jshook MCP Server: JavaScript Reverse Engineering Toolkit

• Finds the right tool for a job from the full catalog

  Searches the whole tool catalog by keywords and, by default, switches on the tools it finds so the assistant can use them right away.

  Try: “Find a tool that can list the network requests this page made.”

  Read · search_tools

• Suggests which tools to use for a task, step by step

  Takes a plain description of a task and returns recommended tools, the order to switch them on, and example arguments.

  Try: “Which tools do I need to unpack this minified script?”

  Read · route_tool

• Shows what a tool does and what it needs

  Returns the details and input format of one named tool so the assistant can see its parameters before calling it.

  Try: “Describe the proxy_start tool.”

  Read · describe_tool

• Switches on specific tools by name

  Adds the named tools to the session so the assistant can call them. A preview mode shows what would be switched on or dropped without changing anything.

  Try: “Switch on the WASM disassembly tools.”

  Read · activate_tools

• Switches tools back off to save space

  Removes tools you added earlier so they stop taking up room in the assistant context. It does not touch the base set.

  Try: “Turn off the tools we no longer need.”

  Read · deactivate_tools

• Switches on a whole group of tools at once

  Registers every tool in one area, such as network or debugger. It costs far more context than picking a few tools, and the tools switch off by themselves after 30 minutes unless you change that.

  Try: “Turn on the network tools for 60 minutes.”

  Read · activate_domain

• Runs an already switched-on tool by name

  Runs a tool that is active in the session, for apps that did not refresh their tool list. It does not switch on tools that are off, but whatever the tool does, it does.

  Try: “Run network_get_requests for the current page.”

  Runs code · call_tool

• Lists which tools have and have not been used

  Reports which tools were called in this session and which known tools were not. It loads every tool group first so the list covers the full catalog.

  Try: “Show me which tools we have used so far.”

  Read · coverage_report

• Starts a local web proxy that can read HTTPS traffic

  On demand: starts a local HTTP and HTTPS proxy and creates a local certificate authority for decrypting traffic if none exists. Install that certificate only on devices you own.

  Try: “Start the proxy and capture requests from my test phone.”

  Runs code · proxy_start

• Turns a WebAssembly file into readable text

  On demand: runs the wabt tool wasm2wat on a .wasm file and returns its text form so the assistant can read what the module does.

  Try: “Disassemble the WASM file we just dumped.”

  Runs code · wasm_disassemble

• Rewrites bytes inside a running program

  On demand: writes bytes into another process memory at an address you give, and keeps the original bytes so the patch can be undone. The memory domain also holds tools that scan memory and, on Windows with an extra setting, inject code.

  Try: “Patch the check at this address in the target process.”

  Runs code · memory_patch_bytes

Watch out for

• It can patch and inject code into other programs

  Memory tools such as memory_patch_bytes write into running processes, and the docs say the injection tools need JSHOOK_INJECTION_ENABLE=1 on Windows. Leave that setting off unless you need it. github.com

• call_tool runs whatever tool is switched on

  The 8 starting tools are harmless, but they switch on the rest and call_tool runs them. Watch what the assistant activates, and prefer a disposable machine. github.com

• The proxy creates a certificate that can read HTTPS

  proxy_start generates a local certificate authority when none exists. Trust it only on test devices, and remove it when you finish. github.com

• The browser can click, type and run scripts on live pages

  Browser tools attach to Chromium or Camoufox and can act on pages you are signed in to. Use a separate browser profile. github.com

• It downloads helpers the first time it runs

  The README says optional runtimes such as ONNX, Z3, Binaryen, Camoufox and Playwright, and a search model, may download on first run. Use the lighter setup from the README to skip the optional ones. github.com

• Shared HTTP mode needs a token off localhost

  The optional shared server binds to 127.0.0.1 by default. Set MCP_AUTH_TOKEN before you expose it beyond your machine. github.com

Security advisories