{"name":"io.github.vmoranv/jshookmcp","slug":"vmoranv-jshookmcp","title":null,"description":"Search-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.","url":"https://mcp.market/server/vmoranv-jshookmcp","rating":null,"grade":"A","score":85,"certified":false,"status":"active","category":"search","tags":["search"],"presence":{"score":65,"stars":2108,"forks":465,"downloads_week":1148,"last_push_at":"2026-11-10T12:20:14.000Z","license":"AGPL-3.0"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/vmoranv/jshookmcp","website":"https://vmoranv.github.io/jshookmcp/","version":"0.4.2","remotes":[],"packages":[{"registryType":"npm","identifier":"@jshookmcp/jshook","version":"0.4.2","transport":{"type":"stdio"}}],"tools":[{"name":"activate_tools","description":"Dynamically register specific tools by name, regardless of current base tier. Use after search_tools to enable exactly the tools you need. In search-tier sessions this is usually enough; use activate_domain when you need every tool in a domain. Activated tools appear in the tool list immediately. If tools do not appear after activation, use call_tool to invoke them directly.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_apk_analyze","description":"Analyze an installed APK: package, permissions, activities, and security info.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_apk_pull","description":"Pull an APK from a device to the local filesystem.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_app_cold_start_trace","description":"High-level Android startup trace: force-stop, clear logcat, start activity with -W, wait, collect PID-filtered logs, and parse launch/Looper timing.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_device_list","description":"List all connected Android devices and emulators.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_dumpsys","description":"Run adb shell dumpsys for a service and return parsed structured output. Supports key-value extraction, array parsing, and section detection. Common services: package, activity, window, battery, meminfo, alarm, cpuinfo, diskstats, netstats, usagestats.","write_action":true,"price_micros":0,"input_schema":null},{"name":"adb_file_pull","description":"Pull a file from an Android device using normal ADB permissions.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_file_push","description":"Push a local file to an Android device using normal ADB permissions.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_getprop","description":"Dump and parse Android system properties (getprop) into a structured map with a curated device fingerprint (model, SDK, ABI, build fingerprint, security patch, bootloader lock).","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_input_keyevent","description":"Send an Android keyevent name or numeric key code through adb shell input.","write_action":true,"price_micros":0,"input_schema":null},{"name":"adb_input_swipe","description":"Send a touchscreen swipe event through adb shell input.","write_action":true,"price_micros":0,"input_schema":null},{"name":"adb_input_tap","description":"Send a touchscreen tap event through adb shell input.","write_action":true,"price_micros":0,"input_schema":null},{"name":"adb_input_text","description":"Send text through adb shell input text with Android-safe whitespace encoding.","write_action":true,"price_micros":0,"input_schema":null},{"name":"adb_install","description":"Install one APK or a split-APK set onto a device with parsed success output.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_logcat_query","description":"Capture and filter Android logcat output in-process without shell grep pipelines.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_package_summary","description":"Return structured Android package metadata: launcher, uid, versions, permissions, components, and native library dirs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_port_forward","description":"Manage ADB forward/reverse port mappings for device-host bridge workflows.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_proc_maps","description":"Read and parse /proc/PID/maps from a device, resolving PID from packageName when needed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_pull_native_libs","description":"Pull native shared libraries (.so) for an installed app from a device.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_root_check","description":"Probe root indicators such as su, Magisk, test-keys, SELinux, and shell uid.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_screenrecord","description":"Record a short MP4 screen capture through adb shell screenrecord and pull it locally.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_screenshot","description":"Capture a PNG screenshot through adb exec-out screencap -p.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_shell","description":"Execute an ADB shell command on a specific device.","write_action":true,"price_micros":0,"input_schema":null},{"name":"adb_ui_dump","description":"Capture Android UI hierarchy via uiautomator dump. Runs uiautomator dump on-device, pulls the XML, and returns parsed UI tree. Useful for UI automation verification, layout inspection, and accessibility tree analysis.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_uninstall","description":"Uninstall a package from a device, optionally keeping app data.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_webview_attach","description":"Attach to a WebView via ADB; returns WebSocket debugger URL for CDP.","write_action":false,"price_micros":0,"input_schema":null},{"name":"adb_webview_list","description":"List debuggable WebView targets connected via ADB.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ai_hook","description":"Manage AI hooks. Actions: inject (inject code into page), get_data (retrieve captured hook data), list (all active hooks), clear (remove hook data by id or all), toggle (enable/disable a hook), export (export data as JSON/CSV).","write_action":false,"price_micros":0,"input_schema":null},{"name":"ai_suggest_exploits","description":"Use LLM to suggest exploit primitives and attack chains for a given vulnerability. Returns theoretical exploitation steps, references, and required conditions. IMPORTANT: Does NOT generate executable payloads or malicious code.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analysis_ast_match","description":"Match AST nodes by type and optional property filter.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analysis_data_flow","description":"Trace data flow through JavaScript: identify sources (user input, network, storage), sinks (XSS, eval, SQL injection, command execution), sanitizer pass-through points, and tainted variable propagation paths. Useful for finding injection vulnerabilities.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analysis_decode_string_array","description":"Decode literal string-array access back to strings.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analysis_deflat_control_flow","description":"Flatten switch-dispatch control flow back to straight-line code.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analysis_security_scan","description":"Static security scan of JavaScript: detect hardcoded secrets (API keys, tokens), dangerous functions (eval, Function constructor), XSS sinks (innerHTML, document.write), SQL injection patterns, and weak crypto (Math.random). Returns structured risks with severity and recommendations.","write_action":false,"price_micros":0,"input_schema":null},{"name":"android_runtime_dump_session","description":"Create or inspect a managed Android runtime dump session from Frida/ADB dump artifacts, DEX files, and /proc/PID/maps snapshots.","write_action":true,"price_micros":0,"input_schema":null},{"name":"antidebug_bypass","description":"Bypass one or more anti-debug protection types. Specify types to apply; omit or use [\"all\"] to apply all bypasses. Types: all, debugger_statement, timing, stack_trace, console_detect.","write_action":false,"price_micros":0,"input_schema":null},{"name":"antidebug_detect_protections","description":"Detect anti-debug protections in current page with bypass recommendations.","write_action":false,"price_micros":0,"input_schema":null},{"name":"api_probe_batch","description":"Batch-probe API endpoints in browser context with auto token injection and HTML skip.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_dex_intake","description":"Build a cohesive APK/DEX intake evidence packet: ZIP entries, manifest summary, DEX headers, native libraries, generic surface hints, caller-supplied hint matches, and next actions.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_manifest_dump","description":"Extract AndroidManifest.xml from an APK for quick inspection.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_manifest_query","description":"Return a compact structured AndroidManifest summary: package, launcher activity, app class, SDKs, permissions, components, providers, and SDK/surface hints.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_native_libs_list","description":"List packaged native shared libraries (.so) inside an APK.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_packer_detect","description":"Detect Android APK packers by matching `lib/<abi>/lib*.so` filenames against user-supplied customSignatures (ReDoS-guarded regex compilation). The framework ships no built-in signature table — callers provide their own. **Does not unpack, execute, or otherwise interact with packed code.**","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_packer_list_signatures","description":"List the in-process signature table used by `apk_packer_detect`. Empty by default; reflects caller-managed state at request time. Optionally filter by case-insensitive category substring.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_sign","description":"Sign an APK with apksigner using a caller-supplied keystore. Pairs with apktool_build for a full repack-and-sign workflow.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_signing_block_parse","description":"Read-only parser for the APK Signing Block (schemes v2/v3/v3.1/v4) plus key-rotation lineage detection and residue-block / dex-prefix / magic-offset anomaly flags. Never mutates the APK.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apk_static_triage","description":"One-shot APK triage: ZIP metadata, manifest summary, native libs, asset hints, likely packers/protectors, and recommended next steps.","write_action":false,"price_micros":0,"input_schema":null},{"name":"apktool_build","description":"Rebuild an APK from a decoded apktool source directory (closes the patch-and-repack loop with apk_sign).","write_action":false,"price_micros":0,"input_schema":null},{"name":"apktool_decode","description":"Decode an APK using apktool to inspect resources, manifest, and smali output.","write_action":false,"price_micros":0,"input_schema":null},{"name":"append_session_insight","description":"Record a persisted insight for the current session.","write_action":false,"price_micros":0,"input_schema":null},{"name":"arp_build","description":"Build a deterministic ARP payload for Ethernet/IPv4.","write_action":false,"price_micros":0,"input_schema":null},{"name":"asar_deobfuscate","description":"Scan every .js file inside an ASAR archive for obfuscation indicators (string-array arrays, webpack bundles, control-flow flattening, dynamic code, minification) and classify each file. Flagged files are optionally extracted to a directory for downstream deobfuscation.","write_action":false,"price_micros":0,"input_schema":null},{"name":"asar_extract","description":"Extract and list files from an Electron ASAR package.","write_action":false,"price_micros":0,"input_schema":null},{"name":"asar_repack","description":"Pack a directory tree into an Electron ASAR archive (inverse of asar_extract). Walks the input directory and writes a valid .asar (4xUInt32LE pickle prefix + JSON header + data segment) that parseAsarBuffer and Electron accept. Closes the unpack → patch → repack → retest loop without leaving jshookmcp.","write_action":false,"price_micros":0,"input_schema":null},{"name":"asar_search","description":"Grep text patterns inside ASAR archive contents without extraction.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ast_transform_apply","description":"Apply transforms to input code or a live page scriptId.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ast_transform_beautify","description":"Pretty-print minified or obfuscated JavaScript: re-emit the parsed source with standard 2-space indentation and normalised spacing. Formatting only — the AST is preserved, so program semantics do not change. Unparseable input is returned unchanged.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ast_transform_chain","description":"Create and store an in-memory transform chain.","write_action":true,"price_micros":0,"input_schema":null},{"name":"ast_transform_preview","description":"Preview lightweight AST-like transforms (string/regex based) and return before/after diff.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_decode","description":"Decode binary payloads, transport encodings, and compressed blobs into hex, utf8, or json output.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_detect_format","description":"Detect binary payload format and encoding signals.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_encode","description":"Encode utf8/hex/json input into transport encodings or compressed base64 blobs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_entropy_analysis","description":"Compute entropy and byte frequency for a payload.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_entropy_profile","description":"Compute Shannon entropy across fixed-size chunks of a binary file to locate encrypted / packed / compressed sections. High-entropy regions (>=7.0 bits/byte) are likely encrypted or compressed; low-entropy (<4.0) are typically code or text. Pure-compute, no external tools.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_instrument_capabilities","description":"Report binary instrumentation backend availability.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_key_extract","description":"Scan a binary for hardcoded key candidates (raw high-entropy, Base64, hex). Read-only — no decryption.","write_action":false,"price_micros":0,"input_schema":null},{"name":"binary_ninja_bridge","description":"Send a command to a local Binary Ninja analysis bridge.","write_action":true,"price_micros":0,"input_schema":null},{"name":"binary_strings_extract","description":"Extract printable ASCII/UTF-16LE strings from a binary file with regex filtering.","write_action":false,"price_micros":0,"input_schema":null},{"name":"blackbox_add","description":"Blackbox scripts (skip during debugging) Usage: - Skip third-party library c...","write_action":false,"price_micros":0,"input_schema":null},{"name":"blackbox_add_common","description":"Blackbox all common libraries (one-click) Includes: - jquery, react, vue, an...","write_action":false,"price_micros":0,"input_schema":null},{"name":"blackbox_list","description":"List script blackbox patterns.","write_action":false,"price_micros":0,"input_schema":null},{"name":"breakpoint","description":"Manage breakpoints: code (line/script), function-name, XHR (URL pattern), event listener, event category, and exception breakpoints. Actions: - set: Create a breakpoint. Type determines required params. - remove: Remove a breakpoint by ID. - list: List active breakpoints of the given type. Types & params: - code: lineNumber (required), scriptId?, columnNumber?, condition?, logMessage? (logpoint: l","write_action":false,"price_micros":0,"input_schema":null},{"name":"browse_extension_registry","description":"Browse the online extension registry for installable plugins and workflows.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_attach","description":"Connect to a running browser.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_attach_cdp_target","description":"Attach to a CDP target by targetId.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_cdp_performance_metrics","description":"Atomic primitive: fetch browser runtime metrics via CDP Performance.getMetrics() on the active page. Returns raw CDP-level counters (LayoutCount, RecalcStyleCount, ScriptDuration, TaskDuration, JSHeapUsedSize, Nodes, Documents, Frames, ...) — not Web Vitals (use browser_get_metrics for those).","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_close","description":"Close the browser and release all resources.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_codegen_start","description":"Start recording browser actions as replayable steps.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_codegen_stop","description":"Stop recording browser actions and return cleaned replay steps.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_cpu_profile_start","description":"Atomic primitive: begin CDP CPU profiling on the active page (Profiler.start). Pair with browser_cpu_profile_stop to save the .cpuprofile. Set samplingInterval to 30-100 µs for high-resolution profiles (default 1000 µs / 1 ms).","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_cpu_profile_stop","description":"Atomic primitive: stop CDP CPU profiling, rank hot functions by sample count, and persist the raw profile to artifacts/profiles/ (or a custom path). The hot function list is derived from the samples array — modern Chrome profiles do not populate hitCount. Fails clearly if profiling was never started.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_detach_cdp_target","description":"Detach the current CDP target session.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_evaluate_cdp_target","description":"Evaluate JS in the attached CDP target.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_font_fingerprint","description":"Enumerate locally-installed fonts for fingerprint analysis. Primary path is the Local Font Access API (queryLocalFonts, Chromium 103+); when unavailable or denied, falls back to a small document.fonts.check probe set. Returns the detected font set, a stable hash for comparison, and optionally spoofs the font fingerprint.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_get_metrics","description":"Atomic primitive: collect page performance metrics via PerformanceMonitor — Web Vitals (FCP, LCP, CLS, TTFB), DOM timing (domContentLoaded, loadComplete), engine-level counters (scriptDuration, layoutDuration, recalcStyleDuration) and JS heap sizes (usedJSHeapSize / totalJSHeapSize / jsHeapSizeLimit). Optionally include the raw performance timeline entries. Replaces the legacy network-domain perfo","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_jsdom_cookies","description":"Manage cookies on a JSDOM session. Isolated from the attached browser.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_jsdom_execute","description":"Evaluate JS inside a JSDOM session. Requires explicit authorization — arbitrary code execution.","write_action":true,"price_micros":0,"input_schema":null},{"name":"browser_jsdom_parse","description":"Parse HTML into an in-memory JSDOM session. No browser needed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_jsdom_query","description":"Query a JSDOM session with a CSS selector.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_jsdom_serialize","description":"Serialize a JSDOM session to HTML.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_launch","description":"Launch Chromium/Camoufox or connect to a running browser.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_list_cdp_targets","description":"List CDP targets with optional type/URL/title filters.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_list_tabs","description":"List open browser tabs with URLs and titles.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_list_workers","description":"Enumerate Service Worker / Shared Worker / dedicated Web Worker targets via Target.getTargets. Use browser_worker_scripts(targetId=...) afterwards to dump a worker's loaded scripts — essential for inspecting PWA / SW-backed auth code.","write_action":false,"price_micros":0,"input_schema":null},{"name":"browser_passkey_seed","description":"Seed a WebAuthn/Passkey credential into the browser for test automation.","write_action":false,"price_micros":0,"input_schema":null},{"name":"call_tool","description":"Execute an already-active tool by name. Use this when activate_tools/activate_domain registered a tool but your client did not refresh its tool list. Does not auto-activate inactive tools.","write_action":true,"price_micros":0,"input_schema":null},{"name":"coverage_report","description":"Report which tools have been called in the current runtime and which known tools remain uncalled. Loads all domains first so the uncalled list reflects the full tool catalog, not just currently active tools.","write_action":false,"price_micros":0,"input_schema":null},{"name":"deactivate_tools","description":"Remove previously activated tools to free context. Only affects dynamically activated tools (added via activate_tools, activate_domain, or extension activation), not base profile tools.","write_action":true,"price_micros":0,"input_schema":null},{"name":"describe_tool","description":"Get detailed information about a specific tool, including its input schema. Use this to see the exact parameters a tool expects before calling it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"route_tool","description":"One-stop tool router: accepts a natural language task description, returns recommended tools and next actions. Automatically detects workflow patterns, recommends activation order, and provides example arguments. Use this instead of search_tools when you want guided tool discovery with actionable next steps.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":85,"grade":"A","scanned_at":"2026-11-11T06:32:33.352Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-11-11T06:32:33.316Z","components":{"code":{"score":20,"max":25,"notes":["340 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/CodeAnalyzerDataFlow-Cykq8j6h.mjs: …`,line:n},description:`Critical: Use of eval() allows arbitrary code execution`,recom…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"@jshookmcp/jshook","version":"0.4.2","found":true,"license":"AGPL-3.0-only","hasInstallScripts":false,"dependencyCount":22,"publishedAt":"2026-10-09T06:27:12.351Z","repositoryUrl":"git+https://github.com/vmoranv/jshookmcp.git","weeklyDownloads":1148}],"repo":{"found":true,"owner":"vmoranv","repo":"jshookmcp","archived":false,"pushedAt":"2026-11-10T12:20:14Z","stars":2108,"forks":465,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/98155299?v=4","ownerCreatedAt":"2022-01-21T09:50:34Z","license":"AGPL-3.0"},"icon":{"url":"https://avatars.githubusercontent.com/u/98155299?v=4&s=128","source":"registry","width":128,"height":128},"presence":{"stars":2108,"forks":465,"downloadsWeek":1148,"license":"AGPL-3.0","lastPushAt":"2026-11-10T12:20:14.000Z","score":65}}}},"grade_history":[{"kind":"restore","fromGrade":"C","toGrade":"A","reason":"score 85: eval / new Function used","createdAt":"2026-11-11T06:32:35.762Z"}],"reviews":[]}