js-reverse-mcp
The js-reverse-mcp server is a JS reverse engineering toolkit for dynamically analyzing and replicating JavaScript encryption logic in web applications, primarily for CTF/web security login scenarios. It provides ~31 tools across six capability areas:
Browser Automation
Launch/close Chrome (headless or visible, with proxy support), navigate to URLs, take screenshots (base64), and retrieve page HTML or element content.
Network Interception & Analysis
Enable/disable request interception with URL filters, list/inspect captured HTTP requests, retrieve full request details (headers, body, response), auto-detect login requests, and compare requests to identify dynamically encrypted parameters.
JavaScript Source Code Analysis
List all scripts on a page, fetch and auto-beautify script sources, search scripts by keyword or regex, extract specific function implementations, trace function call chains, and capture full encryption context (function + dependencies).
Runtime Interaction & Hooking
Execute arbitrary JavaScript in the page context, call global functions with custom arguments, inspect encryption-related global variables, hook any function (including chained calls like
CryptoJS.AES.encrypt) to log arguments/return values, and retrieve hook logs.
Cryptographic Detection & Key Extraction
Auto-detect encryption algorithms (AES, DES, RSA, MD5, SHA, SM2, SM4, Base64, etc.), analyze parameter ciphertext format/length to infer encryption method, identify crypto libraries (CryptoJS, JSEncrypt, node-forge, SM-Crypto, etc.), extract hardcoded keys/IVs/salts, and verify a guessed algorithm by comparing local encryption output against captured ciphertext.
Script Generation & Testing
Generate ready-to-use Python or JavaScript scripts for decryption, encryption replay, or brute-force login, supporting AES-CBC/ECB, DES, 3DES, RSA, MD5, SHA256, Base64, and custom algorithms. Generated scripts can be test-run directly within the server.
Controls a Chrome browser instance via Chrome DevTools Protocol to dynamically analyze JavaScript code, intercept network requests, and extract encryption logic from web pages.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@js-reverse-mcpanalyze the login request encryption on http://example.com/login"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
JS 逆向 MCP 工具 (js-reverse-mcp)
Chrome 浏览器 JS 逆向分析 MCP 工具 —— 专用于 CTF / Web 安全场景中登录框加密逻辑的动态分析与还原
建议:可以用最近新出的Qoder启动,每天200次免费调用Qwen3.7-Max,运行前可以让Qcoder自动补齐项目所需的依赖,根据你本地环境自动修改配置文件。
一、项目简介
本项目是一个基于 MCP(Model Context Protocol) 协议的 JS 逆向分析工具集,通过 Chrome DevTools Protocol(CDP)动态分析目标网页中的 JavaScript 加密逻辑,自动识别加密算法、提取密钥,并生成可用的加密/解密脚本。
核心能力:
基于 Puppeteer 控制 Chrome 浏览器,动态执行目标页面 JS
利用 CDP 协议拦截网络请求、获取脚本源码、Hook 函数调用
内置加密算法特征库,支持 AES/DES/RSA/MD5/SHA/SM2/SM4/Base64 等
自动生成 Python 和 JavaScript 的加密/解密/暴力破解脚本
通过 MCP 协议暴露 31 个标准化工具接口,支持与 AI 助手集成
Related MCP server: js-reverse-analyzer
二、技术栈
类别 | 技术 | 说明 |
语言 | TypeScript 5.7 + Node.js ≥18 | 主开发语言 |
协议 | @modelcontextprotocol/sdk v1.29 | MCP 协议 SDK |
浏览器 | puppeteer-core v23 | Chrome 自动化控制 |
AST 分析 | acorn + acorn-walk | JS 语法树解析与遍历 |
加密分析 | crypto-js + node-forge | 加密算法验证与还原 |
代码美化 | js-beautify | 混淆 JS 代码格式化 |
模板引擎 | mustache | 脚本生成模板 |
数据校验 | zod v3.23 | MCP 消息 Schema 校验 |
三、项目结构
js-reverse-mcp/
├── src/ # 源码目录
│ ├── index.ts # 程序入口 - 注册所有工具模块,启动 stdio 传输
│ ├── server.ts # MCP Server 创建与配置
│ │
│ ├── browser/
│ │ └── manager.ts # 浏览器单例管理器 - Puppeteer 生命周期管理
│ │
│ ├── tools/ # MCP 工具模块(共 6 个模块,31 个工具)
│ │ ├── navigation.ts # 浏览器导航工具(5 个工具)
│ │ ├── network.ts # 网络拦截工具(6 个工具)
│ │ ├── source-analysis.ts # JS 源码分析工具(6 个工具)
│ │ ├── runtime.ts # 运行时分析工具(5 个工具)
│ │ ├── crypto-detect.ts # 加密检测工具(5 个工具)
│ │ └── script-gen.ts # 脚本生成工具(4 个工具)
│ │
│ ├── analysis/
│ │ └── crypto-patterns.ts # 加密算法特征库 - 静态模式匹配 + 密文格式识别
│ │
│ ├── generators/
│ │ ├── python-template.ts # Python 脚本模板生成器(AES/DES/RSA/MD5/自定义)
│ │ └── javascript-template.ts # JavaScript 脚本模板生成器
│ │
│ ├── storage/
│ │ └── request-store.ts # 请求数据存储 - 内存 + 文件双层持久化
│ │
│ └── utils/
│ └── logger.ts # 日志工具(所有日志走 stderr,不破坏 MCP stdio)
│
├── build/ # 编译输出目录(tsc 生成)
├── output/ # 生成的脚本输出目录
├── mcp-config.json # MCP 配置文件示例
├── package.json # 项目依赖与脚本
└── tsconfig.json # TypeScript 编译配置四、工具清单
4.1 浏览器导航工具(navigation.ts)— 5 个
工具名 | 功能 | 关键参数 |
| 启动 Chrome 浏览器实例 |
|
| 关闭浏览器,释放资源 | 无 |
| 导航到指定 URL |
|
| 截取页面截图(base64 返回) |
|
| 获取页面 HTML 或元素内容 |
|
4.2 网络拦截工具(network.ts)— 6 个
工具名 | 功能 | 关键参数 |
| 开启网络请求拦截 |
|
| 关闭网络拦截 | 无 |
| 获取已拦截的请求列表摘要 |
|
| 获取单个请求完整详情 |
|
| 智能定位登录请求 |
|
| 对比多次请求参数差异 |
|
4.3 JS 源码分析工具(source-analysis.ts)— 6 个
工具名 | 功能 | 关键参数 |
| 获取页面所有 JS 脚本列表 | 无 |
| 获取脚本源码(自动美化) |
|
| 在脚本中搜索关键词/正则 |
|
| 提取指定函数的完整实现 |
|
| 追踪函数调用链 |
|
| 获取加密函数及其依赖上下文 |
|
4.4 运行时分析工具(runtime.ts)— 5 个
工具名 | 功能 | 关键参数 |
| 在页面中执行 JS 代码 |
|
| 调用页面全局函数 |
|
| 获取加密相关全局变量 |
|
| Hook 函数,记录调用参数和返回值 |
|
| 获取 Hook 调用日志 |
|
4.5 加密检测工具(crypto-detect.ts)— 5 个
工具名 | 功能 | 关键参数 |
| 自动扫描检测加密算法 | 无 |
| 分析参数加密方式 |
|
| 识别页面使用的加密库 | 无 |
| 提取密钥/IV/盐值 |
|
| 本地验证加密算法是否正确 |
|
4.6 脚本生成工具(script-gen.ts)— 4 个
工具名 | 功能 | 关键参数 |
| 生成解密脚本(Python/JS) |
|
| 生成加密脚本 | 同上 |
| 生成暴力破解脚本 | 同上 + |
| 测试运行 JS 脚本 |
|
支持的算法类型: AES-CBC、AES-ECB、DES、3DES、RSA、MD5、SHA256、Base64、Custom
五、环境要求与安装
5.1 环境要求
Node.js ≥ 18.0.0
Google Chrome 浏览器(需安装在本机)
5.2 安装步骤
# 1. 克隆项目
git clone <repo-url>
cd js-reverse-mcp
# 2. 安装依赖
npm install
# 3. 编译 TypeScript
npm run build (注意:启动项目前检查下所需的依赖是否齐全)5.3 环境变量
变量名 | 说明 | 默认值 |
| Chrome 可执行文件路径 |
|
| 脚本输出目录 |
|
| 设为任意值开启调试日志 | 未设置(关闭) |
六、使用方法
6.1 启动命令
# 正式运行(需先 build)
npm start
# 等价于: node build/index.js
# 开发调试(直接运行 TS 源码,无需 build)
npm run dev
# 构建项目
npm run build
# 使用 MCP Inspector 调试
npm run inspector6.2 配置 MCP 客户端
在 AI 客户端(如 Cursor、Claude Desktop 等)的 MCP 配置文件中添加:
{
"mcpServers": {
"js-reverse": {
"command": "node",
"args": ["e:\\Qwen\\build\\index.js"],
"env": {
"CHROME_PATH": "C:\\Users\\fangz\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"OUTPUT_DIR": "e:\\Qwen\\output"
}
}
}
}配置完成后,AI 助手即可通过自然语言调用所有 31 个逆向工具。
七、实战逆向流程
以下是使用本工具对一个典型登录页面进行 JS 逆向的完整流程:
第 1 步:启动浏览器并导航
"帮我启动 Chrome 并导航到目标登录页"
调用 browser_launch → page_navigate → page_screenshot
第 2 步:开启网络拦截
"开启网络拦截,捕获所有请求"
调用 network_enable_intercept,然后在页面上手动执行一次登录操作。
第 3 步:定位登录请求
"帮我找到加密的登录请求"
调用 network_find_login_request,自动识别包含密码/加密参数的 POST 请求。
第 4 步:自动检测加密算法
"帮我检测页面使用了什么加密"
调用 crypto_auto_detect,扫描所有 JS 代码中的加密特征模式。
第 5 步:搜索加密代码
"在 JS 中搜索 encrypt|CryptoJS|password"
调用 js_search_in_scripts,定位加密函数的具体代码位置。
第 6 步:提取密钥和参数
"帮我提取 AES 的 key 和 iv"
调用 crypto_extract_key,从源码和 Runtime 中提取硬编码密钥。
第 7 步:验证加密算法
"用 AES-ECB 模式,key 为 xxx,验证加密结果"
调用 crypto_verify_algorithm,本地计算对比密文是否匹配。
第 8 步:生成脚本
"生成 Python 的 AES-ECB 解密脚本"
调用 generate_decrypt_script,自动保存到 output/ 目录。
八、实战案例
以下是对 https://XXXXXXX.edu.cn/admin/#/login 的逆向分析结果:
抓包结果
POST /api/venue_book/login/AdminLogin
{"user":"testuser","password":"y8d/dgERxCaiTGAod1+RiQ=="}逆向定位的加密代码(app.js)
// 硬编码密钥
const M = CryptoJS.enc.Utf8.parse("0123456789ABCDEF");
// 加密函数
function j(e) {
var t = CryptoJS.enc.Utf8.parse(JSON.stringify(e));
var n = CryptoJS.AES.encrypt(t, M, {
mode: CryptoJS.mode.ECB,
padding: CryptoJS.pad.Pkcs7
});
return n.toString();
}
// 登录调用: c = j(password)分析结论
项目 | 值 |
算法 | AES-128-ECB |
密钥 |
|
填充 | PKCS7 |
编码 | Base64 |
安全弱点 | ECB 模式无 IV、密钥硬编码在前端 |
九、核心模块说明
9.1 浏览器管理器(browser/manager.ts)
单例模式管理 Puppeteer 浏览器生命周期:
支持启动新实例或连接已有 Chrome(通过
wsEndpoint)自动创建 CDP(Chrome DevTools Protocol)会话
默认禁用沙箱和跨域限制,方便逆向调试
9.2 请求存储(storage/request-store.ts)
内存 + 文件双层持久化:
自动检测登录请求(基于 URL 关键词 + 请求体关键词)
自动识别加密参数(Base64/Hex 特征检测)
请求记录持久化到
output/.session/requests.json
9.3 加密特征库(analysis/crypto-patterns.ts)
内置 20+ 种加密模式匹配规则:
对称加密: AES(CBC/ECB/PKCS7/Zero/NoPadding)、DES、3DES
非对称加密: JSEncrypt RSA、RSAKey、node-forge RSA
哈希算法: MD5、SHA1、SHA256、HMAC-SHA256
编码格式: Base64、Hex
国密算法: SM2、SM3、SM4
密文格式识别器: 根据长度和编码格式推断可能算法
密钥长度推断: 8→DES、16→AES-128/SM4、24→AES-192/3DES、32→AES-256
9.4 脚本生成器(generators/)
支持生成三种类型的脚本:
加密/解密脚本: Python(pycryptodome)和 JavaScript(crypto-js)
暴力破解脚本: 包含加密函数 + 自动化登录请求
支持 AES、DES、3DES、RSA、MD5、自定义算法
9.5 日志工具(utils/logger.ts)
所有日志输出到 stderr(console.error),绝不使用 console.log,避免破坏 MCP stdio 协议通信。
十、完整依赖清单
10.1 直接依赖(dependencies)
包名 | 版本 | 说明 |
| 1.29.0 | MCP 协议 SDK(含 Hono/Express 服务端支持) |
| 3.25.76 | TypeScript-first Schema 声明与校验库 |
| 23.11.1 | Chrome 浏览器自动化控制(高优先级 CDP API) |
| 1.15.4 | JS/HTML/CSS 代码美化格式化 |
| 8.16.0 | ECMAScript 语法解析器 |
| 8.3.5 | ECMAScript AST 遍历器 |
| 4.2.0 | 加密算法库(AES/DES/MD5/SHA/RSA 等) |
| 1.4.0 | JS 加密实现(TLS/X.509/RSA/AES 等) |
| 4.2.0 | 无逻辑 Mustache 模板引擎 |
10.2 开发依赖(devDependencies)
包名 | 版本 | 说明 |
| 5.9.3 | TypeScript 编译器 |
| 4.22.4 | TypeScript 直接执行工具(基于 esbuild) |
| 22.19.20 | Node.js 类型定义 |
| 4.2.2 | crypto-js 类型定义 |
| 1.14.3 | js-beautify 类型定义 |
| 1.3.14 | node-forge 类型定义 |
| 4.2.6 | mustache 类型定义 |
| 2.10.3 | yauzl 类型定义 |
10.3 间接依赖(传递依赖)
MCP / 网络通信相关
包名 | 版本 | 说明 |
| 5.2.1 | HTTP Web 框架(MCP SDK 内部使用) |
| 4.12.25 | 轻量 Web 框架(MCP SDK 可选传输) |
| 1.19.14 | Hono Node.js 适配器 |
| 8.21.0 | WebSocket 客户端/服务端 |
| 2.0.2 | SSE(Server-Sent Events)客户端 |
| 3.0.2 | SSE 协议解析器 |
| 3.25.2 | Zod Schema 转 JSON Schema |
| 6.2.3 | JWT/JWS/JWE 实现(OAuth 支持) |
| 5.0.1 | PKCE 挑战对生成/验证 |
| 2.8.5 | HTTP CORS 中间件 |
| 2.2.2 | HTTP 请求体解析中间件 |
| 2.2.0 | 简易中间件路由 |
| 8.2.1 | Express 请求限速 |
Puppeteer / 浏览器自动化相关
包名 | 版本 | 说明 |
| 0.11.0 | WebDriver BiDi 协议实现(Puppeteer 内部) |
| 2.6.1 | 浏览器下载与启动工具 |
| 0.0.1452057 | Chrome DevTools Protocol 类型定义 |
| 5.3.1 | FTP 客户端(浏览器下载) |
| 2.0.1 | ZIP 解压工具 |
| 2.10.0 | ZIP 文件解析库 |
| 2.0.3 | 下载进度条 |
| 3.0.1 | 轻量事件发射器 |
| 2.12.2 | 类型化 querySelector |
代理 / 网络相关
包名 | 版本 | 说明 |
| 6.5.0 | 代理协议映射 Agent |
| 7.0.2 | HTTP 代理 Agent |
| 7.0.6 | HTTPS 代理 Agent |
| 8.0.5 | SOCKS 代理 Agent |
| 2.8.9 | SOCKS v4/v4a/v5 客户端 |
| 7.2.0 | PAC 文件代理 Agent |
| 7.0.1 | PAC 文件解析器 |
| 1.1.0 | 从环境变量获取代理配置 |
| 2.1.1 | IP 网段解析 |
| 10.2.0 | IPv4/IPv6 地址解析 |
| 4.2.0 | 智能 Buffer 封装 |
| 7.1.4 | HTTP Agent 基类 |
| 6.0.2 | Data URI 转 Buffer |
| 6.0.5 | URI 转可读流 |
构建工具
包名 | 版本 | 说明 |
| 0.28.0 | 极速 JS 打包器(tsx 内部使用) |
| 0.28.0 | esbuild Windows 64 位二进制 |
工具函数 / 通用库
包名 | 版本 | 说明 |
| 4.4.1 | 调试日志工具 |
| 2.1.3 | 毫秒转换工具 |
| 7.8.4 | 语义化版本解析 |
| 10.4.5 | Glob 模式匹配 |
| 9.0.9 | Glob 匹配器 |
| 7.1.3 | 最小 PassThrough 流实现 |
| 10.4.3 | LRU 缓存 |
| 4.1.0 | 进程退出信号处理 |
| 1.4.0 | 函数单次执行 |
| 3.0.4 | 管道流连接 |
| 1.0.2 | 回调包装工具 |
| 2.0.2 | 可执行文件查找(类 Unix which) |
| 3.1.1 | 跨平台 PATH 键获取 |
| 7.0.6 | 跨平台 spawn |
| 2.0.0 | shebang 命令提取 |
| 3.0.0 | shebang 正则匹配 |
| 2.0.0 | 可执行文件检测 |
| 3.3.1 | 前台子进程管理 |
| 1.0.1 | 从 dist 加载 package.json |
| 1.11.1 | 高效路径遍历 |
| 3.4.3 | 严格参数解析器 |
| 2.0.2 | 从字符串加载模块 |
| 2.1.1 | 递归加载目录模块 |
HTTP / Web 基础
包名 | 版本 | 说明 |
| 2.0.0 | HTTP 内容协商 |
| 1.0.0 | HTTP 内容协商底层 |
| 1.0.5 | Content-Type 解析 |
| 1.1.0 | Content-Disposition 解析 |
| 2.1.0 | 请求类型推断 |
| 1.1.0 | RFC 6838 媒体类型解析 |
| 3.0.2 | MIME 类型工具 |
| 1.54.0 | MIME 类型数据库 |
| 0.7.2 | Cookie 解析与序列化 |
| 1.2.2 | Cookie 签名 |
| 1.8.1 | ETag 生成 |
| 2.0.0 | HTTP 缓存新鲜度检查 |
| 1.1.2 | Vary 头操作 |
| 1.2.1 | 静态文件发送 |
| 2.2.1 | 静态文件服务 |
| 1.2.1 | Range 头解析 |
| 1.3.3 | URL 解析(带缓存) |
| 2.0.0 | URL 编码 |
| 1.0.3 | HTML 转义 |
| 2.4.1 | 请求完成回调 |
| 1.1.1 | 事件优先触发 |
| 1.0.0 | 解除流管道 |
| 3.0.2 | 原始请求体获取 |
| 3.1.2 | 字节字符串转换 |
| 2.0.2 | HTTP 状态码工具 |
| 2.0.1 | HTTP 错误对象 |
| 1.0.1 | 字符串转 JS 标识符 |
| 2.0.0 | 废弃警告工具 |
| 2.0.7 | 代理地址判定 |
| 0.2.0 | Forwarded 头解析 |
| 1.9.1 | IPv4/IPv6 操作库 |
| 2.0.0 | 属性描述符合并 |
| 1.13.4 | 对象字符串表示 |
| 8.4.2 | Express 风格路径转正则 |
| 6.15.2 | 查询字符串解析(支持嵌套) |
| 0.7.2 | 字符编码转换 |
| 2.1.2 | 安全 Buffer polyfill |
JS 解析 / AST 相关
包名 | 版本 | 说明 |
| 4.0.1 | ECMAScript 解析器 |
| 2.1.0 | ECMAScript 代码生成 |
| 5.3.0 | ECMAScript AST 遍历 |
| 2.0.3 | ECMAScript 工具函数 |
| 0.13.4 | Mozilla JS Parser API 实现 |
| 0.6.1 | Source Map 生成与消费 |
加密 / 编码相关
包名 | 版本 | 说明 |
| 1.5.1 | 纯 JS Base64 编解码 |
| 1.2.1 | IEEE754 浮点数读写 |
| 5.7.1 | 浏览器 Buffer API |
| 0.2.13 | CRC32 算法 |
数据校验 / Schema
包名 | 版本 | 说明 |
| 8.20.0 | JSON Schema 校验器 |
| 3.0.1 | Ajv 格式校验扩展 |
| 1.0.0 | JSON Schema 遍历 |
| 8.0.2 | JSON Schema TS 定义 |
| 3.1.3 | 深度相等比较 |
| 3.1.0 | 快速 URI 解析 |
流处理 / 解压
包名 | 版本 | 说明 |
| 2.27.0 | 改进的 Node.js 流实现 |
| 3.2.0 | 流式 tar 解析/生成 |
| 3.1.2 | tar 文件系统绑定 |
| 1.0.1 | 可读流多路复用 |
| 1.2.7 | 流式文本解码器 |
| 1.8.1 | Buffer/TypedArray 桥接 |
| 1.4.3 | bzip2 流式解压 |
| 1.4.5 | 流结束检测 |
| 5.2.0 | 流转换为字符串/Buffer |
| 2.13.1 | Bare 运行时流实现 |
| 2.3.8 | 简易流构造 |
| 1.3.2 | 快速 FIFO 队列 |
终端 / CLI 相关
包名 | 版本 | 说明 |
| 17.7.2 | 命令行参数解析 |
| 21.1.1 | yargs 参数解析器 |
| 5.0.8 | 国际化库(yargs 使用) |
| 8.0.1 | CLI 多列输出 |
| 7.0.0 / 8.1.0 | ANSI 终端文本换行 |
| 6.2.2 | ANSI 转义码正则 |
| 6.2.3 | ANSI 终端样式 |
| 2.0.1 | 颜色格式转换 |
| 1.1.4 | 颜色名称映射 |
| 4.2.3 / 5.1.2 | 字符串显示宽度 |
| 6.0.1 / 7.2.0 | 去除 ANSI 转义码 |
| 3.0.0 | 全角字符检测 |
| 0.2.0 | 东亚字符宽度 |
| 10.4.0 | Emoji 正则 |
配置 / INI / EditorConfig
包名 | 版本 | 说明 |
| 10.0.1 | Node.js CLI 命令框架 |
| 1.0.4 | EditorConfig 解析 |
| 0.1.1 | INI 文件 WASM 解析 |
| 1.3.8 | INI 编解码 |
| 1.1.13 | 配置链管理 |
| 1.2.4 | 原型链工具 |
| 7.2.1 | Node 选项解析 |
| 2.0.0 | 字符串缩写生成 |
对象 / 函数工具
包名 | 版本 | 说明 |
| 1.1.0 | Symbol 支持检测 |
| 2.0.4 | 安全 hasOwnProperty |
| 1.2.0 | getOwnPropertyDescriptor |
| 1.0.2 | call/apply 辅助 |
| 1.0.4 | 安全绑定调用 |
| 1.0.1 | Object.defineProperty 安全版 |
| 1.3.0 | ES 错误类型 |
| 1.1.1 | ES 对象原子操作 |
| 1.1.0 | Math 内部函数 |
| 1.1.1 | 侧信道存储(WeakMap) |
| 1.0.1 | 侧信道 Map 实现 |
| 1.0.1 | 侧信道链表实现 |
| 1.0.2 | 侧信道 WeakMap 实现 |
| 1.0.1 | __proto__ 安全访问 |
| 1.3.0 | JS 内置对象获取 |
| 1.0.1 | 原型获取 |
| 4.1.1 | Object.assign polyfill |
| 1.2.0 | setPrototypeOf polyfill |
| 2.0.4 | 继承工具 |
| 1.1.2 | Function.prototype.bind |
Bare 运行时(Puppeteer 可选依赖)
包名 | 版本 | 说明 |
| 2.9.1 | Bare 事件发射器 |
| 4.7.2 | Bare 文件系统操作 |
| 3.9.1 | Bare 操作系统工具 |
| 3.0.1 | Bare 路径操作 |
| 2.4.5 | Bare URL 实现 |
| 1.0.1 | 通用事件模块 |
其他
包名 | 版本 | 说明 |
| 1.0.2 | 平衡括号匹配 |
| 2.1.1 | 大括号展开(sh/bash 风格) |
| 2.8.1 | TypeScript 运行时辅助库 |
| 6.21.0 | Undici 类型定义 |
| 3.0.8 | 轻量 Cookie 操作库 |
| 0.23.0 | QuickJS WASM 绑定 |
| 8.0.2 | CLI 多列输出(isaacs 版) |
| 0.11.0 | util.parseArgs polyfill |
十一、配置文件说明
mcp-config.json
{
"mcpServers": {
"js-reverse": {
"command": "node",
"args": ["e:\\Qwen\\build\\index.js"],
"env": {
"CHROME_PATH": "C:\\Users\\fangz\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"OUTPUT_DIR": "e:\\Qwen\\output"
}
}
}
}tsconfig.json
{
"compilerOptions": {
"target": "ES2022",
"module": "Node16",
"moduleResolution": "Node16",
"outDir": "./build",
"rootDir": "./src",
"strict": true,
"esModuleInterop": true,
"declaration": true,
"sourceMap": true
}
}十二、注意事项
首次使用必须调用
browser_launch:所有需要浏览器操作的工具都依赖浏览器实例,必须先启动Chrome 路径配置:确保
CHROME_PATH环境变量指向正确的 Chrome 安装路径网络拦截顺序:需先调用
network_enable_intercept,再在页面上进行操作脚本源码缓存:
js_get_all_scripts会建立脚本缓存,后续的分析/搜索工具依赖此缓存日志走 stderr:所有调试日志通过
console.error输出,不会干扰 MCP stdio 通信输出目录:生成的脚本和会话数据保存在
OUTPUT_DIR指定的目录中
十三、许可证
本项目仅供学习和安全研究使用,请遵守相关法律法规。
十三、测试用例
Available Tools
31 toolsbrowser_closeA
关闭浏览器实例,释放资源
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that it closes the browser and releases resources, which signals a destructive operation. Without annotations, this is adequate for a simple tool with no parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single concise sentence that directly conveys the tool's purpose without unnecessary fluff. Front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and a simple action, the description fully covers the tool's behavior. No additional context needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is complete. Description adds no extra param info, but none is needed. Baseline score of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action (close) and the resource (browser instance), with '释放资源' indicating resource release. It directly distinguishes from sibling 'browser_launch'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage when the browser instance is no longer needed, but no explicit when-to-use or when-to-avoid guidance is provided. Context with sibling tools suggests pairing, but description lacks direct instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_launchB
启动Chrome浏览器实例,支持headless模式和代理设置
| Name | Required | Description | Default |
|---|---|---|---|
| headless | No | 是否无头模式,默认false(可视化) | |
| chromePath | No | Chrome可执行文件路径 | |
| proxy | No | 代理服务器地址,如 http://127.0.0.1:8080 | |
| wsEndpoint | No | 连接已有Chrome实例的WebSocket地址 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description does not disclose resource implications, permissions, or that wsEndpoint connects to an existing instance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence without waste, but lacks any structuring or front-loading of key details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Brief but adequate for a simple launch tool; missing details about wsEndpoint alternative and browser behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all parameters with descriptions; description adds minimal extra meaning by summarizing capabilities.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it launches a Chrome browser instance with headless and proxy support, distinguishing it from sibling browser_close.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance; the wsEndpoint parameter hints at an alternative but is not explained.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crypto_analyze_paramC
分析指定请求参数的加密方式,通过密文格式和长度推断可能的算法
| Name | Required | Description | Default |
|---|---|---|---|
| paramName | Yes | 参数名(如'password') | |
| sampleValues | No | 密文样本值列表(多个样本有助于分析) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It mentions that the tool infers algorithms from ciphertext format and length, but does not disclose whether it is read-only, any side effects, or requirements beyond having sample values. The lack of annotation contradictions is not relevant here due to the absence of annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is clear and front-loaded with the action. It efficiently conveys the core functionality without extraneous words. However, it could be slightly more explicit about the process of inference.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should explain what the output looks like (e.g., identified algorithms, confidence scores). It does not, leaving a significant gap for an analysis tool. The context signals indicate low complexity, but the description fails to cover return values comprehensively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers both parameters with descriptions (e.g., 'parameter name (e.g., password)' and 'list of ciphertext samples'). The tool description adds overarching context about using ciphertext format and length, which provides some extra meaning, but it does not significantly enhance understanding beyond the schema. Baseline 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: analyzing encryption methods of a request parameter by inferring algorithms from ciphertext format and length. It is specific with a verb ('分析') and resource ('请求参数的加密方式'), but it does not explicitly differentiate itself from sibling tools like crypto_auto_detect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There is no mention of prerequisites, use cases, or when it should be avoided, leaving the agent without context for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crypto_auto_detectB
自动扫描页面所有JS代码,检测使用的加密算法和库(支持AES/DES/RSA/MD5/SHA/SM2/SM4/Base64)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only says it scans JS code automatically. Does not disclose behavioral traits such as read-only status, potential performance impact, or whether it modifies the page. Lacks safety or side-effect information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is concise and front-loaded with key action and supported algorithms. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description does not specify what the tool returns (e.g., list of detected algorithms, libraries). Also missing prerequisites (e.g., page must be loaded). Incomplete for a detection tool given many sibling tools with different capabilities.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters in schema, so baseline is 4. Description adds no parameter info but none is needed. It does not misrepresent parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it scans JS code to detect encryption algorithms and libraries, listing supported types. However, it does not differentiate from sibling tools like crypto_identify_library or crypto_verify_algorithm, which have similar purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. Does not mention prerequisites, limitations, or when to prefer sibling tools for more specific tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crypto_extract_keyB
尝试从JS源码和Runtime中提取加密密钥、IV、盐值等关键参数
| Name | Required | Description | Default |
|---|---|---|---|
| algorithm | No | 指定算法类型辅助搜索,如'AES','RSA' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must bear the burden of disclosing behavioral traits. It does not mention potential side effects, performance implications, required page state, or whether the tool is safe to call repeatedly. The description is too sparse to guide agent expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the core purpose. It is not overly verbose, but it could benefit from more structure (e.g., bullet points for key behaviors). Still, it is efficient and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema and annotations, the description should explain what the tool returns or any additional context. It does not mention return values, success indicators, or limitations, leaving the agent with insufficient information to predict the tool's output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the parameter 'algorithm' already has a description in the schema. The tool description does not add any additional insight beyond what the schema provides, so it meets the baseline but adds no extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to extract encryption keys, IVs, salt from JS source and runtime. It specifies the action ('extract') and the resources, effectively distinguishing it from sibling tools like crypto_analyze_param or crypto_auto_detect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention prerequisites, context, or situations where other tools might be preferred. The description is purely functional without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crypto_identify_libraryB
识别页面使用的加密库名称和版本
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description does not disclose any behavioral traits such as side effects, required page state, or limitations. It only states the function without depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no superfluous words. It effectively communicates the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, output schema, or annotations, the description is minimal but adequate for a simple identification tool. However, it could benefit from clarifying how the identification works or what is returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so schema coverage is 100%. The description adds the meaning that it identifies library name and version, which is baseline value beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb '识别' (identify) and the resource '加密库名称和版本' (encryption library name and version). It distinguishes this tool from siblings like 'crypto_analyze_param' and 'crypto_extract_key' by focusing on library identification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, nor any prerequisites or context for its use. The description is purely declarative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crypto_verify_algorithmA
使用本地加密库验证猜测的算法是否正确(输入明文+参数,对比是否能得到相同密文)
| Name | Required | Description | Default |
|---|---|---|---|
| algorithm | Yes | 算法类型 | |
| plaintext | Yes | 明文(如原始密码) | |
| expected | Yes | 期望的密文(从拦截的请求中获取) | |
| key | No | 密钥(对称加密需要) | |
| iv | No | IV向量(CBC模式需要) | |
| encoding | No | 输出编码方式,默认base64 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses that the tool uses a local encryption library, performs computation, and compares ciphertexts. This is sufficient for a verification tool; it does not mention side effects or error handling, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It conveys the verb, resource, and process efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, process, and inputs adequately. It lacks explicit mention of output format, but the phrase 'compare whether the same ciphertext can be obtained' implies a boolean result. With no output schema, this is sufficient but could be more explicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all parameters. The description adds value by integrating parameters into a narrative flow ('input plaintext + parameters, compare'), helping an agent understand the overall process beyond individual schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool verifies a guessed cryptographic algorithm by comparing computed ciphertext with expected. It uses a specific verb 'verify' and resource 'algorithm', but does not explicitly differentiate from sibling tools like crypto_auto_detect or crypto_analyze_param, which have related but distinct purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (after guessing an algorithm) but does not explicitly state when not to use or name alternative tools. An agent can infer usage context, but lacks direct guidance on choosing between siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_brute_scriptB
生成暴力破解脚本(包含加密+自动化登录尝试)
| Name | Required | Description | Default |
|---|---|---|---|
| language | Yes | 脚本语言 | |
| algorithm | Yes | 加密算法 | |
| loginUrl | Yes | 登录接口URL | |
| paramName | No | 密码参数名,默认'password' | |
| key | No | 加密密钥 | |
| iv | No | IV偏移量 | |
| mode | No | 加密模式 | |
| encoding | No | 输出编码 | |
| publicKey | No | RSA公钥 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It mentions 'encryption + automated login attempts', which hints at the behavior but does not disclose potential side effects, safety concerns, or prerequisites. Important details like whether the script is generated locally, if any network requests are made, or if it could be destructive are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that efficiently conveys the tool's purpose. It is front-loaded with key information ('generate brute force script') and contains no extraneous words. However, it is very short and could benefit from slightly more detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 9 parameters and no output schema, the description provides minimal context. It does not explain the typical use case, what the generated script looks like, or how to use the parameters. A more detailed description would be needed to fully support the agent in using this complex tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 9 parameters. The description adds the overall context of 'encryption + automated login' but does not provide additional meaning beyond what the schema's descriptions offer. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a brute force script with encryption and automated login attempts. It uses a specific verb (generate) and resource (brute force script), and it distinguishes itself from sibling tools like generate_encrypt_script by explicitly mentioning brute force.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. No when-to-use, when-not-to-use, or exclusion information is provided. The description merely states what the tool does without any usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_decrypt_scriptB
根据分析结果生成完整的解密脚本(Python或JavaScript),自动保存到output目录
| Name | Required | Description | Default |
|---|---|---|---|
| language | Yes | 脚本语言 | |
| algorithm | Yes | 加密算法 | |
| key | No | 加密密钥 | |
| iv | No | IV偏移量(CBC模式) | |
| mode | No | 加密模式,如CBC/ECB | |
| padding | No | 填充方式,如PKCS7/ZeroPadding | |
| encoding | No | 输出编码,如base64/hex | |
| publicKey | No | RSA公钥(PEM格式) | |
| testPlaintext | No | 测试明文 | |
| testCiphertext | No | 测试密文(用于验证) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for behavioral disclosure. It mentions auto-saving to the output directory, but omits details about error handling, overwrite behavior, or dependencies such as requiring prior analysis (e.g., key extraction). The description is insufficient for an agent to predict side effects or constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the core action and output format. It is appropriately sized but could be more structured, perhaps separating the action from the automatic save behavior. It earns its place but leaves room for additional clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, no output schema), the description is incomplete. It does not explain what the generated script does (e.g., decrypts using specified algorithm), how to verify correctness, or what the output file contains. The agent lacks sufficient context to understand the tool's full purpose and outcomes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The tool description adds no additional meaning beyond the schema; it does not explain parameter relationships (e.g., when iv is needed for CBC mode) or provide usage examples. The description adds marginal value over the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: generating a complete decryption script (Python or JavaScript) based on analysis results, and automatically saving it. It uses a specific verb ('generate') and resource ('decrypt script'), distinguishing it from sibling tools like 'generate_encrypt_script' and 'generate_brute_script'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage 'based on analysis results' but does not explicitly state when to use this tool versus alternatives like generate_encrypt_script or brute force. It lacks guidance on prerequisites or context, leaving the agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_encrypt_scriptC
生成加密脚本(用于构造请求重放)
| Name | Required | Description | Default |
|---|---|---|---|
| language | Yes | 脚本语言 | |
| algorithm | Yes | 加密算法 | |
| key | No | 加密密钥 | |
| iv | No | IV偏移量 | |
| mode | No | 加密模式 | |
| padding | No | 填充方式 | |
| encoding | No | 输出编码 | |
| publicKey | No | RSA公钥 | |
| testPlaintext | No | 测试明文 | |
| testCiphertext | No | 期望密文 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose any behavioral traits such as side effects, authorization requirements, or output format. The agent cannot infer what happens when the tool is invoked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with key information. However, it could be more structured to improve readability, and the use of Chinese may limit accessibility.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, multiple algorithms) and lack of output schema, the description is too sparse. It does not explain the script's behavior, return value, or how to use the parameters effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameters are documented in the schema. The description adds no additional meaning beyond what is already provided. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates an encryption script for request replay, which is a specific verb and resource. It distinguishes from sibling tools like generate_decrypt_script. However, it could be more explicit about the purpose and scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like crypto_auto_detect or generate_decrypt_script. The description does not mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
js_get_all_scriptsA
获取当前页面加载的所有JavaScript脚本列表
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description lacks behavioral traits such as whether the list includes all scripts dynamically loaded, performance implications, or whether it returns URLs or IDs. The description is too minimal to inform the agent about side effects or execution context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, concise and to the point. No wasted words. However, it could be slightly more structured with a brief note on return value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, and description does not explain what the returned list contains (e.g., URLs, file names). For a tool that returns a list, this omission leaves the agent guessing about the data format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist (input schema is empty), so baseline is 4. The description does not need to add parameter details as there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool retrieves the list of all JavaScript scripts loaded on the current page ('获取当前页面加载的所有JavaScript脚本列表'). The verb '获取' and resource '脚本列表' are specific, and it distinguishes from siblings like js_get_script_source (gets source) and js_search_in_scripts (searches within scripts).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use or alternatives. The purpose is implied by the name and description, but without mentioning that it's a listing tool for obtaining script identities (e.g., URLs) versus siblings that operate on individual scripts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
js_get_encryption_contextB
获取加密函数及其所有依赖的完整上下文(函数本身+引用的变量/函数)
| Name | Required | Description | Default |
|---|---|---|---|
| functionName | Yes | 加密函数名 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as side effects, permissions required, or the format of the returned context. It remains vague about what 'complete context' entails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no extraneous words. It is appropriately front-loaded, though the use of Chinese characters may limit accessibility.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and annotations, the description does not adequately inform the agent about the return value or behavior. For a tool retrieving function context, more detail on output structure is necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage with a description for the single parameter 'functionName'. The description adds no additional meaning beyond the schema's brief '加密函数名', so it meets the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: obtaining the complete context of an encryption function including its dependencies. It specifies verb+resource and distinguishes from siblings such as js_get_function_body which only returns the function body.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like js_get_function_body or js_trace_call_chain. It does not mention scenarios where the full context is needed or when a simpler tool suffices.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
js_get_function_bodyB
根据函数名提取完整的函数实现代码
| Name | Required | Description | Default |
|---|---|---|---|
| functionName | Yes | 函数名,如 'encrypt', 'getPassword', 'encryptByAES' | |
| scriptId | No | 限定在指定脚本中搜索 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as what happens if the function is not found, whether the returned code includes comments or just the body, or if the operation is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence directly stating the tool's action, with no wasted words. It is front-loaded and appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should specify what 'complete function implementation code' entails (e.g., includes signature? body only? comments?). It is insufficient for an agent to understand the exact return format or error behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds no extra meaning beyond the schema; it simply restates 'function name'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'extract' and resource 'complete function implementation code'. It distinguishes from sibling tools like js_get_script_source (whole script) and js_search_in_scripts (search).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for extracting a specific function by name, but lacks explicit guidance on when to use this vs alternatives, or prerequisites like requiring the script to be loaded.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
js_get_script_sourceB
获取指定脚本的完整源码(自动美化格式化)
| Name | Required | Description | Default |
|---|---|---|---|
| scriptId | Yes | 脚本ID(从js_get_all_scripts获取) | |
| beautify | No | 是否美化代码,默认true | |
| maxLength | No | 最大返回字符数,默认30000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description mentions auto beautify but lacks disclosure of side effects, permissions, or read-only behavior. With no annotations, more behavioral context expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no fluff, front-loaded with verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, description does not explain return format, error handling, or behavior when scriptId is invalid. For a retrieval tool, more context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all parameters. Description adds 'auto beautify' but does not enhance parameter meanings beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states action (获取完整源码) and resource (指定脚本) with added context (自动美化格式化). Distinguishes from siblings like js_get_all_scripts and js_get_function_body.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or alternatives mentioned. Sibling tools like js_get_function_body exist but description doesn't guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
js_search_in_scriptsA
在所有JS脚本中搜索关键词/正则表达式,定位加密相关代码
| Name | Required | Description | Default |
|---|---|---|---|
| keyword | Yes | 搜索关键词或正则表达式,如 'encrypt|password|CryptoJS|JSEncrypt|md5|aes|rsa' | |
| isRegex | No | 是否使用正则表达式,默认true | |
| contextLines | No | 匹配行前后显示的上下文行数,默认5 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the tool searches scripts but does not disclose potential side effects or confirm it is read-only. The description describes basic functionality without elaborating on behavioral traits beyond what is obvious from the action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently communicates the verb, resource, and intent without any extraneous information. Every word contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, and the description does not specify the format or structure of the search results (e.g., matched lines, file paths). Given the tool's purpose, describing the return value is important for completeness, and this gap reduces the overall context provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters. The description does not add any additional meaning or usage context beyond what is in the schema, meeting the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the action (search), resource (all JS scripts), and purpose (locate encryption-related code) with a specific verb and resource. It distinguishes itself from sibling tools like js_get_all_scripts (which retrieves all scripts) and crypto_* tools (analysis after search).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly suggests usage for finding encryption code but does not explicitly state when to use this tool versus alternatives, nor does it mention when not to use it. No exclusions or alternative recommendations are provided, making it adequate but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
js_trace_call_chainA
追踪指定函数的调用链(谁调用了它,它又调用了谁)
| Name | Required | Description | Default |
|---|---|---|---|
| functionName | Yes | 目标函数名 | |
| depth | No | 追踪深度,默认2 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. It states it traces who called the function and who it called, but lacks details on side effects, performance, or limits. Basic behavior is conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single concise sentence with front-loaded action and resource, plus parenthetical clarification. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description lacks output format details (e.g., tree/list) and error conditions. Given no output schema, this is a gap. However, the tool is simple and input-driven, so a 3 is appropriate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with parameter descriptions for functionName and depth. Description adds no extra meaning beyond the schema for these parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action '追踪' (trace) and the resource '调用链' (call chain) of a specified function, distinguishing it from sibling tools that retrieve source or search scripts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like js_get_function_body or runtime_hook_function. The description only implies usage for tracing, leaving selection unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_compare_requestsB
对比多次请求的参数差异,帮助分析哪些参数是动态加密的
| Name | Required | Description | Default |
|---|---|---|---|
| requestIds | Yes | 要对比的请求ID列表(至少2个) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must cover behavioral traits. It does not disclose side effects, prerequisites (e.g., requests must exist), error behavior, or whether it is read-only. This leaves significant gaps for an AI agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the purpose. However, it could include more structure or bullet points for clarity without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description lacks information about return format, error cases, or prerequisites. An agent cannot fully understand what to expect from invoking this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a description for the single parameter 'requestIds' already stating 'at least 2'. The tool description adds purpose context but no additional parameter value or format details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool compares parameter differences across multiple requests to identify dynamically encrypted parameters. This is a specific verb+resource purpose that distinguishes it from sibling tools like network_get_request_detail or crypto_analyze_param.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for analyzing dynamic encryption by comparing requests but does not explicitly state when to use or avoid this tool, nor does it mention alternatives like crypto_analyze_param.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_disable_interceptA
关闭网络请求拦截
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must fully disclose behavior. It only states the action without mentioning side effects, persistence, or whether it affects future or ongoing requests. For a toggle operation, more detail is expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, short sentence in Chinese that is concise and front-loaded with the verb. Every word is necessary and there is no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple toggle with no parameters and no output schema, the description is minimally adequate. However, it lacks context about scope (e.g., global or per-request) and whether any prior enable is required. Given zero annotations, the description could be slightly more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and schema coverage is 100%, so the description does not need to add parameter details. The baseline of 4 is appropriate given no parameters exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb '关闭' (disable) and the resource '网络请求拦截' (network request interception), making the action unambiguous. It distinguishes itself from the sibling 'network_enable_intercept' which enables interception.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage context is provided. There is no guidance on when to disable interception, whether it should be preceded by enable, or any conditions. The sibling tool 'network_enable_intercept' implies a counterpart, but the description does not clarify usage scope or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_enable_interceptB
开启网络请求拦截,捕获所有HTTP请求(特别是登录请求)
| Name | Required | Description | Default |
|---|---|---|---|
| urlPatterns | No | URL过滤模式列表,如['*login*','*auth*'],不填则拦截所有请求 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as whether interception blocks requests, affects performance, or requires specific permissions. The term 'intercept' is vague; it does not explain the impact on network flow or how to retrieve captured data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words. However, it could be more structured by mentioning related tools or lifecycle (e.g., use before network_get_requests).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description should cover more: how to stop interception (sibling exists), whether it affects existing requests, and typical workflow. The current description leaves critical gaps for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains urlPatterns. The description adds context about 'especially login requests', which is helpful but does not significantly enhance parameter meaning. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool enables network request interception and captures all HTTP requests, with emphasis on login requests. This specific verb+resource combination distinguishes it from siblings like network_disable_intercept.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for capturing requests, especially login ones, but does not explicitly state when to use it versus alternatives (e.g., network_find_login_request after enabling). No clear when-not or prerequisite guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_find_login_requestA
智能定位登录请求,自动识别包含密码/加密参数的POST请求
| Name | Required | Description | Default |
|---|---|---|---|
| keywords | No | 额外关键词用于匹配,如['encrypt','cipher'] |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states it 'automatically identifies' requests but does not disclose what happens if no matching request exists, whether it modifies state, or any side effects. The tool's behavior beyond identification is unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that conveys the core functionality. It is front-loaded and efficient, though it could be slightly more detailed. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given one optional parameter and no output schema, the description is adequate but not fully complete. It does not specify the return format or what the output contains (e.g., list of request IDs). For a simple detection tool, it's minimally viable but could be improved.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'keywords' is described in the schema as 'additional keywords for matching, e.g., ['encrypt','cipher']'. The description adds value by explaining the purpose and providing examples, beyond the schema field name. Schema coverage is 100%, so baseline is 3; the example pushes it to 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: intelligently locate login requests by auto-identifying POST requests with password/encrypted parameters. It uses a specific verb and resource, and distinguishes from sibling tools like network_get_requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for finding login requests but provides no explicit guidance on when to use this tool versus alternatives such as crypto_auto_detect or network_compare_requests. No exclusions or context are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_get_request_detailA
获取单个请求的完整详情,包括请求头、请求体、响应
| Name | Required | Description | Default |
|---|---|---|---|
| requestId | Yes | 请求ID(从network_get_requests获取) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It explicitly states the return includes headers, body, and response, which is sufficient for a read operation. No side effects mentioned, but none expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that efficiently communicates purpose and scope, with no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given low complexity (1 param, no output schema), the description adequately covers what the tool does and what it returns. Could be slightly more detailed about return format, but sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for requestId. The tool description adds no extra meaning beyond the schema, providing no additional semantics for the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets complete details of a single network request, including headers, body, and response. It distinguishes from siblings like network_get_requests (which lists requests) and network_compare_requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when needing full details of a specific request, and the parameter description points to getting the ID from network_get_requests. However, no explicit when-not or alternatives are stated, leaving the agent to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_get_requestsC
获取已拦截的所有请求列表摘要
| Name | Required | Description | Default |
|---|---|---|---|
| method | No | 按HTTP方法过滤,如POST | |
| urlPattern | No | 按URL正则过滤 | |
| loginOnly | No | 仅返回疑似登录请求 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only states the tool gets a summary of intercepted requests, with no mention of side effects, authorization needs, or that it is read-only. This is insufficient for a tool that likely interacts with a network interception state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that directly states the tool's function with no unnecessary words. It is appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has three optional parameters and no output schema, the description should provide more context, such as the return format or that it only works when interception is active. The current description is too minimal.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters have descriptions in the schema, achieving 100% coverage. The tool description does not add extra meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description '获取已拦截的所有请求列表摘要' clearly indicates the tool retrieves a summary of all intercepted requests, distinguishing it from sibling tools like 'network_get_request_detail' and 'network_find_login_request'. However, the lack of an English description might hinder multilingual agents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'network_get_request_detail' or 'network_find_login_request'. The description does not mention prerequisites (e.g., interception must be enabled) or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_get_contentB
获取页面HTML内容或指定元素的内容
| Name | Required | Description | Default |
|---|---|---|---|
| selector | No | CSS选择器,不填则返回整个页面HTML |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description lacks behavioral details such as whether the tool is read-only, performance implications, or error handling. The basic purpose is stated, but transparency is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no unnecessary words. It communicates the core functionality clearly without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should provide more context about return format, error cases, or security considerations. It is too brief for a complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the selector parameter well described. The description adds no new meaning beyond the schema, stating only what is already implied (return full page if selector omitted). Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves page HTML content or content of a specified CSS element. It distinguishes itself from sibling tools like page_screenshot (visual) and page_navigate (navigation) by focusing on HTML content extraction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives. Usage is implied by the purpose, but no context is given about when it is appropriate or what prerequisites exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_screenshotB
截取当前页面截图,返回base64编码图片
| Name | Required | Description | Default |
|---|---|---|---|
| selector | No | 指定元素选择器进行截图,不填则截取整个视口 | |
| fullPage | No | 是否截取整个页面(包括滚动区域) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states screenshot action but doesn't disclose whether it's read-only, any side effects, or permission requirements, leaving behavioral traits unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words; front-loaded with action and output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 optional parameters and no output schema, description is minimal but functionally complete; however, lacks behavioral context like read-only nature or return format details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline 3; description adds no extra meaning beyond the schema fields (selector, fullPage).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (截取) and resource (当前页面) and output format (base64编码图片), distinguishing it from sibling tools like page_navigate or page_get_content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives; description merely states what it does without context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_call_functionB
调用页面中的指定全局函数,传入参数并获取返回值
| Name | Required | Description | Default |
|---|---|---|---|
| functionName | Yes | 全局函数名 | |
| args | No | 函数参数列表 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses that the tool calls a function and returns a value, but lacks details on side effects, error handling (e.g., if function undefined), or reliance on global scope. It is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is concise and to the point. No superfluous words. Could be slightly more structured (e.g., bullet points) but remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations; description should provide more context. Does not explain what happens if the function does not exist or if arguments are invalid. The args array format (positional vs named) is unspecified. Compared to richer sibling tool descriptions, this feels incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters ('global function name' and 'function argument list'). The description adds marginal value by stating that parameters are passed and a return value is obtained, which is already implied by the schema and tool name. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool calls a specified global function with parameters and returns the value, distinguishing it from siblings like runtime_evaluate (evaluates arbitrary JS) and runtime_hook_function (hooks functions). The verb 'call' and resource 'global function' are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., runtime_evaluate for arbitrary JS, runtime_hook_function for hooking). The description does not mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_evaluateB
在页面上下文中执行JavaScript代码(可用于填写表单、触发登录等)
| Name | Required | Description | Default |
|---|---|---|---|
| expression | Yes | 要执行的JS代码 | |
| awaitPromise | No | 是否等待Promise完成,默认false |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral disclosure. It only states that code executes in the page context but fails to mention whether execution is synchronous, what side effects are possible (e.g., navigation), error handling, or the effect of the awaitPromise parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with a parenthetical example. It is front-loaded with the core action and efficiently conveys purpose without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that executes arbitrary JavaScript—a potentially complex operation—the description lacks completeness. It does not specify return values, error behavior, or side effects, leaving the agent without enough context to use it safely, especially given no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with inline descriptions for both parameters. The tool description adds no additional meaning beyond the schema, meeting the baseline expectation for a tool with complete schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb: execute JavaScript code in the page context. It provides concrete usage examples (form filling, login triggering) that help distinguish it from sibling tools like runtime_call_function or runtime_get_global_vars.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through examples (form filling, login), but does not explicitly state when not to use this tool or suggest alternatives among the many sibling tools. Missing explicit guidance on when to prefer runtime_call_function or other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_get_global_varsB
获取页面全局作用域中与加密相关的变量和对象
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | 变量名过滤模式(正则),如'crypto|encrypt|key|CryptoJS' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the tool retrieves variables but does not disclose whether it is a read-only operation, any side effects, permission requirements, or performance implications. The absence of such details results in a baseline score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that directly states the tool's purpose without any unnecessary words. It is well-structured and front-loaded with the key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is incomplete as it does not explain the return value or output format. Since there is no output schema, the agent lacks information on what the tool returns (e.g., a list of variable names, key-value pairs, or objects). This gap is significant for effective usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the input schema already describes the single 'pattern' parameter with an example. The description adds no additional meaning beyond the schema. Therefore, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the tool's purpose: retrieving encryption-related variables and objects from the page's global scope. It uses a specific verb ('get') and resource ('global scope variables'), and implicitly distinguishes it from sibling tools that focus on analyzing crypto parameters, extracting keys, or identifying libraries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention prerequisites, typical use cases, or when to choose this over sibling tools like 'crypto_auto_detect' or 'crypto_identify_library'. The agent must infer from the tool name and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_get_hook_logsB
获取已Hook函数的调用记录(包含参数和返回值)
| Name | Required | Description | Default |
|---|---|---|---|
| functionName | No | 过滤指定函数名的日志,不填返回全部 | |
| clear | No | 获取后是否清除日志,默认false |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description should disclose behavioral traits like logging being ongoing, persistence, or effects of the 'clear' parameter. Only states it returns parameters and return values, missing critical context like what happens to logs after retrieval or if clearing is destructive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence in Chinese is concise and front-loads purpose. Could arguably include more structure like bullet points for usage notes, but not overly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description lacks context about the format of call records (e.g., timestamp, function call stack), the effect of clearing logs, and whether logs are accumulated across hook invocations. With no output schema and no annotations, this is insufficient for an agent to anticipate the tool's behavior fully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so description adds minimal value over schema. The parameter descriptions in schema (filter by function name, clear after fetch) are self-explanatory. Description does not elaborate on format or behavior beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool retrieves call records of hooked functions, including parameters and return values, using specific verb '获取' and resource '已Hook函数的调用记录'. This distinguishes it from sibling tools like runtime_hook_function which sets hooks, and other runtime tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives, such as runtime_hook_function or js_trace_call_chain. Does not mention the prerequisite that functions must be hooked first or that logging must be enabled.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_hook_functionB
Hook指定函数,记录每次调用的参数和返回值(用于捕获加密过程的输入输出)
| Name | Required | Description | Default |
|---|---|---|---|
| functionName | Yes | 要Hook的函数名(支持链式如 'CryptoJS.AES.encrypt') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavioral traits. It fails to mention whether the hook is reversible, if it modifies function behavior, performance impact, or error handling. Only states basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that front-loads the action and purpose. Efficient, though in Chinese which may impact clarity for non-Chinese agents, but content-wise concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers basic purpose and parameter but omits return value (likely logs), side effects, and relationship to sibling tool runtime_get_hook_logs. Adequate for simple tool but could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and already explains the functionName parameter with example of chained notation. Description adds no additional semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Hook' and resource '指定函数', clearly states purpose of recording parameters and return values for encryption I/O capture. Distinguishes from siblings like runtime_call_function and js_trace_call_chain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for capturing encryption process input/output, but lacks explicit when-to-use or when-not-to-use guidance. No mention of alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
script_test_runA
测试运行生成的脚本(仅支持JavaScript,Python需要本地python环境)
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | 要测试的JavaScript代码 | |
| testInput | No | 测试输入(会作为命令行参数传入) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It discloses constraints (only JavaScript direct support, Python requires local env) but does not describe the behavior of test execution (e.g., whether it runs in a sandbox, what side effects occur, or if it modifies state). The description adds some value but lacks depth for a code execution tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the purpose and main constraint. It is front-loaded with the key information and contains no unnecessary words. It could be slightly more structured (e.g., separated sections) but remains concise and readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool executes code, the description is incomplete. It lacks information about the output (e.g., whether it returns stdout, stderr, exit code) and how results are presented. No output schema is provided, so the description should compensate. It also does not mention any safety guarantees. For a tool that runs scripts, this leaves significant gaps for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters adequately described in the schema. The tool description does not add new meaning beyond the schema, which states code is JavaScript code to test and testInput is passed as a command line argument. Therefore, the description meets the baseline but does not enhance parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: testing generated scripts. It specifies the verb (test run) and resource (generated scripts), and distinguishes itself by noting that only JavaScript is directly supported while Python requires a local environment. This scope differentiates it from sibling tools that generate scripts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: for testing generated scripts, with the constraint that Python support requires a local environment. It does not explicitly state when not to use it or list alternative tools, but the constraint implies usage boundaries. A score of 4 reflects clear context without explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
31 tool updates
v1.0.0- First observed
browser_close - First observed
browser_launch - First observed
crypto_analyze_param - First observed
crypto_auto_detect - First observed
crypto_extract_key - First observed
crypto_identify_library - First observed
crypto_verify_algorithm - First observed
generate_brute_script - First observed
generate_decrypt_script - First observed
generate_encrypt_script - First observed
js_get_all_scripts - First observed
js_get_encryption_context - First observed
js_get_function_body - First observed
js_get_script_source - First observed
js_search_in_scripts - First observed
js_trace_call_chain - First observed
network_compare_requests - First observed
network_disable_intercept - First observed
network_enable_intercept - First observed
network_find_login_request - First observed
network_get_request_detail - First observed
network_get_requests - First observed
page_get_content - First observed
page_navigate - First observed
page_screenshot - First observed
runtime_call_function - First observed
runtime_evaluate - First observed
runtime_get_global_vars - First observed
runtime_get_hook_logs - First observed
runtime_hook_function - First observed
script_test_run
TDQS
Each tool has a clearly distinct purpose, with well-defined prefixes (browser_, crypto_, generate_, js_, network_, page_, runtime_, script_) that group related functions. There is minimal overlap; for example, crypto_analyze_param and crypto_auto_detect target different aspects (specific parameter vs. full scan).
All tool names follow a consistent verb_noun pattern with underscores, using prefixes to indicate domain (e.g., browser_launch, crypto_auto_detect, network_get_requests). No mixed conventions or ambiguous verbs.
31 tools is relatively high, but the domain of JavaScript reverse engineering is inherently complex, requiring tools for browser control, crypto analysis, JS analysis, network interception, script generation, and testing. Each tool justifies its existence, though some consolidation might be possible (e.g., crypto_analyze_param and crypto_auto_detect could merge).
The tool set covers the full workflow: launch browser, navigate, intercept network, analyze JS, detect crypto, extract keys, generate encryption/decryption/brute-force scripts, and test them. No obvious gaps; even edge cases like hooking functions and tracing call chains are included.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for understanding Javascript internals from ECMAScript specification.
Browser MCP for logged-in tasks. Uses your Chrome — credentials stay local. Zero-token replay.
Reasoning, code, anti-deception, memory harness MCP tools. Stdio or HTTPS api.ejentum.com/mcp
MCP server for static security analysis of Android source code
Related MCP Servers
- AlicenseCqualityBmaintenanceAn MCP server for JavaScript reverse engineering that enables AI to perform browser debugging, script analysis, and automated hook injection. It streamlines complex workflows like deobfuscation, network tracing, and risk assessment through direct browser integration.3527995Apache 2.0
- AlicenseNot gradedqualityDmaintenanceProvides JavaScript reverse engineering capabilities including static analysis, dynamic execution, and bypassing anti-bot protections like Cloudflare 5-second challenge.10Apache 2.0
- AlicenseNot gradedqualityCmaintenanceA JavaScript reverse engineering MCP server that enables AI coding assistants to debug and analyze JavaScript code in web pages.1,2917Apache 2.0
- FlicenseNot gradedqualityBmaintenanceExposes reverse engineering capabilities via MCP protocol, enabling AI agents to automatically detect, analyze, trace, and deobfuscate JSVMP protected JavaScript code.2-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/jenn619/JS-reverse-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server