Jshookmcp MCP Server

by vmoranv• 2.1k•• Scanned•Claim this listing•Request removal

Coding Agentsai agentsanti detectionbrowser automationchrome devtools protocoldebugging

A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.

Jshookmcp is an open-source mcp server by vmoranv, written mainly in TypeScript, with 2,095 GitHub stars and the AGPL-3.0 license. Its code was last updated Nov 1, 2026. The latest npm release is @jshookmcp/jshook 0.4.3, published Oct 30, 2026, with 1,015 downloads last week.

Scan summary: scanned Nov 5, 2026 at commit 9940e59. Seen able to run dynamic code, read environment and secrets, connect to the internet. 1 published advisory for its package. Scan policy

about README security reviews

How to install Jshookmcp

Built from the start command in the project's README: npx -y @jshookmcp/jshook@latest. Check the README for required keys or settings.

Claude Code · Terminal

claude mcp add jshookmcp -- npx -y @jshookmcp/jshook@latest

Claude Desktop · claude_desktop_config.json

{
  "mcpServers": {
    "jshookmcp": {
      "command": "npx",
      "args": [
        "-y",
        "@jshookmcp/jshook@latest"
      ]
    }
  }
}

Cursor · .cursor/mcp.json

{
  "mcpServers": {
    "jshookmcp": {
      "command": "npx",
      "args": [
        "-y",
        "@jshookmcp/jshook@latest"
      ]
    }
  }
}

VS Code · Terminal

code --add-mcp '{"name":"jshookmcp","command":"npx","args":["-y","@jshookmcp/jshook@latest"]}'

What Jshookmcp can touch

Run shell commandsNot seen in this scan
Run dynamic codeFound in the code by our scan
Read or write filesNot seen in this scan
Read environment and secretsFound in the code by our scan
Control a web browserLikely, from its own description
Connect to databasesNot seen in this scan
Read or send messagesNot seen in this scan
Touch money or tradingNot seen in this scan
Connect to the internetFound in the code by our scan

"Not seen" means our checks did not find it, and the tool may still do it. Covers commit 9940e59, Nov 5, 2026. See the scan policy.

Before you install Jshookmcp

AgenticMart scanned Jshookmcp on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.

What it can access

An MCP server is a program your AI app starts and talks to. A local one runs with your user's permissions: it can see the files, environment variables and network your account can.
Based on its description and topics, it likely needs to control a web browser (visit sites, fill in and submit forms).

Before you install

Run it in a separate browser profile without your logged-in accounts.
Pin the version you reviewed instead of always installing the latest release.
Read the tool list or scripts before the first run, and keep approval prompts on for actions that write, send or delete.

Maintained by vmoranv on GitHub, 2,095 stars and 464 forks. Popularity is not proof of safety.
Last code change: Nov 1, 2026.
Open-source license: AGPL-3.0.

Read the scan report What our scan checks

Published advisories for @jshookmcp/jshook

From the OSV database, for this npm package. Check that your installed version is past any fix.

CVE-2026-49856@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorizationFixed in 0.3.2.

Tools Jshookmcp exposes (8)

Listed by the server itself during our scan of commit 9940e59.

search_tools
Search 736 tools across 36 capability domains. This includes built-in tools plus any loaded plugin/workflow tools (0 currently loaded). In search-tier sessions, call this before assuming a capability is unavailable. Use activate_tools for exact matches, activate_domain for an entire domain. Domains:
route_tool
One-stop tool router: accepts a natural language task description, returns recommended tools and next actions. Automatically detects workflow patterns, recommends activation order, and provides example arguments. Use this instead of search_tools when you want guided tool discovery with actionable ne
describe_tool
Get detailed information about a specific tool, including its input schema. Use this to see the exact parameters a tool expects before calling it.
activate_tools
Dynamically register specific tools by name, regardless of current base tier. Use after search_tools to enable exactly the tools you need. In search-tier sessions this is usually enough; use activate_domain when you need every tool in a domain. Activated tools appear in the tool list immediately. If
deactivate_tools
Remove previously activated tools to free context. Only affects dynamically activated tools (added via activate_tools, activate_domain, or extension activation), not base profile tools.
activate_domain
Register every tool in a single domain at once. Use this when a task needs a whole capability area; prefer search_tools or activate_tools when you only need a few specific tools, because activating a domain costs far more context. Domains: . Activated tools appear in the tool list immediately; if yo
call_tool
Execute an already-active tool by name. Use this when activate_tools/activate_domain registered a tool but your client did not refresh its tool list. Does not auto-activate inactive tools.
coverage_report
Report which tools have been called in the current runtime and which known tools remain uncalled. Loads all domains first so the uncalled list reflects the full tool catalog, not just currently active tools.

Jshookmcp is an open-source mcp server by vmoranv, written mainly in TypeScript. A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.

At a glance

Stars: 2.1k
Forks: 464
Language: TypeScript
License: AGPL-3.0
Created: Feb 2026
Last update: Nov 1, 2026
Type: MCP Server
Price: Free

Topics

ai-agentsanti-detectionbrowser-automationchrome-devtools-protocoldebuggingdeobfuscationfridajavascriptjs-reversellmmcpmcp-servermodel-context-protocolnetwork-analysisreverse-engineeringsecurity-analysissource-mapstypescriptwasmweb-security

Questions about Jshookmcp

What is Jshookmcp?

A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.

Who maintains Jshookmcp?

Jshookmcp is maintained by vmoranv on GitHub (vmoranv/jshookmcp). AgenticMart lists it from public repository data.

Is Jshookmcp safe to use?

What license does Jshookmcp use?

It is published under the AGPL-3.0 license.

Guides

Jshookmcp alternatives

View more →

Similar mcp servers in Coding Agents, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

Name	Stars	Licence	Last updated	Scan
Jshookmcp (this page) vmoranv	2.1k	AGPL-3.0	Nov 1, 2026	Scanned, no flagged issues
Context Mode mksglu	33k	None found	Nov 1, 2026	Not scanned yet
Serena oraios	31k	None found	Oct 28, 2026	Not scanned yet
Fastmcp PrefectHQ	28k	Apache-2.0	Nov 1, 2026	Scanned, no flagged issues
Nuclear nukeop	19k	AGPL-3.0	Nov 1, 2026	Scanned, no flagged issues
MCP For Beginners microsoft	18k	MIT	Oct 30, 2026	Scanned, no flagged issues