js-reverse-mcp

dandany/js-reverse-mcp

Hosted

0 Stars 269 次浏览更新于 2026-08-23

一个JavaScript逆向工程MCP服务器，使AI编码助手能够调试和分析网页中的JavaScript代码。它基于Patchright反检测引擎构建，可以在具有机器人检测的网站上工作。

浏览器自动化

MCP 服务配置

复制以下 JSON 到 OPClaw 或其他 MCP 客户端的配置文件中即可使用

{
  "mcpServers": {
    "js-reverse": {
      "args": [
        "js-reverse-mcp",
        "--browser-url=http://127.0.0.1:9222"
      ],
      "command": "npx"
    }
  }
}

可用工具（23 个）

该服务在 MCP 协议中暴露的工具，AI 可按需调用

break_on_xhr 1 个参数需填 1 项 Sets a breakpoint that triggers when an XHR/Fetch request URL contains the specified string.

Sets a breakpoint that triggers when an XHR/Fetch request URL contains the specified string.

必填参数：url

evaluate_script 3 个参数需填 1 项 Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON so returned values have to JSON-serializable. When execution is paused at a breakpoint, automatically evaluates in the paused call frame context.

Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON so returned values have to JSON-serializable. When execution is paused at a breakpoint, automatically evaluates in the paused call frame context.

必填参数：function

get_paused_info 3 个参数 Gets information about the current paused state including call stack, current location, and scope variables. Use this after a breakpoint is hit to understand the execution context.

Gets information about the current paused state including call stack, current location, and scope variables. Use this after a breakpoint is hit to understand the execution context.

该工具无需必填参数，直接调用即可

get_request_initiator 1 个参数需填 1 项 Gets the JavaScript call stack that initiated a network request. This helps trace which code triggered an API call.

Gets the JavaScript call stack that initiated a network request. This helps trace which code triggered an API call.

必填参数：requestId

get_script_source 6 个参数 Gets a small snippet of a JavaScript script source by URL (recommended) or script ID. Supports line range (for normal files) or character offset (for minified single-line files). Prefer using url over scriptId — URLs remain stable across page navigations while script IDs become invalid after reload. IMPORTANT: This tool is designed for reading small code regions (e.g. around breakpoints or search results). You MUST always specify startLine/endLine or offset/length. To read an entire script file, use curl to download it by its URL instead.

Gets a small snippet of a JavaScript script source by URL (recommended) or script ID. Supports line range (for normal files) or character offset (for minified single-line files). Prefer using url over scriptId — URLs remain stable across page navigations while script IDs become invalid after reload. IMPORTANT: This tool is designed for reading small code regions (e.g. around breakpoints or search results). You MUST always specify startLine/endLine or offset/length. To read an entire script file, use curl to download it by its URL instead.

该工具无需必填参数，直接调用即可

get_websocket_messages 10 个参数 Lists WebSocket connections or gets messages for a specific connection. Without wsid, lists all connections. With wsid, gets messages. Set analyze=true to group messages by pattern. Use groupId to filter by group. Use frameIndex to get a single message's full detail.

Lists WebSocket connections or gets messages for a specific connection. Without wsid, lists all connections. With wsid, gets messages. Set analyze=true to group messages by pattern. Use groupId to filter by group. Use frameIndex to get a single message's full detail.

该工具无需必填参数，直接调用即可

inject_before_load 2 个参数 Injects a JavaScript script that runs before any page script on every page load. Pass script to inject, or pass identifier to remove a previously injected script.

Injects a JavaScript script that runs before any page script on every page load. Pass script to inject, or pass identifier to remove a previously injected script.

该工具无需必填参数，直接调用即可

list_breakpoints Lists all active breakpoints in the current debugging session. Breakpoints persist across page navigations and are automatically restored after reload/goto/back/forward.

Lists all active breakpoints in the current debugging session. Breakpoints persist across page navigations and are automatically restored after reload/goto/back/forward.

该工具无需必填参数，直接调用即可

list_console_messages 5 个参数 List all console messages for the currently selected page since the last navigation. Pass msgid to get a single message by its ID.

List all console messages for the currently selected page since the last navigation. Pass msgid to get a single message by its ID.

该工具无需必填参数，直接调用即可

list_network_requests 6 个参数 List network requests for the currently selected page since the last navigation. Results are sorted newest-first. By default returns the 20 most recent requests; use pageSize/pageIdx to paginate. Pass reqid to get a single request's full details.

List network requests for the currently selected page since the last navigation. Results are sorted newest-first. By default returns the 20 most recent requests; use pageSize/pageIdx to paginate. Pass reqid to get a single request's full details.

该工具无需必填参数，直接调用即可

list_scripts 1 个参数 Lists all JavaScript scripts loaded in the current page. Returns script ID, URL, and source map information. Use this to find scripts before setting breakpoints or searching. Script IDs are automatically refreshed after page navigation, so listed IDs are always valid.

Lists all JavaScript scripts loaded in the current page. Returns script ID, URL, and source map information. Use this to find scripts before setting breakpoints or searching. Script IDs are automatically refreshed after page navigation, so listed IDs are always valid.

该工具无需必填参数，直接调用即可

navigate_page 4 个参数 Navigates the currently selected page to a URL, or performs back/forward/reload navigation. Waits for DOMContentLoaded event (not full page load). Default timeout is 10 seconds. After navigation, stale script IDs are cleared and fresh ones are captured automatically. All breakpoints (URL, XHR, DOM) are preserved across navigation.

Navigates the currently selected page to a URL, or performs back/forward/reload navigation. Waits for DOMContentLoaded event (not full page load). Default timeout is 10 seconds. After navigation, stale script IDs are cleared and fresh ones are captured automatically. All breakpoints (URL, XHR, DOM) are preserved across navigation.

该工具无需必填参数，直接调用即可

new_page 2 个参数需填 1 项 Creates a new page and navigates to the specified URL. Waits for DOMContentLoaded event (not full page load). Default timeout is 10 seconds.

Creates a new page and navigates to the specified URL. Waits for DOMContentLoaded event (not full page load). Default timeout is 10 seconds.

必填参数：url

pause_or_resume Toggles JavaScript execution. If paused, resumes execution. If running, pauses execution.

Toggles JavaScript execution. If paused, resumes execution. If running, pauses execution.

该工具无需必填参数，直接调用即可

remove_breakpoint 2 个参数 Removes breakpoints and automatically resumes execution if paused. Pass breakpointId to remove a code breakpoint, url to remove an XHR breakpoint, or neither to remove ALL breakpoints (code + XHR).

Removes breakpoints and automatically resumes execution if paused. Pass breakpointId to remove a code breakpoint, url to remove an XHR breakpoint, or neither to remove ALL breakpoints (code + XHR).

该工具无需必填参数，直接调用即可

save_script_source 3 个参数需填 1 项 Saves the full source code of a JavaScript script to a local file. Use this to download complete script sources for offline analysis, especially for large or minified files that are too big to view inline with get_script_source.

Saves the full source code of a JavaScript script to a local file. Use this to download complete script sources for offline analysis, especially for large or minified files that are too big to view inline with get_script_source.

必填参数：filePath

search_in_sources 7 个参数需填 1 项 Searches for a string or regex pattern in all loaded JavaScript sources. Returns matching lines with script ID, URL, and line number. Use get_script_source with startLine/endLine to view full context around matches.

Searches for a string or regex pattern in all loaded JavaScript sources. Returns matching lines with script ID, URL, and line number. Use get_script_source with startLine/endLine to view full context around matches.

必填参数：query

select_frame 1 个参数 Lists all frames (including iframes) in the current page. Pass frameIdx to switch execution context to that frame for evaluate_script and other tools.

Lists all frames (including iframes) in the current page. Pass frameIdx to switch execution context to that frame for evaluate_script and other tools.

该工具无需必填参数，直接调用即可

select_page 1 个参数 Lists all open pages in the browser. Pass pageIdx to select a page as context for future tool calls.

Lists all open pages in the browser. Pass pageIdx to select a page as context for future tool calls.

该工具无需必填参数，直接调用即可

set_breakpoint_on_text 4 个参数需填 1 项 Sets a breakpoint on specific code (function name, statement, etc.) by searching for it and automatically determining the exact position. Works with both normal and minified files. Breakpoints persist across page navigations.

Sets a breakpoint on specific code (function name, statement, etc.) by searching for it and automatically determining the exact position. Works with both normal and minified files. Breakpoints persist across page navigations.

必填参数：text

step 1 个参数需填 1 项 Steps JavaScript execution. Use direction "over" to skip function calls, "into" to enter function bodies, "out" to exit the current function. Returns the new location with source context.

Steps JavaScript execution. Use direction "over" to skip function calls, "into" to enter function bodies, "out" to exit the current function. Returns the new location with source context.

必填参数：direction

take_screenshot 4 个参数 Take a screenshot of the page or element.

Take a screenshot of the page or element.

该工具无需必填参数，直接调用即可

trace_function 6 个参数需填 1 项 Traces calls to a function by its name in the source code. Works for ANY function including module-internal functions (webpack/rollup bundled). Uses "logpoints" (conditional breakpoints) to log arguments without pausing execution. Trace breakpoints persist across page navigations.

Traces calls to a function by its name in the source code. Works for ANY function including module-internal functions (webpack/rollup bundled). Uses "logpoints" (conditional breakpoints) to log arguments without pausing execution. Trace breakpoints persist across page navigations.

必填参数：functionName

服务介绍

JS 反向 MCP

English | 中文

一个 JavaScript 反向工程 MCP 服务器，使 AI 编码助手（Claude, Cursor, Copilot）能够调试和分析网页中的 JavaScript 代码。

基于 Patchright 反检测引擎，具有多层反机器人绕过能力，可以在知乎和谷歌等具有机器人检测的网站上工作。

功能

反检测浏览器：基于 Patchright（Playwright 的反检测分支），60 多个隐身启动参数，绕过主流反机器人系统
脚本分析：列出所有加载的 JS 脚本，搜索代码，获取/保存源代码
断点调试：设置/移除断点，条件断点，在压缩代码中精确定位
函数跟踪：通过日志点跟踪任何函数（包括模块内部函数）
执行控制：暂停/恢复执行，带有源上下文的步进调试（跳过/进入/跳出）
运行时检查：在断点处评估表达式，检查作用域变量
网络分析：查看请求发起者的调用堆栈，设置 XHR 断点，WebSocket 消息分析
脚本注入：在页面加载前注入脚本以进行拦截和工具化

要求

Node.js v20.19 或更高版本
Chrome 稳定版

快速开始 (npx)

无需安装。将以下配置添加到您的 MCP 客户端配置中：


{

  "mcpServers": {

    "js-reverse": {

      "command": "npx",

      "args": ["js-reverse-mcp"]

    }

  }

}

Claude 代码


claude mcp add js-reverse npx js-reverse-mcp

Codex


codex mcp add js-reverse -- npx js-reverse-mcp

Cursor

转到 Cursor 设置 -> MCP -> 新建 MCP 服务器，并使用上述配置。

VS Code Copilot


code --add-mcp '{"name":"js-reverse","command":"npx","args":["js-reverse-mcp"]}'

本地安装（替代方法）


git clone https://github.com/nicecaesar/js-reverse-mcp.git

cd js-reverse-mcp

npm install

npm run build

然后在您的 MCP 配置中使用本地路径：


{

  "mcpServers": {

    "js-reverse": {

      "command": "node",

      "args": ["/path/to/js-reverse-mcp/build/src/index.js"]

    }

  }

}

反检测

js-reverse-mcp 包含多层反检测措施，以便在具有机器人检测的网站上工作：

反检测架构

层	描述
Patchright 引擎	C++ 级别的反检测补丁，移除 `navigator.webdriver`，避免 `Runtime.enable` 泄露
60 多个隐身参数	移除自动化签名，绕过无头检测，GPU/网络/行为指纹欺骗
有害参数移除	排除 `--enable-automation` 和其他 4 个默认 Playwright 参数
静默 CDP 导航	导航工具不激活 CDP 域，仅通过 Playwright 级别监听器捕获请求，防止反机器人脚本检测调试协议活动
Google 引荐来源伪装	所有导航自动包含 `referer: https://www.google.com/`
持久登录状态	默认使用持久用户数据目录，跨会话保持登录状态

工具（23 个）

页面与导航

工具	描述
`select_page`	列出打开的页面，或按索引选择一个作为调试上下文
`new_page`	创建一个新页面并导航到 URL
`navigate_page`	导航、后退、前进或重新加载
`select_frame`	列出所有框架（iframe），或选择一个作为执行上下文
`take_screenshot`	截取页面屏幕截图

脚本分析

工具	描述
`list_scripts`	列出页面中加载的所有 JavaScript 脚本
`get_script_source`	按行范围或字符偏移获取脚本源代码片段
`save_script_source`	将完整的脚本源代码保存到本地文件（适用于大型/压缩文件）
`search_in_sources`	在所有脚本中搜索字符串或正则表达式模式

工具	描述
`set_breakpoint_on_text`	通过搜索代码文本设置断点（适用于压缩代码）
`break_on_xhr`	通过 URL 模式设置 XHR/Fetch 断点
`remove_breakpoint`	通过 ID、URL 或全部移除断点；自动恢复
`list_breakpoints`	列出所有活动断点
`get_paused_info`	获取暂停状态、调用堆栈和作用域变量
`pause_or_resume`	切换暂停/恢复执行
`step`	在响应中带有源上下文的情况下单步跳过、进入或跳出

函数跟踪与注入

工具	描述
`trace_function`	通过日志点跟踪任何函数调用（包括打包的内部函数）
`inject_before_load`	注入或移除在页面加载前运行的脚本

网络与 WebSocket

工具	描述
`list_network_requests`	列出网络请求，或通过 reqid 获取一个
`get_request_initiator`	获取网络请求的 JavaScript 调用堆栈
`get_websocket_messages`	列出 WebSocket 连接，分析消息，或获取消息详情

检查

工具	描述
`evaluate_script`	在页面中执行 JavaScript（支持暂停上下文和主世界）
`list_console_messages`	列出控制台消息，或通过 msgid 获取一条

使用示例

基本的 JS 反向工程工作流程

打开目标页面


Open https://example.com and list all loaded JS scripts

查找目标函数


Search all scripts for code containing "encrypt"

设置断点


Set a breakpoint at the entry of the encryption function

触发并分析


Trigger an action on the page, then inspect arguments, call stack and scope variables when the breakpoint hits

跟踪模块内部函数


Use trace_function to trace the webpack-bundled internal function "encryptData",

view arguments of each call without setting breakpoints

WebSocket 协议分析


List WebSocket connections, analyze message patterns, view messages of specific types

配置选项

选项	描述	默认值
`--browserUrl, -u`	连接到正在运行的 Chrome 实例	-
`--wsEndpoint, -w`	WebSocket 终端连接	-
`--headless`	以无头模式运行	false
`--executablePath, -e`	自定义 Chrome 可执行文件路径	-
`--isolated`	使用临时用户数据目录（每次都是新的）	false
`--channel`	Chrome 通道: stable, canary, beta, dev	stable
`--viewport`	初始视口大小，例如 `1280x720`	实际大小
`--hideCanvas`	启用 Canvas 指纹噪声	false
`--blockWebrtc`	阻止 WebRTC 以防止真实 IP 泄露	false
`--disableWebgl`	禁用 WebGL 以防止 GPU 指纹识别	false
`--noStealth`	禁用隐身启动参数（用于调试）	false
`--proxyServer`	代理服务器配置	-
`--logFile`	调试日志文件路径	-

示例配置

增强反检测（Canvas 噪声 + WebRTC 阻止）：


{

  "mcpServers": {

    "js-reverse": {

      "command": "npx",

      "args": [

        "js-reverse-mcp",

        "--hideCanvas",

        "--blockWebrtc"

      ]

    }

  }

}

隔离模式（无持久登录，每次使用新配置文件）：


{

  "mcpServers": {

    "js-reverse": {

      "command": "npx",

      "args": [

        "js-reverse-mcp",

        "--isolated"

      ]

    }

  }

}

连接到正在运行的 Chrome 实例1. 启动 Chrome（请先关闭所有 Chrome 窗口，然后重新启动）：

macOS


/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 --user-data-dir=/tmp/chrome-debug

Windows


"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="%TEMP%\chrome-debug"

配置 MCP 连接：


{

  "mcpServers": {

    "js-reverse": {

      "command": "npx",

      "args": [

        "js-reverse-mcp",

        "--browser-url=http://127.0.0.1:9222"

      ]

    }

  }

}

故障排除

被反机器人系统阻止

如果您在访问某些网站时被阻止（例如知乎返回错误 40362）：

清除受污染的配置文件：删除 ~/.cache/chrome-devtools-mcp/chrome-profile 目录
使用隔离模式：添加 --isolated 标志
启用 Canvas 噪声：添加 --hideCanvas 标志

安全须知

此工具将浏览器内容暴露给 MCP 客户端，允许检查、调试和修改浏览器中的任何数据。请勿在包含敏感信息的页面上使用它。

许可证

Apache-2.0

查看源码项目主页

MCP 服务配置

可用工具 （23 个）

服务介绍

JS 反向 MCP

功能

要求

快速开始 (npx)

Claude 代码

Codex

Cursor

VS Code Copilot

本地安装（替代方法）

反检测

反检测架构

工具（23 个）

页面与导航

脚本分析

函数跟踪与注入

网络与 WebSocket

检查

使用示例

基本的 JS 反向工程工作流程

跟踪模块内部函数

WebSocket 协议分析

配置选项

示例配置

连接到正在运行的 Chrome 实例1. 启动 Chrome（请先关闭所有 Chrome 窗口，然后重新启动）：

故障排除

被反机器人系统阻止

安全须知

许可证

相关 MCP 服务

开源版 与 企业版

企业版（含 FDE 交付）

技能定制开发服务

可用工具（23 个）

开源版与企业版