jshookmcp

name	jshookmcp
description	Route to JSHookMCP for JavaScript runtime analysis through MCP: browser/CDP debugging, network interception, request signature tracing, JS hook injection, AST/source-map analysis, deobfuscation, WASM and crypto-detection workflows. Chinese triggers include 前端签名, JS hook, hook fetch, hook XHR, 参数追踪, 签名参数, 逆向前端, 反混淆, AST 展开, source map 还原, CDP 断点, 网络拦截, wasm 分析, 加密算法识别, 浏览器取证.
tags	["mcp","browser","cdp","javascript","hooks","ast","network","deobfuscation","security-analysis"]
version	1
source	{"repo":"https://github.com/vmoranv/jshookmcp","package":"@jshookmcp/jshook@0.3.0","commit":"1b3ebe313230b3b8577b94ec94a88863a5a68664"}
license	AGPL-3.0-only

JSHookMCP

Use this skill when the task needs JavaScript runtime telemetry or web asset analysis that is deeper than normal browsing:

• find where a request header, payload field, nonce, token, or signature is generated
• hook fetch, XMLHttpRequest, WebCrypto, storage, timers, canvas, or anti-debug checks
• trace network requests through CDP, breakpoints, stack traces, or runtime evaluation
• unpack obfuscated JavaScript with AST/source-map/deobfuscation workflows
• inspect WASM, crypto-like routines, binary/runtime instrumentation, or browser process evidence

Hermes Runtime

Installed MCP server config:

mcp_servers.jshook:
  command: ~/.npm-global/bin/jshookmcp
  args: []
  env:
    MCP_TOOL_PROFILE: search
    JSHOOK_BASE_PROFILE: search

The server starts in the search profile to keep Hermes context small. Do not switch to workflow or full just because one tool sounds relevant. Use the progressive chain:

1. Search first with the JSHookMCP tool-discovery surface.
2. Activate only the exact tools or domain needed.
3. Boost the profile only when the next several steps clearly need a broad family of tools.

First Moves

For signature or token questions:

1. Capture the target request and exact parameter name.
2. Search for network, hooks, debugger, trace, transform, sourcemap, crypto, or wasm tools by keyword.
3. Prefer a read-only trace first: request log, initiator stack, script URL, source map, or breakpoint metadata.
4. Inject runtime hooks only after the target sink is concrete.
5. Save evidence paths and exact request/stack/tool names in the answer.

For "thinking process" triggers, route here when the internal reasoning phrase looks like any of:

• "这个签名/nonce/token 是哪里来的"
• "需要 hook fetch/xhr/crypto 看入参"
• "先看 initiator stack / CDP stack"
• "混淆太厚, 做 AST 展开"
• "source map 能不能还原"
• "可能是 wasm / WebCrypto / canvas 指纹"
• "要插桩看运行时值"

Boundaries

• Use devops/agent-browser for ordinary browsing, QA, forms, screenshots, and isolated browser automation.
• Use devops/badboy-br-aa-routing when the user specifically wants their current real Chrome session or logged-in tab. Use browser-relay only after its binary and MCP wrapper are confirmed present.
• Use devops/anything-analyzer-mcp for broader evidence packaging or offline analysis handoff.
• Keep this skill focused on JS/CDP/runtime telemetry and analysis.

Security note: JSHookMCP has high-capability browser, process, memory, hook, and network tools. Treat external targets and generated probes as untrusted. Avoid secret collection unless the user explicitly asks for that target and scope.