# How to Trace XHR/Fetch Requests to Source Using js-reverse MCP Tools

> Trace XHR Fetch requests to source code with js-reverse MCP tools. Learn how to map browser requests to JavaScript lines using Burp proxy, WebSocket, and AST analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-02

---

**The js-reverse skill provides a complete workflow for mapping browser XHR/Fetch requests to their exact JavaScript source lines by combining a Burp MCP proxy, a WebSocket bridge, and AST analysis.**

The `reverse-skill` repository by zhaoxuya520 offers a specialized toolkit for reverse engineering web applications. To trace XHR/Fetch requests to source using js-reverse MCP tools, you combine a traffic-capturing proxy with an AST-based analyzer that maps network activity back to specific functions and line numbers in your JavaScript codebase.

## Architecture Overview

The workflow relies on three integrated components that bridge the gap between runtime network activity and static source code analysis.

### Burp MCP Server

The **Burp MCP Server** acts as a lightweight HTTP proxy that intercepts every request the browser issues. Located in `burp-mcp-full/`, this component captures raw request data—including method, URL, headers, and body—before any encryption or compression is applied. According to the [`burp-mcp-full/README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/README.md), the server registers listeners that forward intercepted HTTP messages to the bridge component.

### MCP Bridge

The **MCP Bridge** ([`burp-mcp-full/mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/mcp-bridge.js)) creates the communication layer between the proxy and the analyzer. This script opens a WebSocket server (default `ws://127.0.0.1:9000`) that receives request objects from the Burp MCP Server. It enriches each request with a unique identifier and timestamp, then emits them as JSON payloads:

```json
{
  "id": "a1b2c3",
  "url": "https://example.com/api/do",
  "method": "POST",
  "body": "...",
  "timestamp": 1722912000
}

```

### js-reverse Analyzer

The **js-reverse Analyzer** resides in `skills/js-reverse/` and contains the [`capture.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/capture.js) script that performs the source mapping. It loads the target page's JavaScript files, parses them using ES2022-compliant AST parsers (Esprima/Acorn), and walks the syntax tree to locate `XMLHttpRequest.send` or `fetch` calls matching the captured traffic.

## Step-by-Step Workflow

Follow this reproducible sequence to trace XHR/Fetch requests from network activity to source code.

### Step 1: Initialize the Tool Index

Before launching components, refresh the tool index so the MCP server is properly detected:

```bash
bash skills/scripts/refresh-tool-index.sh

```

### Step 2: Start the MCP Proxy Server

Launch the Burp MCP server to begin intercepting browser traffic. From the repository root:

```bash
cd burp-mcp-full
./gradlew run

```

The server starts on port `8080` (configurable) and begins forwarding captured requests to the bridge component.

### Step 3: Launch the MCP Bridge

In a separate terminal, start the WebSocket bridge that connects the proxy to the js-reverse analyzer:

```bash
node burp-mcp-full/mcp-bridge.js

```

The bridge listens on `ws://127.0.0.1:9000` by default and awaits connections from the capture script.

### Step 4: Execute the js-reverse Capture Script

Run the analyzer to begin mapping network requests to source locations:

```bash
cd skills/js-reverse
node capture.js --ws ws://127.0.0.1:9000

```

The [`capture.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/capture.js) script performs three operations:

- Connects to the WebSocket and listens for incoming request objects
- Loads JavaScript source files or bundles from the target application
- Searches the AST for nodes invoking `XMLHttpRequest` or `fetch` with matching URLs and HTTP methods

### Step 5: Reproduce the Request

Trigger the XHR or Fetch request in your browser by navigating the application or clicking relevant UI elements. The MCP proxy captures the request, the bridge assigns it a unique ID, and the analyzer matches it against the parsed AST.

## Interpreting the Results

When [`capture.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/capture.js) locates the source of a request, it outputs a stack-trace-like reference:

```

[a1b2c3] fetch → src/api/user.js:42:12 (function getUser)

```

This output format provides:

- **Request ID**: The unique identifier assigned by the MCP bridge (`a1b2c3`)
- **Call Type**: The API used (`fetch` or `XMLHttpRequest`)
- **Source Location**: File path ([`src/api/user.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/src/api/user.js)), line number (`42`), and column (`12`)
- **Function Context**: The enclosing function name (`getUser`)

You can now open the indicated file in your IDE, set breakpoints at the specified line, or conduct deeper static analysis of the function logic.

## Key Source Files and References

Understanding the repository structure helps navigate the implementation:

- **[`burp-mcp-full/README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/README.md)**: Documents the Burp MCP server configuration and proxy settings
- **[`burp-mcp-full/mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/mcp-bridge.js)**: Implements the WebSocket bridge for request forwarding
- **`skills/js-reverse/`**: Contains AST parsing logic and the [`capture.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/capture.js) entry point
- **[`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md)**: Provides detailed diagrams of the reverse-skill routing pipeline
- **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)**: Defines global routing rules governing when AI agents may perform automated actions

## Summary

- **js-reverse MCP tools** combine a Burp proxy, WebSocket bridge, and AST analyzer to trace XHR/Fetch requests to their JavaScript source
- The **MCP Bridge** ([`mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/mcp-bridge.js)) enriches captured requests with unique IDs and forwards them via WebSocket to [`capture.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/capture.js)
- **AST analysis** using Esprima/Acorn parses JavaScript source files to locate exact `fetch` or `XMLHttpRequest` call sites
- Output provides **file paths, line numbers, and function names** for immediate debugging or security auditing
- Requires **Node.js 22+**, Java for the MCP server, and the [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) initialization step

## Frequently Asked Questions

### What is the purpose of the MCP Bridge in js-reverse?

The MCP Bridge serves as the communication intermediary between the Burp MCP proxy server and the js-reverse analyzer. It receives raw HTTP request objects from the proxy, assigns unique identifiers and timestamps to distinguish concurrent requests, and exposes them via WebSocket for the [`capture.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/capture.js) script to consume without polling.

### How does js-reverse handle minified or bundled JavaScript?

The js-reverse analyzer loads JavaScript source files or bundles and parses them using ES2022-compliant AST parsers like Esprima or Acorn. While the raw analysis focuses on locating `fetch` and `XMLHttpRequest` calls, the AST-based approach works against minified code by analyzing the syntax tree structure rather than relying on fragile string matching, allowing it to map network calls back to specific lines even in bundled applications.

### Can js-reverse trace requests that use custom wrappers around fetch?

Yes, because the analyzer performs AST walking to locate the actual `fetch` or `XMLHttpRequest.send` calls that execute at runtime. Even if your application uses custom wrapper functions or abstraction layers, the analyzer identifies the underlying native API calls that generate the network traffic, tracing back to the specific invocation site in your wrapper or utility functions.

### What ports does the js-reverse MCP workflow use by default?

The Burp MCP server typically listens on port `8080` for HTTP proxy traffic, while the MCP Bridge ([`mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/mcp-bridge.js)) opens a WebSocket server on `ws://127.0.0.1:9000`. You can configure these endpoints when launching the respective components, but these defaults are documented in [`burp-mcp-full/README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/README.md) and the [`capture.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/capture.js) help output.