How to Configure jshookmcp for JavaScript Runtime Analysis and Browser CDP Hooks

To configure jshookmcp for JavaScript runtime analysis, install the npm package @jshookmcp/jshook, register it as an MCP server in your Claude configuration with the search profile, and activate the CDP-based debugging tools to enable runtime sampling and browser hooking.

The jshookmcp server provides the zhaoxuya520/reverse-skill framework with unified browser automation, Chrome DevTools Protocol (CDP) integration, and JavaScript hooking capabilities. This guide walks through the exact configuration steps required to enable the "Observe → Capture → Rebuild" workflow for reverse engineering JavaScript applications.

Prerequisites and Package Installation

Before registering the server, ensure your environment meets the Node.js runtime requirements. The ensure_node_runtime function (called within the bootstrap process) validates that Node is available for executing the npx commands.

Install the jshookmcp package using the built-in bootstrap script located at skills/scripts/bootstrap-reverse.sh. The ensure_jshookmcp function (lines 497-500) handles the installation and registration automatically:

bash skills/scripts/bootstrap-reverse.sh jshookmcp

This command executes npx -y @jshookmcp/jshook@0.3.4 to download and cache the server binary without requiring a global npm install.

MCP Server Registration

The bootstrap script writes a JSON entry named jshook into the global Claude MCP configuration file (~/.claude.json). The registration structure follows this exact schema:

{
  "command": "npx",
  "args": ["-y", "@jshookmcp/jshook@0.3.4"],
  "env": {
    "JSHOOK_BASE_PROFILE": "search"
  }
}

You can verify successful registration by inspecting the configuration:

cat ~/.claude.json | jq '.mcpServers.jshook'

Once registered, Claude MCP exposes the server under the namespace jshook, automatically routing all js-reverse_* primitives through this server when JavaScript hooking or CDP capabilities are required.

Profile Configuration and Environment Variables

The JSHOOK_BASE_PROFILE environment variable determines which tool subsets are loaded by default. The reverse-skill framework supports three distinct profiles:

• search (default): Loads essential browser and debugger tools on-demand, optimized for quick inspections and single-tool operations
• workflow: Enables multi-tool coordination for complex automation sequences
• full: Activates the complete tool suite including advanced AST manipulation and network interception capabilities

To switch profiles dynamically after registration, use the boost command:

mcp__jshook__boost_profile workflow

Profile definitions and recommendations are documented in skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md (lines 106-115).

Activating Tools and Capabilities

After registration, activate specific tools using the MCP command pattern mcp__jshook__<action>. First, search for available capabilities:

mcp__jshook__search_tools browser

Then activate the required tools for your analysis session:

mcp__jshook__activate_tools browser_evaluate_cdp_target debugger_pause sourcemap_fetch_and_parse

Key tools available through jshookmcp include:

• browser_evaluate_cdp_target: Opens and controls browser pages via CDP
• debugger_pause and debugger_step: Runtime breakpoint management
• debugger_evaluate: Inspection of paused execution contexts
• network_intercept: HTTP/HTTPS request and response capture
• sourcemap_fetch_and_parse: De-obfuscation assistance via SourceMap analysis

These capabilities are mapped to the js-reverse skill primitives in skills/js-reverse/SKILL.md (lines 57-64), ensuring automatic tool selection when you invoke commands mentioning "JS hook", "CDP", or "SourceMap".

Runtime Analysis Workflow

Once configured, execute the standard reverse-engineering workflow through jshookmcp. The framework implements a three-stage pipeline:

1. Observe Open the target application and enumerate loaded scripts:

js-reverse_new_page https://example.com
js-reverse_list_scripts

2. Capture Set breakpoints and intercept network traffic:

js-reverse_break_on_xhr /api/secret
js-reverse_get_paused_info
js-reverse_take_screenshot

3. Rebuild Extract and analyze source maps for de-obfuscation:

mcp__jshook__sourcemap_fetch_and_parse <script_url>

Under the hood, js-reverse_new_page invokes browser_evaluate_cdp_target, while js-reverse_break_on_xhr maps to debugger_pause combined with network interception filters. You do not need to prepend mcp__jshook__ manually when using the high-level js-reverse_* commands—the skill automatically routes to the registered server.

Summary

• Install jshookmcp via skills/scripts/bootstrap-reverse.sh, which calls ensure_jshookmcp to write the MCP server configuration to ~/.claude.json
• Configure the environment using JSHOOK_BASE_PROFILE (default: search, alternatives: workflow or full) to control tool availability
• Register the server with command npx -y @jshookmcp/jshook@0.3.4 and verify via JSON inspection
• Activate specific CDP and debugging tools using mcp__jshook__activate_tools before running analysis
• Execute the "Observe → Capture → Rebuild" workflow through js-reverse_* primitives that automatically route to browser_evaluate_cdp_target, debugger_pause, and sourcemap_fetch_and_parse

Frequently Asked Questions

What is the difference between the search, workflow, and full profiles?

The search profile loads tools on-demand and is optimized for quick inspections with minimal memory overhead. The workflow profile pre-loads multi-tool coordination capabilities for complex automation sequences. The full profile activates the entire tool suite including advanced AST analysis and persistent network interception, suitable for heavy reverse-engineering tasks requiring complete CDP access.

How do I manually register jshookmcp without running the bootstrap script?

Add the following JSON entry to your ~/.claude.json file under the mcpServers key:

"jshook": {
  "command": "npx",
  "args": ["-y", "@jshookmcp/jshook@0.3.4"],
  "env": {"JSHOOK_BASE_PROFILE": "search"}
}

Ensure Node.js is installed and accessible in your system PATH before starting the Claude MCP client.

Which jshookmcp tools handle JavaScript breakpoints and stack inspection?

Use debugger_pause to halt execution at specific locations, debugger_step to advance through code line-by-line, and debugger_evaluate to inspect variables and call stacks when paused. These tools map to the high-level commands js-reverse_break_on_xhr and js-reverse_get_paused_info in the reverse-skill framework.

Can I use jshookmcp for network interception without setting breakpoints?

Yes. Activate the network_intercept tool via mcp__jshook__activate_tools network_intercept to capture HTTP/HTTPS requests and responses independently of the debugger. This enables passive traffic analysis while the JavaScript runtime continues execution, which is useful for mapping API endpoints before performing dynamic analysis.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}