How to Trace XHR/Fetch Requests to Source Using js-reverse MCP Tools

The js-reverse skill provides a complete workflow for mapping browser XHR/Fetch requests to their exact JavaScript source lines by combining a Burp MCP proxy, a WebSocket bridge, and AST analysis.

The reverse-skill repository by zhaoxuya520 offers a specialized toolkit for reverse engineering web applications. To trace XHR/Fetch requests to source using js-reverse MCP tools, you combine a traffic-capturing proxy with an AST-based analyzer that maps network activity back to specific functions and line numbers in your JavaScript codebase.

Architecture Overview

The workflow relies on three integrated components that bridge the gap between runtime network activity and static source code analysis.

Burp MCP Server

The Burp MCP Server acts as a lightweight HTTP proxy that intercepts every request the browser issues. Located in burp-mcp-full/, this component captures raw request data—including method, URL, headers, and body—before any encryption or compression is applied. According to the burp-mcp-full/README.md, the server registers listeners that forward intercepted HTTP messages to the bridge component.

MCP Bridge

The MCP Bridge (burp-mcp-full/mcp-bridge.js) creates the communication layer between the proxy and the analyzer. This script opens a WebSocket server (default ws://127.0.0.1:9000) that receives request objects from the Burp MCP Server. It enriches each request with a unique identifier and timestamp, then emits them as JSON payloads:

{
  "id": "a1b2c3",
  "url": "https://example.com/api/do",
  "method": "POST",
  "body": "...",
  "timestamp": 1722912000
}

js-reverse Analyzer

The js-reverse Analyzer resides in skills/js-reverse/ and contains the capture.js script that performs the source mapping. It loads the target page's JavaScript files, parses them using ES2022-compliant AST parsers (Esprima/Acorn), and walks the syntax tree to locate XMLHttpRequest.send or fetch calls matching the captured traffic.

Step-by-Step Workflow

Follow this reproducible sequence to trace XHR/Fetch requests from network activity to source code.

Step 1: Initialize the Tool Index

Before launching components, refresh the tool index so the MCP server is properly detected:

bash skills/scripts/refresh-tool-index.sh

Step 2: Start the MCP Proxy Server

Launch the Burp MCP server to begin intercepting browser traffic. From the repository root:

cd burp-mcp-full
./gradlew run

The server starts on port 8080 (configurable) and begins forwarding captured requests to the bridge component.

Step 3: Launch the MCP Bridge

In a separate terminal, start the WebSocket bridge that connects the proxy to the js-reverse analyzer:

node burp-mcp-full/mcp-bridge.js

The bridge listens on ws://127.0.0.1:9000 by default and awaits connections from the capture script.

Step 4: Execute the js-reverse Capture Script

Run the analyzer to begin mapping network requests to source locations:

cd skills/js-reverse
node capture.js --ws ws://127.0.0.1:9000

The capture.js script performs three operations:

• Connects to the WebSocket and listens for incoming request objects
• Loads JavaScript source files or bundles from the target application
• Searches the AST for nodes invoking XMLHttpRequest or fetch with matching URLs and HTTP methods

Step 5: Reproduce the Request

Trigger the XHR or Fetch request in your browser by navigating the application or clicking relevant UI elements. The MCP proxy captures the request, the bridge assigns it a unique ID, and the analyzer matches it against the parsed AST.

Interpreting the Results

When capture.js locates the source of a request, it outputs a stack-trace-like reference:

[a1b2c3] fetch → src/api/user.js:42:12 (function getUser)

This output format provides:

• Request ID: The unique identifier assigned by the MCP bridge (a1b2c3)
• Call Type: The API used (fetch or XMLHttpRequest)
• Source Location: File path (src/api/user.js), line number (42), and column (12)
• Function Context: The enclosing function name (getUser)

You can now open the indicated file in your IDE, set breakpoints at the specified line, or conduct deeper static analysis of the function logic.

Key Source Files and References

Understanding the repository structure helps navigate the implementation:

• burp-mcp-full/README.md: Documents the Burp MCP server configuration and proxy settings
• burp-mcp-full/mcp-bridge.js: Implements the WebSocket bridge for request forwarding
• skills/js-reverse/: Contains AST parsing logic and the capture.js entry point
• docs/ARCHITECTURE.md: Provides detailed diagrams of the reverse-skill routing pipeline
• RULES.md: Defines global routing rules governing when AI agents may perform automated actions

Summary

• js-reverse MCP tools combine a Burp proxy, WebSocket bridge, and AST analyzer to trace XHR/Fetch requests to their JavaScript source
• The MCP Bridge (mcp-bridge.js) enriches captured requests with unique IDs and forwards them via WebSocket to capture.js
• AST analysis using Esprima/Acorn parses JavaScript source files to locate exact fetch or XMLHttpRequest call sites
• Output provides file paths, line numbers, and function names for immediate debugging or security auditing
• Requires Node.js 22+, Java for the MCP server, and the refresh-tool-index.sh initialization step

Frequently Asked Questions

What is the purpose of the MCP Bridge in js-reverse?

The MCP Bridge serves as the communication intermediary between the Burp MCP proxy server and the js-reverse analyzer. It receives raw HTTP request objects from the proxy, assigns unique identifiers and timestamps to distinguish concurrent requests, and exposes them via WebSocket for the capture.js script to consume without polling.

How does js-reverse handle minified or bundled JavaScript?

The js-reverse analyzer loads JavaScript source files or bundles and parses them using ES2022-compliant AST parsers like Esprima or Acorn. While the raw analysis focuses on locating fetch and XMLHttpRequest calls, the AST-based approach works against minified code by analyzing the syntax tree structure rather than relying on fragile string matching, allowing it to map network calls back to specific lines even in bundled applications.

Can js-reverse trace requests that use custom wrappers around fetch?

Yes, because the analyzer performs AST walking to locate the actual fetch or XMLHttpRequest.send calls that execute at runtime. Even if your application uses custom wrapper functions or abstraction layers, the analyzer identifies the underlying native API calls that generate the network traffic, tracing back to the specific invocation site in your wrapper or utility functions.

What ports does the js-reverse MCP workflow use by default?

The Burp MCP server typically listens on port 8080 for HTTP proxy traffic, while the MCP Bridge (mcp-bridge.js) opens a WebSocket server on ws://127.0.0.1:9000. You can configure these endpoints when launching the respective components, but these defaults are documented in burp-mcp-full/README.md and the capture.js help output.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}