# jshookmcp vs anything-analyzer: Choosing the Right MCP Server for JavaScript and Browser Analysis

> jshookmcp offers runtime JS analysis via CDP AST and hooking. Anything-analyzer excels at browser automation HTTP capture and replay. Choose the right MCP server for your JS analysis needs.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: comparison
- Published: 2026-08-16

---

**jshookmcp specializes in runtime JavaScript analysis through CDP, AST, and hooking, while anything-analyzer focuses on browser automation and HTTP traffic capture and replay.**

The reverse-skill framework provides two distinct MCP (Modular Capability Provider) servers for JavaScript and browser security analysis. Both serve complementary purposes but target different investigative layers—understanding their capabilities ensures you select the appropriate tool for your reverse-engineering workflow.

## Core Architectural Differences

The fundamental split lies in **what layer of the browser stack each server controls**:

- **jshookmcp** — Operates at the **JavaScript runtime and debugging protocol layer**
- **anything-analyzer** — Operates at the **browser automation and network traffic layer**

This distinction determines which type of analysis task each server handles best.

## jshookmcp: Runtime JavaScript Analysis

jshookmcp is purpose-built for **deep code inspection** during live execution. As documented in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 57-63), this server activates automatically when the `js-reverse` skill chain requires capabilities beyond basic static analysis.

### Key Capabilities

- **Chrome DevTools Protocol (CDP) interaction** — Direct debugging protocol access
- **JavaScript hooking and instrumentation** — Runtime function interception
- **Network interception at the JS level** — API call monitoring
- **SourceMap reconstruction** — De-minification and original source recovery
- **AST (Abstract Syntax Tree) analysis** — Structural code de-obfuscation
- **WASM reverse-engineering** — WebAssembly binary analysis
- **Frida integration** — Native code hooking support

The server exposes **134+ curated tools across 36 domains**, indexed in [`skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md).

### Installation and Activation

```powershell

# Register and enable jshookmcp via bootstrap

powershell -File "skills/scripts/bootstrap-reverse.ps1" -Capability @('jshookmcp')

```

The package requires `@jshookmcp/jshook@0.3.4` installed via npx:

```bash
npx -y @jshookmcp/jshook@0.3.4

```

### Typical Invocation Pattern

```powershell

# Execute JS hook on a target script

mcp__jshook__js-hook --url "https://example.com/obfuscated.js"

```

Use jshookmcp when you need **breakpoint setting, execution tracing, dynamic code generation inspection, or AST-driven de-obfuscation**.

## anything-analyzer: Browser Automation and HTTP Analysis

anything-analyzer handles **UI-driven operations and network traffic management**. Unlike jshookmcp's code-centric approach, this server manages browser behavior and captures the resulting HTTP communication.

### Key Capabilities

- **Browser automation** — Clicks, navigation, form filling, session management
- **HTTP request/response capture** — Full traffic logging with replay support
- **Traffic replay against servers** — Request mutation and re-execution
- **AI-assisted traffic analysis** — Automated parameter extraction and pattern identification

The server runs as a **local HTTP service on port 23816**, making it discoverable by other framework components without additional configuration.

### Installation and Startup

```powershell

# Launch anything-analyzer service via bootstrap

powershell -File "skills/scripts/bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices

```

Requires local repository clone with Node.js dependencies:

```bash
pnpm install

```

### Typical Usage Patterns

Launch a monitored browser session:

```powershell

# Open browser through the MCP proxy

mcp__anything-analyzer__launch-browser --url "https://target-application.com"

```

Replay captured requests for testing or analysis:

```powershell

# Re-execute a previously recorded request

mcp__anything-analyzer__replay-request --id "req-12345"

```

Use anything-analyzer when you need **harvesting requests from web applications, replaying traffic against APIs, or feeding captured data to AI models for inspection**.

## Side-by-Side Comparison

| Factor | jshookmcp | anything-analyzer |
|--------|-----------|-------------------|
| **Primary domain** | JavaScript runtime internals | Browser automation and networking |
| **Core technologies** | CDP, AST, SourceMap, WASM, Frida | HTTP proxy, browser control, AI pipelines |
| **Tool inventory** | 134+ tools across 36 domains | Focused capture/replay/AI stack |
| **Activation trigger** | `js-reverse` skill chain automatically | Explicit bootstrap or direct call |
| **Service endpoint** | MCP protocol integration | Local HTTP on port 23816 |
| **Ideal for** | Malicious script tracing, de-obfuscation, dynamic analysis | Request harvesting, replay testing, traffic AI analysis |

## Integration Within reverse-skill Framework

According to [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and platform documentation in [`docs/platforms/linux.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md) and [`docs/platforms/macos.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md), both servers follow consistent bootstrap patterns but serve different skill chains.

The `js-reverse` skill automatically **surface-switches** to jshookmcp when detecting requirements for:

- Runtime sampling capabilities
- CDP-dependent operations
- Hook-based instrumentation

anything-analyzer operates as a **standalone service** that multiple skills can reference, including `browser-automation` and `http-replay` workflows.

## When to Use Both Together

Complex web application investigations often require **both servers operating in sequence**:

1. **anything-analyzer** captures the initial traffic and identifies interesting endpoints
2. **jshookmcp** drills into the JavaScript delivering those endpoints, analyzing obfuscation and runtime behavior
3. **anything-analyzer** replays modified requests based on insights from jshookmcp analysis

This combined approach provides **complete coverage** from network behavior through code execution, as designed into the reverse-skill platform architecture per [`README_AI.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md) (Q4 section).

## Summary

- **jshookmcp** = runtime JavaScript analysis via CDP, AST, hooking, and WASM tools—activate for code-level reverse engineering
- **anything-analyzer** = browser automation and HTTP capture/replay—activate for network traffic analysis and UI-driven testing
- Both install via `bootstrap-reverse.ps1` but require different prerequisites (npm package vs. local clone)
- The `js-reverse` skill auto-invokes jshookmcp; anything-analyzer requires explicit service startup on port 23816
- Combined usage provides full-spectrum front-end security analysis within the reverse-skill framework

## Frequently Asked Questions

### Can I use jshookmcp and anything-analyzer together in the same investigation?

Yes. The reverse-skill framework is architected for **complementary MCP usage**. Start with anything-analyzer to capture traffic and identify target scripts, then switch to jshookmcp for deep JavaScript analysis. The bootstrap script supports multiple capabilities: `powershell -File "skills/scripts/bootstrap-reverse.ps1" -Capability @('jshookmcp','anything-analyzer')`.

### Why does jshookmcp require npx installation while anything-analyzer needs a local clone?

**jshookmcp** distributes its 134+ tools as a versioned npm package (`@jshookmcp/jshook@0.3.4`) for centralized updates. **anything-analyzer** runs as a persistent local HTTP service with custom configuration, making a repository clone with `pnpm install` necessary for dependency management and service customization.

### Which MCP should I choose for analyzing obfuscated malware?

Use **jshookmcp**. Its AST analysis, SourceMap reconstruction, and runtime hooking capabilities directly target obfuscation techniques. anything-analyzer lacks code-level inspection tools and cannot perform de-obfuscation or dynamic analysis of JavaScript execution.

### How does the `js-reverse` skill know when to activate jshookmcp?

The skill chain in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 57-63) defines **capability requirements** that trigger automatic surface switching. When operations require CDP access, hooking, or AST traversal—capabilities only jshookmcp provides—the framework routes calls to that MCP server transparently.