jenn619/js-reverse-mcp

This page was translated automatically. Technical details may differ from the original. View the original

20 stars 3 forks Quality 69 Trend 14

Recently, I did penetration testing for the client company and found that many of their websites had encrypted login parameters. To improve work efficiency, I wrote a JS reverse MCP and paired it with the newly released Qoder and it worked quite well.

Overview

Chrome browser JS reverse analysis MCP tool — specifically designed for dynamic analysis and restoration of login box encryption logic in CTF/Web security scenarios : You can start it with the recently released Qoder, with 200 free calls per day to Qwen3.7-Max. Before running, Qcoder can automatically fill in the required dependencies for your project and modify configuration files based on your local environment. This project is a protocol-based JS reverse engineering toolkit that dynamically analyzes JavaScript encryption logic in target pages using Chrome DevTools Protocol (CDP), automatically identifies encryption algorithms, extracts keys, and generates usable encryption/decryption scripts. - Control Chrome browser based on Puppeteer, dynamically executing target page JS - Use CDP protocol to intercept network requests, obtain script source code, and call hook functions - Built-in encryption algorithm feature library supporting AES/DES/RSA/MD5/SHA/SM2/SM4/Base64, etc. - Automatically generate Python and JavaScript encryption/decryption/brute-force scripts - Exposes 31 standardized tool interfaces via MCP protocol, supports integration with AI assistants AES-CBC、AES-ECB、DES、3DES、RSA、MD5、SHA256、Base64、Custom Add to the MCP configuration file of AI clients (such as Cursor, Claude Desktop, etc.): Call browser_launch → page_navigate → page_screenshot Call network_enable_intercept, then manually perform a login operation on the page.

Overview (machine translated)

Chrome JS reverse analysis MCP tool — specifically designed for dynamic analysis and restoration of login box encryption logic in CTF/Web security scenarios

Suggestion: You can start with the recently released Qoder and make 200 free calls to Qwen3.7-Max per day. Before running, Qcoder can automatically fill in the required dependencies for your project and automatically modify the configuration file based on your local environment.

I. Project Introduction

This project is a JS reverse analysis toolset based on the MCP (Model Context Protocol) protocol. It dynamically analyzes JavaScript encryption logic in target pages using Chrome DevTools Protocol (CDP), automatically identifies encryption algorithms, extracts keys, and generates usable encryption/decryption scripts.

Core Competencies:

Control Chrome browser based on Puppeteer and dynamically execute target page JS
Use the CDP protocol to intercept network requests, obtain script source code, and perform Hook function calls
Built-in encryption algorithm feature library, supporting AES/DES/RSA/MD5/SHA/SM2/SM4/Base64, etc
Automatically generates encryption/decryption/brute-force scripts for Python and JavaScript
Exposed 31 standardized tool interfaces via the MCP protocol, supporting integration with AI assistants

2. Technology Stack

Category	Technology	Description
Language	TypeScript 5.7 + Node.js ≥18	Main development language
Agreement	@modelcontextprotocol/sdk v1.29	MCP protocol SDK
Browser	puppeteer-core v23	Chrome Automation Control
AST Analysis	acorn + acorn-walk	JS Syntax Tree Parsing and Traversal
Crypto Analysis	crypto-js + node-forge	Encryption algorithm verification and restoration
Code Beautification	js-beautify	Confusing JS code formatting
Template Engine	mustache	Script generation template
Data Validation	zod v3.23	MCP message schema validation

3. Project Structure

4. Tool Checklist

Tool Name	Function	Key Parameters
`browser_launch`	Launching Chrome Browser Instances	`headless`, `chromePath`, `proxy`, `wsEndpoint`
`browser_close`	Close your browser and release resources	None

This page was translated automatically. Technical details may differ from the original.

Install

This server does not publish a one-line install command.

Open the repository installation guide New to MCP? Start with the mcpskill.org guide →

Configuration

{
  "mcpServers": {
    "js-reverse": {
      "command": "node",
      "args": ["e:\\Qwen\\build\\index.js"],
      "env": {
        "CHROME_PATH": "C:\\Users\\fangz\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
        "OUTPUT_DIR": "e:\\Qwen\\output"
      }
    }
  }
}