
- **Register** the server with command `npx -y @jshookmcp/jshook@0.3.4` and verify via JSON inspection
- **Activate** specific CDP and debugging tools using `mcp__jshook__activate_tools` before running analysis
- **Execute** the "Observe → Capture → Rebuild" workflow through `js-reverse_*` primitives that automatically route to `browser_evaluate_cdp_target`, `debugger_pause`, and `sourcemap_fetch_and_parse`

## Frequently Asked Questions

### What is the difference between the search, workflow, and full profiles?

The **search** profile loads tools on-demand and is optimized for quick inspections with minimal memory overhead. The **workflow** profile pre-loads multi-tool coordination capabilities for complex automation sequences. The **full** profile activates the entire tool suite including advanced AST analysis and persistent network interception, suitable for heavy reverse-engineering tasks requiring complete CDP access.

### How do I manually register jshookmcp without running the bootstrap script?

Add the following JSON entry to your `~/.claude.json` file under the `mcpServers` key:

```json
"jshook": {
  "command": "npx",
  "args": ["-y", "@jshookmcp/jshook@0.3.4"],
  "env": {"JSHOOK_BASE_PROFILE": "search"}
}

```

Ensure Node.js is installed and accessible in your system PATH before starting the Claude MCP client.

### Which jshookmcp tools handle JavaScript breakpoints and stack inspection?

Use `debugger_pause` to halt execution at specific locations, `debugger_step` to advance through code line-by-line, and `debugger_evaluate` to inspect variables and call stacks when paused. These tools map to the high-level commands `js-reverse_break_on_xhr` and `js-reverse_get_paused_info` in the reverse-skill framework.

### Can I use jshookmcp for network interception without setting breakpoints?

Yes. Activate the `network_intercept` tool via `mcp__jshook__activate_tools network_intercept` to capture HTTP/HTTPS requests and responses independently of the debugger. This enables passive traffic analysis while the JavaScript runtime continues execution, which is useful for mapping API endpoints before performing dynamic analysis.