jshookmcp vs anything-analyzer: Choosing the Right MCP Server for JavaScript and Browser Analysis

jshookmcp specializes in runtime JavaScript analysis through CDP, AST, and hooking, while anything-analyzer focuses on browser automation and HTTP traffic capture and replay.

The reverse-skill framework provides two distinct MCP (Modular Capability Provider) servers for JavaScript and browser security analysis. Both serve complementary purposes but target different investigative layers—understanding their capabilities ensures you select the appropriate tool for your reverse-engineering workflow.

Core Architectural Differences

The fundamental split lies in what layer of the browser stack each server controls:

• jshookmcp — Operates at the JavaScript runtime and debugging protocol layer
• anything-analyzer — Operates at the browser automation and network traffic layer

This distinction determines which type of analysis task each server handles best.

jshookmcp: Runtime JavaScript Analysis

jshookmcp is purpose-built for deep code inspection during live execution. As documented in skills/js-reverse/SKILL.md (lines 57-63), this server activates automatically when the js-reverse skill chain requires capabilities beyond basic static analysis.

Key Capabilities

• Chrome DevTools Protocol (CDP) interaction — Direct debugging protocol access
• JavaScript hooking and instrumentation — Runtime function interception
• Network interception at the JS level — API call monitoring
• SourceMap reconstruction — De-minification and original source recovery
• AST (Abstract Syntax Tree) analysis — Structural code de-obfuscation
• WASM reverse-engineering — WebAssembly binary analysis
• Frida integration — Native code hooking support

The server exposes 134+ curated tools across 36 domains, indexed in skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md.

Installation and Activation

# Register and enable jshookmcp via bootstrap

powershell -File "skills/scripts/bootstrap-reverse.ps1" -Capability @('jshookmcp')

The package requires @jshookmcp/jshook@0.3.4 installed via npx:

npx -y @jshookmcp/jshook@0.3.4

Typical Invocation Pattern

# Execute JS hook on a target script

mcp__jshook__js-hook --url "https://example.com/obfuscated.js"

Use jshookmcp when you need breakpoint setting, execution tracing, dynamic code generation inspection, or AST-driven de-obfuscation.

anything-analyzer: Browser Automation and HTTP Analysis

anything-analyzer handles UI-driven operations and network traffic management. Unlike jshookmcp's code-centric approach, this server manages browser behavior and captures the resulting HTTP communication.

Key Capabilities

• Browser automation — Clicks, navigation, form filling, session management
• HTTP request/response capture — Full traffic logging with replay support
• Traffic replay against servers — Request mutation and re-execution
• AI-assisted traffic analysis — Automated parameter extraction and pattern identification

The server runs as a local HTTP service on port 23816, making it discoverable by other framework components without additional configuration.

Installation and Startup

# Launch anything-analyzer service via bootstrap

powershell -File "skills/scripts/bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices

Requires local repository clone with Node.js dependencies:

pnpm install

Typical Usage Patterns

Launch a monitored browser session:

# Open browser through the MCP proxy

mcp__anything-analyzer__launch-browser --url "https://target-application.com"

Replay captured requests for testing or analysis:

# Re-execute a previously recorded request

mcp__anything-analyzer__replay-request --id "req-12345"

Use anything-analyzer when you need harvesting requests from web applications, replaying traffic against APIs, or feeding captured data to AI models for inspection.

Side-by-Side Comparison

Factor	jshookmcp	anything-analyzer
Primary domain	JavaScript runtime internals	Browser automation and networking
Core technologies	CDP, AST, SourceMap, WASM, Frida	HTTP proxy, browser control, AI pipelines
Tool inventory	134+ tools across 36 domains	Focused capture/replay/AI stack
Activation trigger	js-reverse skill chain automatically	Explicit bootstrap or direct call
Service endpoint	MCP protocol integration	Local HTTP on port 23816
Ideal for	Malicious script tracing, de-obfuscation, dynamic analysis	Request harvesting, replay testing, traffic AI analysis

Integration Within reverse-skill Framework

According to RULES.md and platform documentation in docs/platforms/linux.md and docs/platforms/macos.md, both servers follow consistent bootstrap patterns but serve different skill chains.

The js-reverse skill automatically surface-switches to jshookmcp when detecting requirements for:

• Runtime sampling capabilities
• CDP-dependent operations
• Hook-based instrumentation

anything-analyzer operates as a standalone service that multiple skills can reference, including browser-automation and http-replay workflows.

When to Use Both Together

Complex web application investigations often require both servers operating in sequence:

1. anything-analyzer captures the initial traffic and identifies interesting endpoints
2. jshookmcp drills into the JavaScript delivering those endpoints, analyzing obfuscation and runtime behavior
3. anything-analyzer replays modified requests based on insights from jshookmcp analysis

This combined approach provides complete coverage from network behavior through code execution, as designed into the reverse-skill platform architecture per README_AI.md (Q4 section).

Summary

• jshookmcp = runtime JavaScript analysis via CDP, AST, hooking, and WASM tools—activate for code-level reverse engineering
• anything-analyzer = browser automation and HTTP capture/replay—activate for network traffic analysis and UI-driven testing
• Both install via bootstrap-reverse.ps1 but require different prerequisites (npm package vs. local clone)
• The js-reverse skill auto-invokes jshookmcp; anything-analyzer requires explicit service startup on port 23816
• Combined usage provides full-spectrum front-end security analysis within the reverse-skill framework

Frequently Asked Questions

Can I use jshookmcp and anything-analyzer together in the same investigation?

Yes. The reverse-skill framework is architected for complementary MCP usage. Start with anything-analyzer to capture traffic and identify target scripts, then switch to jshookmcp for deep JavaScript analysis. The bootstrap script supports multiple capabilities: powershell -File "skills/scripts/bootstrap-reverse.ps1" -Capability @('jshookmcp','anything-analyzer').

Why does jshookmcp require npx installation while anything-analyzer needs a local clone?

jshookmcp distributes its 134+ tools as a versioned npm package (@jshookmcp/jshook@0.3.4) for centralized updates. anything-analyzer runs as a persistent local HTTP service with custom configuration, making a repository clone with pnpm install necessary for dependency management and service customization.

Which MCP should I choose for analyzing obfuscated malware?

Use jshookmcp. Its AST analysis, SourceMap reconstruction, and runtime hooking capabilities directly target obfuscation techniques. anything-analyzer lacks code-level inspection tools and cannot perform de-obfuscation or dynamic analysis of JavaScript execution.

How does the js-reverse skill know when to activate jshookmcp?

The skill chain in skills/js-reverse/SKILL.md (lines 57-63) defines capability requirements that trigger automatic surface switching. When operations require CDP access, hooking, or AST traversal—capabilities only jshookmcp provides—the framework routes calls to that MCP server transparently.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}