Dan Kornas (@DanKornas) on X

What it claims

jshook is an MCP server that gives AI agents a reverse-engineering workspace for JavaScript, browser traffic, WebAssembly and native processes. The announcement names three analysis functions that the catalog summary does not: JavaScript deobfuscation, source map reconstruction, and WebAssembly disassembly and inspection. It also states that the browser automation layer has interceptors for popups, downloads, permissions and protocols. It is released under AGPL-3.0.

How it works

The design premise, in the author's framing, is that reverse-engineering a web app "shouldn't start with a wall of MCP schemas." An agent starts on a small, searchable tool profile with a smaller metadata footprint. It promotes to a workflow profile or a full profile only when the investigation needs more tools. This keeps the tool schemas loaded into the agent's context small at the start of a task.

The other capabilities sit behind the same MCP surface:

• Browser: drives Chromium or Camoufox over CDP, with the interceptors listed above.
• Network: captures WebSocket traffic and has HTTP, GraphQL and Burp Suite helpers.
• Extension: hot-reload plugins and declarative workflows can be added without redeploying the server.

Limits

The post is a feature list. It has no install or run command, no repository URL (the link is in a reply that was not fetched), no list of supported MCP clients, and no version number. It gives no benchmarks or examples. It does not say how a profile is promoted, whether automatically or by explicit request. It names native-process analysis as a scope but describes no native tooling.

AGPL-3.0 is a strong copyleft licence. It requires source disclosure when modified versions are offered to users over a network, so teams should check it before embedding jshook in a hosted service. The tool drives browsers and proxies traffic, so it should only be pointed at applications the user is authorised to test.