Jshookmcp MCP Server

Findings (24)

• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Turns off TLS certificate checking, allowing traffic interception.

  src/server/domains/tls-inspector/handlers/websocket-handlers.ts:417
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/benchmarks/suites/platform.suite.ts:31
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: github-pat

  tests/benchmarks/suites/core.suite.ts:52
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  tests/modules/analyzer/SecurityCodeAnalyzer.test.ts:65
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  3 matches in this file

  tests/benchmarks/suites/transform.suite.ts:23
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/modules/analyzer/PatternDetectorAuthPatterns.test.ts:159
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/modules/analyzer/PatternDetector.test.ts:231
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/native/SymbolPersistence.test.ts:205
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/server/domains/analysis/data-flow-security-scan.test.ts:173
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: private-key

  tests/server/domains/tls-inspector/handlers.test.ts:1075
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  5 matches in this file

  tests/server/domains/network/auth-extractor.test.ts:90
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: jwt

  2 matches in this file

  tests/server/domains/network/auth-extractor.test.ts:78
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/server/workflows/WorkflowEngine.test.ts:494
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.11: 2 known vulnerabilities

  GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@13.0.6: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.4: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  VITEPRESS_BASE, RUNTIME_AUDIT_JSON_PATH, JSHOOK_REGISTRY_PLATFORM, E2E_FIXTURE_PORT, PUPPETEER_HEADLESS, VITEST_MAX_WORKERS, E2E_TARGET_URL, CHECK_SERIAL, VITEST_CPU_SAMPLE_MS, VITEST_IDLE_RESOURCE_TARGET, VITEST_MIN_WORKERS, VITEST_MAX_WORKERS_CAP, RUNTIME_AUDIT_DEBUG, BROWSER_EXECUTABLE_PATH, CHRO…

Network activity

Tools exposed (8)

• search_tools

  Search 736 tools across 36 capability domains. This includes built-in tools plus any loaded plugin/workflow tools (0 currently loaded). In search-tier sessions, call this before assuming a capability is unavailable. Use activate_tools for exact matches, activate_domain for an entire domain. Domains:

• route_tool

  One-stop tool router: accepts a natural language task description, returns recommended tools and next actions. Automatically detects workflow patterns, recommends activation order, and provides example arguments. Use this instead of search_tools when you want guided tool discovery with actionable ne

• describe_tool

  Get detailed information about a specific tool, including its input schema. Use this to see the exact parameters a tool expects before calling it.

• activate_tools

  Dynamically register specific tools by name, regardless of current base tier. Use after search_tools to enable exactly the tools you need. In search-tier sessions this is usually enough; use activate_domain when you need every tool in a domain. Activated tools appear in the tool list immediately. If

• deactivate_tools

  Remove previously activated tools to free context. Only affects dynamically activated tools (added via activate_tools, activate_domain, or extension activation), not base profile tools.

• activate_domain

  Register every tool in a single domain at once. Use this when a task needs a whole capability area; prefer search_tools or activate_tools when you only need a few specific tools, because activating a domain costs far more context. Domains: . Activated tools appear in the tool list immediately; if yo

• call_tool

  Execute an already-active tool by name. Use this when activate_tools/activate_domain registered a tool but your client did not refresh its tool list. Does not auto-activate inactive tools.

• coverage_report

  Report which tools have been called in the current runtime and which known tools remain uncalled. Loads all domains first so the uncalled list reflects the full tool catalog, not just currently active tools.