# How to Use jshookmcp for Browser CDP Debugging and JavaScript Source Interception

> Master browser CDP debugging and JavaScript source interception with jshookmcp. This powerful tool streamlines reverse engineering with integrated debugging, network interception, and JS hooking.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-07

---

**jshookmcp is an MCP server that bundles Chrome DevTools Protocol debugging, network interception, and JavaScript hooking into a single command-line service for reverse engineering.**

The `jshookmcp` tool provides a unified interface for browser automation and front-end reverse engineering within the `zhaoxuya520/reverse-skill` repository. It wraps Chrome DevTools Protocol (CDP) capabilities into a Modular Capability Protocol (MCP) server, allowing you to debug pages, intercept network traffic, and reconstruct original JavaScript sources using standardized command-line tools.

## What is jshookmcp?

**jshookmcp** is an MCP (Modular Capability Protocol) server that exposes browser automation, CDP debugging, network interception, and JavaScript-hooking capabilities through a standardized command interface. Unlike raw CDP implementations that require manual Node.js module management, `jshookmcp` installs via a single `npx` command and organizes functionality into three built-in profiles: `search`, `workflow`, and `full`.

The server registers itself in the reverse-skill ecosystem through `skills/tool-index.md.template` (line 45) and integrates with the routing system described in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) (lines 79-84). When activated, all tools follow the naming convention `mcp__jshook__<tool_name>`, making them discoverable alongside other MCP servers like `reqable-mcp` or `anything-analyzer`.

## Bootstrap and Server Provisioning

Provisioning the server requires running the bootstrap script located at [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh). The function `ensure_jshookmcp()` (lines 497-503) handles the installation automatically.

```bash

# One-time bootstrap per environment

bash skills/scripts/bootstrap-reverse.sh jshookmcp

```

This expands internally to:

```bash
npx -y @jshookmcp/jshook@0.3.4

```

The bootstrap process writes an MCP server definition JSON via `write_mcp_server "jshook" …`, registering the capability without requiring a permanent background process. The server starts on-demand when you invoke any `mcp__jshook__` prefixed command.

## Activating and Discovering Tools

**jshookmcp** uses a profile-based loading system controlled by the `JSHOOK_BASE_PROFILE` environment variable. The default `search` profile loads only lightweight tools, keeping memory footprint minimal. Activate specific tools before use through the following workflow:

```bash

# 1. Search for relevant CDP tools (BM25-style keyword search)

mcp__jshook__search_tools browser

# 2. Activate specific tools for your session

mcp__jshook__activate_tools \
    mcp__jshook__browser_evaluate_cdp_target \
    mcp__jshook__network_intercept \
    mcp__jshook__debugger_pause

```

For cross-domain collaboration, use `mcp__jshook__activate_domain <domain_name>` to activate entire tool domains at once. Switch profiles dynamically using `mcp__jshook__boost_profile <profile>` if you need the full toolset (`full` profile) rather than the lightweight default.

## Browser CDP Debugging with jshookmcp

Open CDP sessions and control execution flow using the browser evaluation and debugger tools. These map directly to Chrome DevTools Protocol commands but expose unified CLI interfaces.

```bash

# Open a page and inject a breakpoint before any script executes

mcp__jshook__browser_evaluate_cdp_target \
    --url https://example.com \
    --preload "debugger;"

# When execution pauses, control the debugger

mcp__jshook__debugger_pause       # Pause current execution

mcp__jshook__debugger_step        # Step over/next line

mcp__jshook__get_call_stack       # Retrieve current JavaScript call stack

```

The `browser_evaluate_cdp_target` tool combines navigation, target attachment, and script evaluation into a single atomic operation, eliminating the need to manage CDP sessions manually.

## JavaScript Source Interception and Hooking

Intercept function calls and network traffic to analyze runtime behavior. The hook tools wrap sensitive functions like `eval` or `atob`, capturing arguments and return values to the MCP server for analysis.

```bash

# Inject a hook preset for eval() to capture all calls

mcp__jshook__hook_preset \
    --function eval \
    --log-file ./eval-calls.log

# Start network interception for all HTTP requests

mcp__jshook__network_intercept --output ./network.log

# Replay a modified request based on captured ID

mcp__jshook__network_replay_request \
    --request-id 42 \
    --method POST \
    --body '{"payload":"tampered"}'

```

Captured data streams to the client for immediate analysis or persists to trace files for offline examination. The `page_inject_script` tool allows custom wrapper injection around any function defined in the target page's scope.

## Reconstructing Original Sources from Minified Code

**jshookmcp** includes built-in source map handling to reverse minification without external tooling. Fetch source maps directly from CDP sessions and reconstruct the original file tree.

```bash

# Fetch and parse the source map

mcp__jshook__sourcemap_fetch_and_parse \
    --url https://example.com/static/app.min.js.map \
    --output ./sourcemap.json

# Reconstruct readable source files from the map

mcp__jshook__sourcemap_reconstruct_tree \
    --map ./sourcemap.json \
    --dest ./original-src/

```

This workflow executes entirely within the MCP server context, maintaining the unified `mcp__jshook__` command namespace throughout the reconstruction process.

## Summary

- **jshookmcp** installs via `npx -y @jshookmcp/jshook@0.3.4` and registers through `ensure_jshookmcp()` in [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh).
- Tools follow the naming pattern `mcp__jshook__<tool_name>` and must be activated before use via `mcp__jshook__activate_tools`.
- Three profiles (`search`, `workflow`, `full`) control memory footprint, with `JSHOOK_BASE_PROFILE` selecting the active set.
- CDP debugging combines navigation and evaluation in `mcp__jshook__browser_evaluate_cdp_target`, with separate controls for pausing, stepping, and stack inspection.
- JavaScript hooking captures function arguments and network traffic without modifying the target site permanently.
- Source map reconstruction tools rebuild original sources from minified bundles using `mcp__jshook__sourcemap_reconstruct_tree`.

## Frequently Asked Questions

### How does jshookmcp differ from using raw Chrome DevTools Protocol?

**jshookmcp** provides one-command installation via `npx`, profile-based tool loading, and unified MCP naming that works across other servers in the reverse-skill ecosystem. Raw CDP requires manual Node.js module management and lacks built-in source-map reconstruction or cross-domain collaboration features available through `mcp__jshook__activate_domain`.

### What profile should I use for basic CDP debugging?

Use the default `search` profile for basic tasks, as it loads only lightweight tools and minimizes memory usage. Switch to the `full` profile using `mcp__jshook__boost_profile full` only when you need advanced capabilities like comprehensive source-map reconstruction or complex network interception chains.

### Can I activate multiple jshookmcp tools at once?

Yes. Use `mcp__jshook__activate_tools` followed by multiple tool names, or activate entire domains with `mcp__jshook__activate_domain <domain>`. This is required before invoking any tool, as the server only loads requested capabilities into the active session to maintain performance.

### Where is the complete list of jshookmcp tools documented?

The exhaustive reference is located at [`skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md) in the repository. This file enumerates every `mcp__jshook__*` command, its parameters, and the specific playbooks where each tool is utilized, serving as the authoritative source for tool discovery.