Skip to content
Get packs

MCP Frontend JS Reverse Engineering

Guides an agent through tracing JavaScript signing and anti-bot logic in web pages via MCP browser tools

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
13 files

What it does

This skill gives an AI agent a structured method for analysing front-end JavaScript on websites: finding the script and request that produces a signature or encrypted parameter, watching it run in a browser, and reproducing it locally in Node.js. It tells the agent to observe the page first, take minimal runtime samples, patch a local environment step by step, and record evidence of each step. It relies on browser automation tools (js-reverse_* MCP tools, optionally the jshookmcp server) to do the actual page inspection.

Great for

  • Developers analysing how a website's request signing or encryption parameters are generated
  • Security or QA researchers auditing client-side anti-bot or risk-control logic on sites they are authorised to test
  • Engineers who need to reproduce a page's JavaScript outside the browser for testing or API integration on their own systems

Skip it if

  • Bypassing access controls, rate limits or anti-bot protection on sites you do not own or have permission to test: the skill's own precedent note assumes authorised work, and using it against third-party services may breach terms or law
  • Binary targets such as APK, PE, ELF, DLL or SO files: the skill itself redirects these to other reverse-engineering skills
  • Non-technical users looking for a simple browser automation or scraping tool: it requires an MCP server setup and reverse-engineering knowledge

Try asking

  • “Find the JavaScript function that generates the sign parameter on this page's API request and show me its inputs and outputs”
  • “Break on the XHR call to this endpoint and capture the parameter sample and call order”
  • “Rebuild the signing function in Node.js by patching missing browser objects one at a time, and log each patch”
  • “Identify whether this script uses control-flow flattening or string-array obfuscation and suggest a deobfuscation approach”
Step-by-step guide: how to use MCP Frontend JS Reverse EngineeringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 13 original files, the MIT licence and an attribution note.

    js-reverse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip js-reverse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip js-reverse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Scope each task to a site and endpoint you are authorised to analyse, and state that scope in the task input
  • Leave the -McpHostTarget option unset during bootstrap if you do not want the installer to change your MCP client configuration; review any registration it proposes
  • Review the task artifacts and captured evidence the skill writes locally, since they may contain session data or request parameters

What's inside

  • references/ast-deobfuscation.md
  • references/automation-entry.md
  • references/env-patching.md
  • references/fallbacks.md
  • references/instrumentation.md
  • references/local-rebuild.md
  • references/mcp-task-template.md
  • references/node-env-rebuild.md
  • references/output-contract.md
  • references/task-artifacts.md
  • references/task-input-template.md
  • references/tool-defaults.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.