What makes jshook different

Most MCP servers for JS analysis expose a handful of hand-rolled tools or wrap a single browser engine. jshook is closer to an operating system for front-end reverse engineering — 36 self-discovered domains, a search-first meta-tool that keeps token cost under control, and runtime recovery that survives broken pages and dropped sessions:

• Search-first, profile-aware. The search profile loads about 3K tokens of tool metadata; the full profile exposes all 735 tools at around 109K tokens (measured 2026-10-10 — this figure scales with the tool count, so re-measure it when the catalog grows). Agents move between them as the task grows — search → workflow → full — instead of drowning in schemas from the first turn.
• Runtime recovery and session isolation. Streamable HTTP sessions restore activated domains, browser attach state, and coverage state after reconnects; per-client browser-side state stays isolated so two agents cannot trample each other's CDP sessions.
• Full-stack browser automation. Chromium and Camoufox via CDP with anti-detection, an explicit-input CAPTCHA solver (no built-in page/feature probing), a self-signed HTTPS interception CA on demand, and HTTP/2 frame building.
• Real reverse engineering, not string searches. WASM disassembly via wabt (wasm2wat / wasm-decompile / wasm-objdump), Frida/Ghidra/IDA bridges, native FFI scanning, hardware breakpoints, PE introspection, GraphQL/Burp Suite proxy bridges, and AST transforms — not a single regex call wrapped as a tool.
• Dynamic extensibility. Hot-reload plugins, declarative workflows, and auto-discovery keep the server growing without a redeploy.

---

Capability overview

A scan of what's in the box. Each row links to the detailed Capability overview below.

Area	Highlights
Tool profiles	search (~3K tokens, BM25 + hybrid vector ranking) · workflow (composite scripts) · full (all 735 tools)
Browser automation	Chromium and Camoufox · CDP attach to existing targets · anti-detection presets · explicit-input CAPTCHA solver · popup, download, permission, and protocol interceptors
Network interception	HTTP/1.1 + HTTP/2 frame building · MITM proxy with auto-generated CA · WebSocket capture · GraphQL introspection helpers · Burp Suite bridge
JS hooks and analysis	LLM-powered deobfuscation · crypto routine detection · AST comprehension · source-map reconstruction · script/scriptlet extraction and replay
WASM reverse engineering	wabt disassembly / C transpilation (wasm2wat / wasm-decompile / wasm-objdump / wasm2c) · Binaryen wasm-opt · pure-TS section parser · import/export listing · section-grouped string extraction with name-section recovery · function-level binary diff · obfuscation detection · function- and basic-block-level instrumentation
Process and memory forensics	Native FFI scanning · cross-reference graphs · hardware breakpoints · PE introspection · live process attach · memory read/write with region guards
Binary instrumentation	Frida bridge · Ghidra and IDA bridges · syscall hooking · TLS keylog and session tooling · Mojo IPC analysis
Android and APK analysis	APK static triage · manifest dump and query · apktool decode / build · jadx decompilation and code search · DEX scanning · native library listing · APK signing · unidbg emulation · runtime DEX dump
Native runtime	Native emulator for foreign-architecture samples · platform introspection · Mojo IPC · Dart Inspector · ADB bridge for on-device traffic
Encoding and transform	URL/Base64/Hex/JWT/Protobuf encoders · AST transforms · streaming decode pipelines
Coordination	Background task queue with progress, cancellation, and async modes · multi-agent coordination · coverage reports
Schema-first meta tools	describe_tool · call_tool with argument validation · coverage_report · search_tools
Pluggable extension registry	Hot-reload plugins · declarative workflows · auto-discovered domains

---

Use cases