Jshookmcp MCP server

Read from the package source without running it. The installed server may list more.

• activate_tools

  Dynamically register specific tools by name, regardless of current base tier. Use after search_tools to enable exactly the tools you need. In search-tier sessions this is usually enough; use activate_domain when you need every tool in a domain. Activated tools appear in the tool list immediately. If tools do not appear after activation, use call_tool to invoke them directly.

• adb_apk_analyze

  Analyze an installed APK: package, permissions, activities, and security info.

• adb_apk_pull

  Pull an APK from a device to the local filesystem.

• adb_app_cold_start_trace

  High-level Android startup trace: force-stop, clear logcat, start activity with -W, wait, collect PID-filtered logs, and parse launch/Looper timing.

• adb_device_list

  List all connected Android devices and emulators.

• adb_dumpsyswrite action

  Run adb shell dumpsys for a service and return parsed structured output. Supports key-value extraction, array parsing, and section detection. Common services: package, activity, window, battery, meminfo, alarm, cpuinfo, diskstats, netstats, usagestats.

• adb_file_pull

  Pull a file from an Android device using normal ADB permissions.

• adb_file_push

  Push a local file to an Android device using normal ADB permissions.

• adb_getprop

  Dump and parse Android system properties (getprop) into a structured map with a curated device fingerprint (model, SDK, ABI, build fingerprint, security patch, bootloader lock).

• adb_input_keyeventwrite action

  Send an Android keyevent name or numeric key code through adb shell input.

• adb_input_swipewrite action

  Send a touchscreen swipe event through adb shell input.

• adb_input_tapwrite action

  Send a touchscreen tap event through adb shell input.

• adb_input_textwrite action

  Send text through adb shell input text with Android-safe whitespace encoding.

• adb_install

  Install one APK or a split-APK set onto a device with parsed success output.

• adb_logcat_query

  Capture and filter Android logcat output in-process without shell grep pipelines.

• adb_package_summary

  Return structured Android package metadata: launcher, uid, versions, permissions, components, and native library dirs.

• adb_port_forward

  Manage ADB forward/reverse port mappings for device-host bridge workflows.

• adb_proc_maps

  Read and parse /proc/PID/maps from a device, resolving PID from packageName when needed.

• adb_pull_native_libs

  Pull native shared libraries (.so) for an installed app from a device.

• adb_root_check

  Probe root indicators such as su, Magisk, test-keys, SELinux, and shell uid.

• adb_screenrecord

  Record a short MP4 screen capture through adb shell screenrecord and pull it locally.

• adb_screenshot

  Capture a PNG screenshot through adb exec-out screencap -p.

• adb_shellwrite action

  Execute an ADB shell command on a specific device.

• adb_ui_dump

  Capture Android UI hierarchy via uiautomator dump. Runs uiautomator dump on-device, pulls the XML, and returns parsed UI tree. Useful for UI automation verification, layout inspection, and accessibility tree analysis.

• adb_uninstall

  Uninstall a package from a device, optionally keeping app data.

• adb_webview_attach

  Attach to a WebView via ADB; returns WebSocket debugger URL for CDP.

• adb_webview_list

  List debuggable WebView targets connected via ADB.

• ai_hook

  Manage AI hooks. Actions: inject (inject code into page), get_data (retrieve captured hook data), list (all active hooks), clear (remove hook data by id or all), toggle (enable/disable a hook), export (export data as JSON/CSV).

• ai_suggest_exploits

  Use LLM to suggest exploit primitives and attack chains for a given vulnerability. Returns theoretical exploitation steps, references, and required conditions. IMPORTANT: Does NOT generate executable payloads or malicious code.

• analysis_ast_match

  Match AST nodes by type and optional property filter.

• analysis_data_flow

  Trace data flow through JavaScript: identify sources (user input, network, storage), sinks (XSS, eval, SQL injection, command execution), sanitizer pass-through points, and tainted variable propagation paths. Useful for finding injection vulnerabilities.

• analysis_decode_string_array

  Decode literal string-array access back to strings.

• analysis_deflat_control_flow

  Flatten switch-dispatch control flow back to straight-line code.

• analysis_security_scan

  Static security scan of JavaScript: detect hardcoded secrets (API keys, tokens), dangerous functions (eval, Function constructor), XSS sinks (innerHTML, document.write), SQL injection patterns, and weak crypto (Math.random). Returns structured risks with severity and recommendations.

• android_runtime_dump_sessionwrite action

  Create or inspect a managed Android runtime dump session from Frida/ADB dump artifacts, DEX files, and /proc/PID/maps snapshots.

• antidebug_bypass

  Bypass one or more anti-debug protection types. Specify types to apply; omit or use ["all"] to apply all bypasses. Types: all, debugger_statement, timing, stack_trace, console_detect.

• antidebug_detect_protections

  Detect anti-debug protections in current page with bypass recommendations.

• api_probe_batch

  Batch-probe API endpoints in browser context with auto token injection and HTML skip.

• apk_dex_intake

  Build a cohesive APK/DEX intake evidence packet: ZIP entries, manifest summary, DEX headers, native libraries, generic surface hints, caller-supplied hint matches, and next actions.

• apk_manifest_dump

  Extract AndroidManifest.xml from an APK for quick inspection.

• apk_manifest_query

  Return a compact structured AndroidManifest summary: package, launcher activity, app class, SDKs, permissions, components, providers, and SDK/surface hints.

• apk_native_libs_list

  List packaged native shared libraries (.so) inside an APK.

• apk_packer_detect

  Detect Android APK packers by matching `lib/<abi>/lib*.so` filenames against user-supplied customSignatures (ReDoS-guarded regex compilation). The framework ships no built-in signature table — callers provide their own. **Does not unpack, execute, or otherwise interact with packed code.**

• apk_packer_list_signatures

  List the in-process signature table used by `apk_packer_detect`. Empty by default; reflects caller-managed state at request time. Optionally filter by case-insensitive category substring.

• apk_sign

  Sign an APK with apksigner using a caller-supplied keystore. Pairs with apktool_build for a full repack-and-sign workflow.

• apk_signing_block_parse

  Read-only parser for the APK Signing Block (schemes v2/v3/v3.1/v4) plus key-rotation lineage detection and residue-block / dex-prefix / magic-offset anomaly flags. Never mutates the APK.

• apk_static_triage

  One-shot APK triage: ZIP metadata, manifest summary, native libs, asset hints, likely packers/protectors, and recommended next steps.

• apktool_build

  Rebuild an APK from a decoded apktool source directory (closes the patch-and-repack loop with apk_sign).

• apktool_decode

  Decode an APK using apktool to inspect resources, manifest, and smali output.

• append_session_insight

  Record a persisted insight for the current session.

• arp_build

  Build a deterministic ARP payload for Ethernet/IPv4.

• asar_deobfuscate

  Scan every .js file inside an ASAR archive for obfuscation indicators (string-array arrays, webpack bundles, control-flow flattening, dynamic code, minification) and classify each file. Flagged files are optionally extracted to a directory for downstream deobfuscation.

• asar_extract

  Extract and list files from an Electron ASAR package.

• asar_repack

  Pack a directory tree into an Electron ASAR archive (inverse of asar_extract). Walks the input directory and writes a valid .asar (4xUInt32LE pickle prefix + JSON header + data segment) that parseAsarBuffer and Electron accept. Closes the unpack → patch → repack → retest loop without leaving jshookmcp.

• asar_search

  Grep text patterns inside ASAR archive contents without extraction.

• ast_transform_apply

  Apply transforms to input code or a live page scriptId.

• ast_transform_beautify

  Pretty-print minified or obfuscated JavaScript: re-emit the parsed source with standard 2-space indentation and normalised spacing. Formatting only — the AST is preserved, so program semantics do not change. Unparseable input is returned unchanged.

• ast_transform_chainwrite action

  Create and store an in-memory transform chain.

• ast_transform_preview

  Preview lightweight AST-like transforms (string/regex based) and return before/after diff.

• binary_decode

  Decode binary payloads, transport encodings, and compressed blobs into hex, utf8, or json output.

• binary_detect_format

  Detect binary payload format and encoding signals.

• binary_encode

  Encode utf8/hex/json input into transport encodings or compressed base64 blobs.

• binary_entropy_analysis

  Compute entropy and byte frequency for a payload.

• binary_entropy_profile

  Compute Shannon entropy across fixed-size chunks of a binary file to locate encrypted / packed / compressed sections. High-entropy regions (>=7.0 bits/byte) are likely encrypted or compressed; low-entropy (<4.0) are typically code or text. Pure-compute, no external tools.

• binary_instrument_capabilities

  Report binary instrumentation backend availability.

• binary_key_extract

  Scan a binary for hardcoded key candidates (raw high-entropy, Base64, hex). Read-only — no decryption.

• binary_ninja_bridgewrite action

  Send a command to a local Binary Ninja analysis bridge.

• binary_strings_extract

  Extract printable ASCII/UTF-16LE strings from a binary file with regex filtering.

• blackbox_add

  Blackbox scripts (skip during debugging) Usage: - Skip third-party library c...

• blackbox_add_common

  Blackbox all common libraries (one-click) Includes: - jquery, react, vue, an...

• blackbox_list

  List script blackbox patterns.

• breakpoint

  Manage breakpoints: code (line/script), function-name, XHR (URL pattern), event listener, event category, and exception breakpoints. Actions: - set: Create a breakpoint. Type determines required params. - remove: Remove a breakpoint by ID. - list: List active breakpoints of the given type. Types & params: - code: lineNumber (required), scriptId?, columnNumber?, condition?, logMessage? (logpoint: l

• browse_extension_registry

  Browse the online extension registry for installable plugins and workflows.

• browser_attach

  Connect to a running browser.

• browser_attach_cdp_target

  Attach to a CDP target by targetId.

• browser_cdp_performance_metrics

  Atomic primitive: fetch browser runtime metrics via CDP Performance.getMetrics() on the active page. Returns raw CDP-level counters (LayoutCount, RecalcStyleCount, ScriptDuration, TaskDuration, JSHeapUsedSize, Nodes, Documents, Frames, ...) — not Web Vitals (use browser_get_metrics for those).

• browser_close

  Close the browser and release all resources.

• browser_codegen_start

  Start recording browser actions as replayable steps.

• browser_codegen_stop

  Stop recording browser actions and return cleaned replay steps.

• browser_cpu_profile_start

  Atomic primitive: begin CDP CPU profiling on the active page (Profiler.start). Pair with browser_cpu_profile_stop to save the .cpuprofile. Set samplingInterval to 30-100 µs for high-resolution profiles (default 1000 µs / 1 ms).

• browser_cpu_profile_stop

  Atomic primitive: stop CDP CPU profiling, rank hot functions by sample count, and persist the raw profile to artifacts/profiles/ (or a custom path). The hot function list is derived from the samples array — modern Chrome profiles do not populate hitCount. Fails clearly if profiling was never started.

• browser_detach_cdp_target

  Detach the current CDP target session.

• browser_evaluate_cdp_target

  Evaluate JS in the attached CDP target.

• browser_font_fingerprint

  Enumerate locally-installed fonts for fingerprint analysis. Primary path is the Local Font Access API (queryLocalFonts, Chromium 103+); when unavailable or denied, falls back to a small document.fonts.check probe set. Returns the detected font set, a stable hash for comparison, and optionally spoofs the font fingerprint.

• browser_get_metrics

  Atomic primitive: collect page performance metrics via PerformanceMonitor — Web Vitals (FCP, LCP, CLS, TTFB), DOM timing (domContentLoaded, loadComplete), engine-level counters (scriptDuration, layoutDuration, recalcStyleDuration) and JS heap sizes (usedJSHeapSize / totalJSHeapSize / jsHeapSizeLimit). Optionally include the raw performance timeline entries. Replaces the legacy network-domain perfo

• browser_jsdom_cookies

  Manage cookies on a JSDOM session. Isolated from the attached browser.

• browser_jsdom_executewrite action

  Evaluate JS inside a JSDOM session. Requires explicit authorization — arbitrary code execution.

• browser_jsdom_parse

  Parse HTML into an in-memory JSDOM session. No browser needed.

• browser_jsdom_query

  Query a JSDOM session with a CSS selector.

• browser_jsdom_serialize

  Serialize a JSDOM session to HTML.

• browser_launch

  Launch Chromium/Camoufox or connect to a running browser.

• browser_list_cdp_targets

  List CDP targets with optional type/URL/title filters.

• browser_list_tabs

  List open browser tabs with URLs and titles.

• browser_list_workers

  Enumerate Service Worker / Shared Worker / dedicated Web Worker targets via Target.getTargets. Use browser_worker_scripts(targetId=...) afterwards to dump a worker's loaded scripts — essential for inspecting PWA / SW-backed auth code.

• browser_passkey_seed

  Seed a WebAuthn/Passkey credential into the browser for test automation.

• call_toolwrite action

  Execute an already-active tool by name. Use this when activate_tools/activate_domain registered a tool but your client did not refresh its tool list. Does not auto-activate inactive tools.

• coverage_report

  Report which tools have been called in the current runtime and which known tools remain uncalled. Loads all domains first so the uncalled list reflects the full tool catalog, not just currently active tools.

• deactivate_toolswrite action

  Remove previously activated tools to free context. Only affects dynamically activated tools (added via activate_tools, activate_domain, or extension activation), not base profile tools.

• describe_tool

  Get detailed information about a specific tool, including its input schema. Use this to see the exact parameters a tool expects before calling it.

• route_tool

  One-stop tool router: accepts a natural language task description, returns recommended tools and next actions. Automatically detects workflow patterns, recommends activation order, and provides example arguments. Use this instead of search_tools when you want guided tool discovery with actionable next steps.

• Code scan340 source files scanned20/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 1 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

85/100

higher than 75% of 3,443 Web search servers

Tools

100

the typical Web search server has 5

Tools that change things

12%

typical: 0%. Fewer write tools means less an agent can break

GitHub stars

2,108

more than 95% of 1,781 Web search servers

Downloads a week

1,148

more than 95% of 994 Web search servers with a package

Grade history

• 2026-11-11restoreC → Ascore 85: eval / new Function used

Jshookmcp: common questions

Is Jshookmcp MCP server safe?

Yes, by our scan: it is graded A (85/100). Read the Jshookmcp safety report

How do I install Jshookmcp?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Jshookmcp need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Jshookmcp maintained?

The last commit was 5 days ago (2026-11-10). The latest release is v0.4.2.

What can I use instead of Jshookmcp?

Servers from other publishers that do the same job: Free Search MCP server, Claude Ops Telegram MCP server and FrankenSurf MCP server.

How does Jshookmcp compare with other Web search MCP servers?

safety score 85/100 (higher than 75% of 3,443 Web search servers); tools 100 (the typical Web search server has 5); tools that change things 12% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.