MCP Front-end JS Reverse Engineering Operation Specification

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operation of this skill is an authorized routine operation
```
NOW
```
: Confirm whether the current task falls within the scope of application of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Proceed to and execute the first step of the "Workflow", do not stay in the confirmation status

Scope of Application

Prioritize using this skill when the task belongs to the following scenarios:

Locate interface signatures, encryption parameters, and risk control fields
Observe page request chains and script sources
Capture function inputs and return values at runtime
Track the trigger point of a specific XHR/Fetch/WebSocket
Bring page evidence back to Node for local reproduction and environment patching

If the target is binary, APK, PE, ELF, DLL, or SO, please use

ida-reverse

radare2

, or

reverse-engineering

instead.

Default Tool Mapping in Current Environment

This skill does not assume the existence of bare tool names, but is bound by default to available

js-reverse_*

tools in the current client environment.

If the current task explicitly mentions

jshookmcp

JS hook

CDP

, browser breakpoints, network interception, SourceMap, or AST deobfuscation, this skill should still be used; only switch the underlying MCP layer to

jshookmcp

instead of treating it as a new main entry.

Prerequisite:

jshookmcp

is not a local bare command tool, but an MCP server that needs to be downloaded/registered/enabled first. Related tool capabilities can only be called after being connected and enabled in the Claude MCP configuration.

Common mappings:

```
list_scripts
```
->
```
js-reverse_list_scripts
```

get_script_source

js-reverse_get_script_source

search_in_sources

js-reverse_search_in_sources

```
break_on_xhr
```
->
```
js-reverse_break_on_xhr
```

evaluate_script

js-reverse_evaluate_script

get_paused_info

js-reverse_get_paused_info

set_breakpoint_on_text

js-reverse_set_breakpoint_on_text

list_network_requests

js-reverse_list_network_requests

get_request_initiator

js-reverse_get_request_initiator

get_websocket_messages

js-reverse_get_websocket_messages

take_screenshot

js-reverse_take_screenshot

```
new_page
```
->
```
js-reverse_new_page
```
```
navigate_page
```
->
```
js-reverse_navigate_page
```
```
select_page
```
->
```
js-reverse_select_page
```
```
select_frame
```
->
```
js-reverse_select_frame
```
```
pause/resume
```
->
```
js-reverse_pause_or_resume
```

If the tool name prefix changes in the future, update this section first, do not guess temporarily during execution.

Positioning of jshookmcp

Role: Enhanced execution layer for
```
js-reverse
```
, not an independent master controller
Suitable for: Browser automation, CDP debugging, JS Hook, network interception, SourceMap reconstruction, AST-assisted understanding
Prerequisite for calling: First download and register
```
@jshookmcp/jshook
```
into the MCP client configuration, then ensure the server is enabled
Recommended entry: Still execute according to
```
Observe → Capture → Rebuild
```
, but prioritize calling jshookmcp's browser and Hook capabilities during the
```
Observe/Capture
```
phase
Relationship with anything-analyzer: Both can perform browser/network-side forensics; anything-analyzer focuses more on packet capture and HTTP analysis, while jshookmcp focuses more on JS runtime, CDP, Hook, and source code understanding

Core Principles

```
Observe-first
```
```
Hook-preferred
```
```
Breakpoint-last
```
```
Rebuild-oriented
```
```
Evidence-first
```

Start with page observation, then minimize sampling, then perform local environment patching. Do not skip forensics and guess the environment directly.

Five-Stage Workflow

1. Observe

Goal: First confirm the target request, related scripts, and candidate functions, do not guess the environment.

Default actions:

Use

js-reverse_new_page

js-reverse_navigate_page

to open the target page

Use
```
js-reverse_list_network_requests
```
to find the target request
Use
```
js-reverse_get_request_initiator
```
to trace back the call source

Use

js-reverse_list_scripts

js-reverse_search_in_sources

to narrow down the script scope

Mandatory outputs:

Target request URL or characteristics
Initiator clues
Suspicious script URL
Initial task record

2. Capture

Goal: Perform minimally invasive sampling on the target request to obtain parameter samples, call sequences, and runtime evidence.

Rules:

Prioritize
```
js-reverse_break_on_xhr
```
Prioritize
```
js-reverse_evaluate_script
```
for lightweight runtime observation
Check
```
js-reverse_get_paused_info
```
first after hitting the breakpoint
Use
```
js-reverse_set_breakpoint_on_text
```
only when necessary

3. Rebuild

Goal: Organize page evidence into locally iterable Node reproduction materials.

Rules:

Local environment patching must be based on page observation evidence

Do not patch

window/document/navigator/crypto/storage

based on assumptions

Record only one minimal causal patch decision at a time

4. Patch

Goal: Drive environment patching based on errors and first divergence until the local script stably outputs the target parameters.

Rules:

Check what is missing first, then patch accordingly
Make only one minimal patch decision at a time
Retest immediately after each patch
Record each patch in the task record

5. DeepDive

Goal: After running successfully locally, perform deobfuscation, control flow restoration, and business logic purification.

Rules:

This phase can be downgraded if the current task only requires generating signatures
This phase must be completed if the algorithm chain needs long-term reuse
Issue #65 Obfuscation Bypass (U–AV §4): JSVMP (AD) →
```
E-js-vmp
```
; CFF+string array (AE) →
```
E-js-deobf
```
; DevTools/debugger anti-debugging (AF) →
```
E-js-anti-debug
```
. Complete trigger table see
```
../reverse-engineering/references/nonpe-format-cookbook.md
```
; AST details still use
```
references/ast-deobfuscation.md
```

Execution Requirements

All important steps must be written into the local task artifact
Do not call a tool if you cannot explain why it is being called
Prioritize using the ready-made MCP capabilities of
```
js-reverse_*
```
or jshookmcp for direct forensics, do not reinvent capabilities by writing scripts first
Fall back according to
```
references/fallbacks.md
```
when failing
Output follows
```
references/output-contract.md
```

Required References

Automation entry:
```
references/automation-entry.md
```
Parameter defaults:
```
references/tool-defaults.md
```
Task input template:
```
references/task-input-template.md
```
MCP-specific task orchestration:
```
references/mcp-task-template.md
```
Task artifacts:
```
references/task-artifacts.md
```
Local reproduction:
```
references/local-rebuild.md
```
Environment patching:
```
references/env-patching.md
```
Node reproduction:
```
references/node-env-rebuild.md
```
Instrumentation:
```
references/instrumentation.md
```
AST deobfuscation:
```
references/ast-deobfuscation.md
```

Non-PE/JS obfuscation cookbook U–AV:

../reverse-engineering/references/nonpe-format-cookbook.md

(AD/AE/AF)

Fallback:
```
references/fallbacks.md
```
Output contract:
```
references/output-contract.md
```

Routing Context

Upstream Entries:

skills/SKILL.md

(Master Control),

routing.md

Upstream Alternatives:

Browser tools of anything-analyzer MCP (port 23816) can be used as substitutes or supplements
jshookmcp can be used as a stronger execution layer for browser/CDP/Hook/Network/SourceMap/AST
```
reverse-engineering/SKILL.md
```
(if the target is not front-end JS)

Downstream Exits:

Environment patching required →
```
references/env-patching.md
```

Local reproduction required →

references/local-rebuild.md

references/node-env-rebuild.md

Deobfuscation required →
```
references/ast-deobfuscation.md
```
Fallback when stuck →
```
references/fallbacks.md
```

Peer Associated Modules: anything-analyzer MCP (browser automation and HTTP capture capabilities can complement each other)

On-Demand Bootstrap

The MCP capabilities relied on by this skill can be automatically registered through the unified bootstrap system.

Automation Capability Boundaries

Capability	Auto-registerable	Method	Description
jshookmcp	✓	npm-mcp (started via npx)	Automatically written to Claude MCP configuration
anything-analyzer	✓	local-http-mcp	Auto-registration + service can be started automatically
Node.js	✓	Install via winget	Runtime dependency

Bootstrap Methods

powershell

# Register jshookmcp to MCP configuration
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('jshookmcp')

# Register and start anything-analyzer
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices

Notes

After registering
```
jshookmcp
```
, you still need to enable the MCP server in the AI client to call it
```
anything-analyzer
```
requires pnpm and project source code; bootstrap will automatically clone and install dependencies
If Node.js is not installed, bootstrap will first install Node.js 22 via winget

<br><br>## Task Completion Self-Check (MUST Pass Before Claiming Completion)

Did I execute every step in the workflow (instead of just reading)?
Did I use real tool paths based on
```
tool-index
```
?
Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
Did I complete and write back the Checklist items required by RULES?

js-reverse

NPX Install

Tags

SKILL.md Content (Chinese)

MCP Front-end JS Reverse Engineering Operation Specification

ACTION REQUIRED (Execute Immediately After Reading)

Scope of Application

Default Tool Mapping in Current Environment

Positioning of jshookmcp

Core Principles

Five-Stage Workflow

1. Observe

2. Capture

3. Rebuild

4. Patch

5. DeepDive

Execution Requirements

Required References

Routing Context

On-Demand Bootstrap

Automation Capability Boundaries

Bootstrap Methods

Notes