How to Use jshookmcp for Browser CDP Debugging and JavaScript Source Interception

jshookmcp is an MCP server that bundles Chrome DevTools Protocol debugging, network interception, and JavaScript hooking into a single command-line service for reverse engineering.

The jshookmcp tool provides a unified interface for browser automation and front-end reverse engineering within the zhaoxuya520/reverse-skill repository. It wraps Chrome DevTools Protocol (CDP) capabilities into a Modular Capability Protocol (MCP) server, allowing you to debug pages, intercept network traffic, and reconstruct original JavaScript sources using standardized command-line tools.

What is jshookmcp?

jshookmcp is an MCP (Modular Capability Protocol) server that exposes browser automation, CDP debugging, network interception, and JavaScript-hooking capabilities through a standardized command interface. Unlike raw CDP implementations that require manual Node.js module management, jshookmcp installs via a single npx command and organizes functionality into three built-in profiles: search, workflow, and full.

The server registers itself in the reverse-skill ecosystem through skills/tool-index.md.template (line 45) and integrates with the routing system described in skills/routing.md (lines 79-84). When activated, all tools follow the naming convention mcp__jshook__<tool_name>, making them discoverable alongside other MCP servers like reqable-mcp or anything-analyzer.

Bootstrap and Server Provisioning

Provisioning the server requires running the bootstrap script located at skills/scripts/bootstrap-reverse.sh. The function ensure_jshookmcp() (lines 497-503) handles the installation automatically.

# One-time bootstrap per environment

bash skills/scripts/bootstrap-reverse.sh jshookmcp

This expands internally to:

npx -y @jshookmcp/jshook@0.3.4

The bootstrap process writes an MCP server definition JSON via write_mcp_server "jshook" …, registering the capability without requiring a permanent background process. The server starts on-demand when you invoke any mcp__jshook__ prefixed command.

Activating and Discovering Tools

jshookmcp uses a profile-based loading system controlled by the JSHOOK_BASE_PROFILE environment variable. The default search profile loads only lightweight tools, keeping memory footprint minimal. Activate specific tools before use through the following workflow:

# 1. Search for relevant CDP tools (BM25-style keyword search)

mcp__jshook__search_tools browser

# 2. Activate specific tools for your session

mcp__jshook__activate_tools \
    mcp__jshook__browser_evaluate_cdp_target \
    mcp__jshook__network_intercept \
    mcp__jshook__debugger_pause

For cross-domain collaboration, use mcp__jshook__activate_domain <domain_name> to activate entire tool domains at once. Switch profiles dynamically using mcp__jshook__boost_profile <profile> if you need the full toolset (full profile) rather than the lightweight default.

Browser CDP Debugging with jshookmcp

Open CDP sessions and control execution flow using the browser evaluation and debugger tools. These map directly to Chrome DevTools Protocol commands but expose unified CLI interfaces.

# Open a page and inject a breakpoint before any script executes

mcp__jshook__browser_evaluate_cdp_target \
    --url https://example.com \
    --preload "debugger;"

# When execution pauses, control the debugger

mcp__jshook__debugger_pause       # Pause current execution

mcp__jshook__debugger_step        # Step over/next line

mcp__jshook__get_call_stack       # Retrieve current JavaScript call stack

The browser_evaluate_cdp_target tool combines navigation, target attachment, and script evaluation into a single atomic operation, eliminating the need to manage CDP sessions manually.

JavaScript Source Interception and Hooking

Intercept function calls and network traffic to analyze runtime behavior. The hook tools wrap sensitive functions like eval or atob, capturing arguments and return values to the MCP server for analysis.

# Inject a hook preset for eval() to capture all calls

mcp__jshook__hook_preset \
    --function eval \
    --log-file ./eval-calls.log

# Start network interception for all HTTP requests

mcp__jshook__network_intercept --output ./network.log

# Replay a modified request based on captured ID

mcp__jshook__network_replay_request \
    --request-id 42 \
    --method POST \
    --body '{"payload":"tampered"}'

Captured data streams to the client for immediate analysis or persists to trace files for offline examination. The page_inject_script tool allows custom wrapper injection around any function defined in the target page's scope.

Reconstructing Original Sources from Minified Code

jshookmcp includes built-in source map handling to reverse minification without external tooling. Fetch source maps directly from CDP sessions and reconstruct the original file tree.

# Fetch and parse the source map

mcp__jshook__sourcemap_fetch_and_parse \
    --url https://example.com/static/app.min.js.map \
    --output ./sourcemap.json

# Reconstruct readable source files from the map

mcp__jshook__sourcemap_reconstruct_tree \
    --map ./sourcemap.json \
    --dest ./original-src/

This workflow executes entirely within the MCP server context, maintaining the unified mcp__jshook__ command namespace throughout the reconstruction process.

Summary

• jshookmcp installs via npx -y @jshookmcp/jshook@0.3.4 and registers through ensure_jshookmcp() in skills/scripts/bootstrap-reverse.sh.
• Tools follow the naming pattern mcp__jshook__<tool_name> and must be activated before use via mcp__jshook__activate_tools.
• Three profiles (search, workflow, full) control memory footprint, with JSHOOK_BASE_PROFILE selecting the active set.
• CDP debugging combines navigation and evaluation in mcp__jshook__browser_evaluate_cdp_target, with separate controls for pausing, stepping, and stack inspection.
• JavaScript hooking captures function arguments and network traffic without modifying the target site permanently.
• Source map reconstruction tools rebuild original sources from minified bundles using mcp__jshook__sourcemap_reconstruct_tree.

Frequently Asked Questions

How does jshookmcp differ from using raw Chrome DevTools Protocol?

jshookmcp provides one-command installation via npx, profile-based tool loading, and unified MCP naming that works across other servers in the reverse-skill ecosystem. Raw CDP requires manual Node.js module management and lacks built-in source-map reconstruction or cross-domain collaboration features available through mcp__jshook__activate_domain.

What profile should I use for basic CDP debugging?

Use the default search profile for basic tasks, as it loads only lightweight tools and minimizes memory usage. Switch to the full profile using mcp__jshook__boost_profile full only when you need advanced capabilities like comprehensive source-map reconstruction or complex network interception chains.

Can I activate multiple jshookmcp tools at once?

Yes. Use mcp__jshook__activate_tools followed by multiple tool names, or activate entire domains with mcp__jshook__activate_domain <domain>. This is required before invoking any tool, as the server only loads requested capabilities into the active session to maintain performance.

Where is the complete list of jshookmcp tools documented?

The exhaustive reference is located at skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md in the repository. This file enumerates every mcp__jshook__* command, its parameters, and the specific playbooks where each tool is utilized, serving as the authoritative source for tool discovery.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}