High-risk tools in Jshookmcp

Dynamically register specific tools by name, regardless of current base tier.

High-level Android startup trace: force-stop, clear logcat, start activity with -W, wait, collect PID-filtered logs, and parse launch/Looper timing.

Run adb shell dumpsys for a service and return parsed structured output. Supports key-value extraction, array parsing, and section detection. Common services: package, activity,...

Send an Android keyevent name or numeric key code through adb shell input.

Send a touchscreen swipe event through adb shell input.

Send a touchscreen tap event through adb shell input.

Send text through adb shell input text with Android-safe whitespace encoding.

Install one APK or a split-APK set onto a device with parsed success output.

Manage ADB forward/reverse port mappings for device-host bridge workflows.

Execute an ADB shell command on a specific device.

Attach to a WebView via ADB; returns WebSocket debugger URL for CDP.

Manage AI hooks. Actions: inject (inject code into page), get_data (retrieve captured hook data), list (all active hooks), clear (remove hook data by id or all), toggle (enable/...

Flatten switch-dispatch control flow back to straight-line code.

Bypass one or more anti-debug protection types. Specify types to apply; omit or use [

Batch-probe API endpoints in browser context with auto token injection and HTML skip.

Sign an APK with apksigner using a caller-supplied keystore. Pairs with apktool_build for a full repack-and-sign workflow.

Rebuild an APK from a decoded apktool source directory (closes the patch-and-repack loop with apk_sign).

Build a deterministic ARP payload for Ethernet/IPv4.

Apply transforms to input code or a live page scriptId.

Create and store an in-memory transform chain.

Send a command to a local Binary Ninja analysis bridge.

Manage breakpoints: code (line/script), function-name, XHR (URL pattern), event listener, event category, and exception breakpoints.\n\nActions:\n- set: Create a breakpoint. Typ...

Connect to a running browser.

Attach to a CDP target by targetId.

Close the browser and release all resources.

Start recording browser actions as replayable steps.

Stop recording browser actions and return cleaned replay steps.

Atomic primitive: begin CDP CPU profiling on the active page (Profiler.start). Pair with browser_cpu_profile_stop to save the .cpuprofile. Set samplingInterval to 30-100 µs for ...

Atomic primitive: stop CDP CPU profiling, rank hot functions by sample count, and persist the raw profile to artifacts/profiles/ (or a custom path). The hot function list is der...

Detach the current CDP target session.

Evaluate JS in the attached CDP target.

Evaluate JS inside a JSDOM session. Requires explicit authorization — arbitrary code execution.

Parse HTML into an in-memory JSDOM session. No browser needed.

Launch Chromium/Camoufox or connect to a running browser.

Atomic primitive: subscribe to PerformanceObserver entry types in the active page and return both buffered and live entries observed during a collection window. Entry types are ...

Switch active tab by index, URL pattern, or title pattern.

Atomic primitive: begin a Chrome performance trace on the active page via page.tracing.start(). Pair with browser_trace_stop to save the trace to disk. Use a sensible categories...

Atomic primitive: stop the Chrome performance trace started by browser_trace_start and persist it to artifacts/traces/ (or to a custom path). Returns event count, file size, and...

Execute an already-active tool by name.

Start, close, or check status of a Camoufox anti-detect server.

Intercept Canvas 2D (drawImage/fillText/strokeText) and WebGL (drawArrays/drawElements) draw calls into a ring buffer on the page. Actions: install (wrap prototypes), read (dump...

Trace a click event from DOM to JS call stack.

Solve a CAPTCHA with manual flow or a configured external service.

Block until the user manually solves the CAPTCHA.

Manage injected interceptor state.

Evaluate a JS expression in the browser console context.

Inject an in-page script, XHR, fetch, or function monitor.

Inject a fetch interceptor.

Inject an XMLHttpRequest interceptor.

Run the built-in skia, mojo, syscall, and binary correlators and merge the results into the shared evidence graph.

Extract crypto/sign/encrypt function from current page and generate standalone runnable code.

Run extracted crypto code in worker_threads + vm sandbox and return deterministic test results.

Execute a Dart function in the ARM64 emulator by address or name, with simplified runtime (mock built-ins, tagged pointers). Pass a sessionId to reuse the cached snapshot; the e...

Parse a Dart AOT snapshot once and cache it under a sessionId, so subsequent dart_load_snapshot / dart_list_functions / dart_call_graph / dart_inspect_object_pool / dart_call_fu...

Trace Dart function execution step-by-step, emitting each instruction with register state (PC, x0-x30, PP, THR). Pass a sessionId to reuse the cached snapshot.

Evaluate a JavaScript expression. context=

Enable or disable the CDP debugger session.

Pause execution at the next statement.

Resume execution.

Run execution until a source location by setting a temporary code breakpoint, resuming, waiting for pause, and removing the breakpoint.

Step execution: into (enter next call), over (skip next call), out (exit current function).

Wait for debugger pause after setting breakpoints.

Run webcrack-powered JavaScript deobfuscation with bundle unpacking.

Run environment doctor: dependencies, bridges, platform limits.

Attach to an Electron CDP port and optionally evaluate in a matching page.

Launch Electron with main and renderer CDP ports.

Patch Electron fuse states.

Build a deterministic Ethernet II frame from source/destination MAC addresses, EtherType, and payload bytes.

Execute JavaScript in an isolated sandbox.

Generate format string exploit payload for arbitrary write. Uses %hn (2-byte) writes for reliability. Returns hex payload and reliability assessment.

Generate heap spray payload for predictable heap layout. Supports V8 (ArrayBuffer), IE (BSTR), and generic (ArrayBuffer) spray targets. Returns spray code, allocation count, and...

Build a JOP (Jump-Oriented Programming) chain from binary gadgets.

Build a ret2dlresolve payload that forges ELF dynamic-linker structures to resolve

Construct a ROP chain for a specified goal (execve, write_memory, call_function). Automatically searches for required gadgets and chains them. Returns hex chain and gadget list....

Find and assemble stack pivot gadgets from a binary. Stack pivots redirect the stack pointer (ESP/RSP) to a controlled buffer, enabling ROP chains when limited stack space is av...

Update exploit-dev cache configuration (TTLs, memory limits, enable/disable). Changes take effect immediately.

Calculate buffer overflow offset from crash value and De Bruijn pattern. Used to determine exact EIP/RIP overwrite offset.

Discover one-gadget (single-address shell-spawning) offsets for common libc versions.

Encode shellcode to avoid bad characters or detection. Supports alphanumeric, unicode, XOR, and fnstenv encodings. Returns encoded shellcode and decoder stub. User must provide ...

Search for ROP/JOP/COP/COOP gadgets in a binary file. Returns addresses, instructions, and bytes for each gadget. Supports filtering by regex pattern and gadget type. User must ...

Find

Generate egghunter shellcode for constrained buffer sizes. An egghunter searches process memory for a 4-byte

Generate De Bruijn sequence for offset finding. Every 4-byte substring is unique, allowing precise offset calculation from crash dumps.

Generate a pwntools-compatible Python exploit script (exploit.py).

Solve a system of constraints using the Z3 SMT solver.

Verify a user-supplied ROP chain against an exploit goal using Z3.

Load an extension and execute a named exported context function.

Install/register an extension from a manifest, local package directory, local module file, or remote module URL.

Reload an installed extension by unloading and loading it again.

Enable or disable capture of fetch()-based streams. Wraps window.fetch and, for responses with content-type text/event-stream, clones the body and parses the SSE frame stream in...

Attach Frida to a local target and open a session.

Generate a real Frida Interceptor.attach block for a symbol and optionally install it in a session.

Detach from a Frida session and clean up resources.

Run frida-dexdump as a high-level Android DEX dump helper by package/process name or PID.

Generate a Frida interceptor or hook script from built-in templates.

Scan process memory for a byte pattern via Frida Memory.scanSync. Searches a named module, an explicit address range, or all readable ranges by default. Pass async:true to scan ...

Resume a target previously spawned for early Frida instrumentation.

Execute a Frida JavaScript snippet inside an attached Frida session. Pass async:true to run in a background task (MCP 2.0 Tasks) and poll with tasks_get/tasks_result — useful fo...

Spawn a target through Frida for early instrumentation before normal execution.

Generate a Frida interceptor script for a list of symbols.

Send a command to a Ghidra headless analysis bridge.

Replay a GraphQL operation with optional variables, batch array, or Apollo persisted-query (APQ) extensions.

Open a GraphQL subscription WebSocket, perform the graphql-transport-ws (or legacy graphql-ws) handshake, send a subscribe frame, and collect frames for collectMs. Runs in-page ...

Encode one or more messages into a gRPC / gRPC-Web length-prefixed body. Inverse of grpc_frame_parse — for constructing test or replay bodies. Each message takes payloadHex plus...

Install a pre-built JavaScript hook from 20+ built-in presets (eval, atob/btoa, Proxy, Reflect, Object.defineProperty, etc.), or provide customTemplate/customTemplates to instal...

Send a raw HTTP request over plain TCP.

Build a raw HTTP/1.x request payload.

Build a raw HTTP/2 frame.

Probe an HTTP/2 endpoint.

Move mouse along a Bezier curve with jitter.

Scroll with randomized speed and pauses to mimic human behavior.

Type text with human-like speed and occasional typos.

Build a deterministic ICMPv4 echo request or reply payload with an automatically computed checksum.

Send a command to an IDA Pro plugin bridge.

Inject a DLL into a target process. Requires elevated privileges. Target process and payload are validated before injection.

Allocate and execute raw shellcode in a target process. Requires elevated privileges. Target process and payload are validated before injection.

Install an extension from the remote registry.

Apply hook presets inside an instrumentation session.

Replay a captured network request inside an instrumentation session.

Manage operations inside an instrumentation session.

Start, stop, or query status of an instrumentation recording session. Destroying a session archives it read-only (the last 8 destroyed sessions are retained, oldest evicted) so ...

Three-stage deobfuscation pipeline: preprocess → deobfuscate → humanize.

Solve opaque predicates and constant expressions in obfuscated code.

Symbolic execution of JavaScript: explore all feasible execution paths, collect path constraints, and solve them. Best for control-flow-flattened code with complex branching.

Symbolic execution of JSVMP bytecode: step through instructions symbolically to infer original logic, constraints, and confidence score. Use after js_analyze_vm to get instructi...

Create, inspect, and clear JavaScript runtime hooks.

Allocate executable memory in target process (VirtualAllocEx wrapper). Win32 only. Requires JSHOOK_INJECTION_ENABLE=1.

Execute a Cheat Engine-style Auto Assembler script. Parses [ENABLE]/[DISABLE] sections and executes ENABLE commands. Supported commands: ALLOC(name,size), DEALLOC(name), LABEL(n...

Execute the DISABLE section of a previously-run Auto Assembler script. Pass the disableScript returned by memory_auto_assemble. Executes DISABLE commands, running DEALLOC last (...

Write multiple memory patches at once. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.

Breakpoint via hardware debug registers (DR0-DR3) or software INT3 (0xCC). Actions: set, remove, list, trace. Hardware BPs (type=\

Walk the call stack of a target process thread using the x64 RBP frame-pointer chain. Suspends the thread, reads the CONTEXT to get RBP/RSP/RIP, then follows the linked list of ...

Import, export, sign, or verify Cheat Engine .CT files. Export: converts JSON entries to valid .CT XML. Import: parses .CT XML to JSON. Sign: HMAC-SHA256 sign the XML using a se...

Find what writes to or accesses a memory address (Cheat Engine MWT workflow). Sets a hardware breakpoint on the target address, auto-rearms after each hit, captures the faulting...

Start a new memory scan session.

Free remote memory in target process (VirtualFreeEx wrapper). Win32 only. Requires JSHOOK_INJECTION_ENABLE=1.

Freeze or unfreeze a memory address. Freeze continuously writes a value to prevent changes; unfreeze stops it.

EPT Hypervisor Phase 1: VMXON, VMCS setup, basic VM-exit handler design, CPUID spoofing. Intel VT-x only. Requires BYOVD kernel driver for MSR reads and VMXON region preparation...

Inject a DLL into target process. Win32 only. Modes: loadlibrary (LoadLibraryW injection) or manualmap (manual mapping). Requires JSHOOK_INJECTION_ENABLE=1.

Inject shellcode into target process. Win32 only. Methods: createremote (CreateRemoteThread) or ntcreatethread (NtCreateThreadEx). Requires JSHOOK_INJECTION_ENABLE=1.

Narrow an existing scan session. Supports delta modes: changed_by (value changed by exactly N), increased_by (value increased by at least N), decreased_by (value decreased by at...

Write bytes to target process at address. Saves original bytes for undo. Use for runtime code patching.

NOP out instructions at address (replace with 0x90). Useful for disabling checks or jumps.

Pointer chain operations: scan (multi-level BFS), autoscan (auto-discover pointer chains by recursively scanning for pointers that point to or near the target address), validate...

Suspend or resume a target process for consistent memory snapshots. Suspend freezes all threads (NtSuspendProcess on Win32, SIGSTOP on Linux, task_suspend on macOS) so memory re...

Change memory page protection for a region in the target process. Wraps VirtualProtectEx (Win32) / mprotect (Linux) / mach_vm_protect (macOS). Protection: r (read-only), rw (rea...

Connect to a remote jshookmcp MCP server via WebSocket for remote debugging. Enables ceserver-style remote memory operations: connect to a remote instance, forward tool calls (m...

Scan process memory for a pattern or value. Requires elevated privileges. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.

Hook time APIs (GetTickCount64/GetTickCount/QueryPerformanceCounter/QueryPerformanceFrequency/timeGetTime/GetSystemTimeAsFileTime) to scale process time via an in-process SSE2 t...

Ultimap-style instruction-level code tracing. Sets INT3 (0xCC) software breakpoints at function entry points and logs every execution. Aggregates hit counts per address to produ...

Start an unknown initial value scan.

Poll a memory address until its value changes (like scanmem\

Write data to process memory at a given address. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.

Write a typed value to a memory address. Supports undo/redo via memory_write_history(action=undo|redo).

Unpack a miniapp package.

Encode a structured Mojo IPC message into a hex payload.

Start or stop Mojo IPC monitoring for the active Chromium-based target.

Generate a Frida verification script that probes a target Chromium process for known Mojo C-API exports (MojoWriteMessage, MojoWriteMessageNew) across modules. Uses a curated sy...

Allocate raw guest memory (NOT a JNI handle — a real char* address). Optionally fill with initial data via fillBytes (base64). Returns the guest address to pass as an integer ar...

Batch-bind host functions to ALL resolved import stubs in the GOT. Reads the GOT table (0x74000 range), finds every unique resolved address, and binds the given JS function body...

Register a JavaScript host function at a specific guest address, overriding any existing stub. The function receives guest registers (ctx.x(0)..x(7)), can read/write guest memor...

Call a function at an arbitrary guest address (e.g. a native method registered via RegisterNatives). Uses AArch64 AAPCS with args in x0..x7; returns x0. Set injectJni=true to pr...

Invoke an exported

Invoke an exported function by name following AArch64 AAPCS (integer args in x0..x7, result in x0). Auto-detects JNI signatures. Set injectJni=false to force raw arguments. Set ...

Create a mock JNI object handle pre-populated with controlled data. Use BEFORE calling JNI functions to seed the handle table so that GetStringUTFChars / GetObjectArrayElement /...

Create an isolated ARM64 emulator session and return its sessionId. Each session owns its own CPU registers, guest stack, and JNI object table, so concurrent analyses never inte...

GDB Remote Serial Protocol (RSP) TCP server. Starts a real TCP server on host:port that GDB clients can connect to. Provides full register read/write, memory read/write, step, c...

Extract a specific arm64-v8a .so from an APK by name and load it into a session in one step (no temp files). Pair with nemu_extract_apk_libs to discover library names.

Load an AArch64 ELF shared object (.so) from a filesystem path into a session, mapping its segments and resolving exported symbols. Prerequisite for list_symbols / call_symbol /...

Load a chain of dependent libraries into a session, resolving inter-library imports. Pass dependency .so paths as dependencyPaths (loaded first in order), then the primary .so p...

Map a memory region in guest address space. Use to extend the mapped area for output buffers or scratch data that would otherwise cause unmapped-memory faults. Idempotent — safe...

Wrap base64 bytes as a JNI jbyteArray handle to pass as an argument into call_jni_export (e.g. the plaintext a signing routine consumes). Returns the handle.

Apply multiple memory patches in a single call. Each patch is {address, dataBase64, writeProtect?}. Faster than repeated nemu_write_memory calls — essential for atomic code patc...

Map the TPIDR_EL0 (thread-pointer) TLS block so its memory is accessible for pre-population via nemu_write_regions. Returns the TLS base address. Use this before writing data to...

Connect to a remote native-emulator session via IPC relay. Proxies nemu operations through a named pipe (Windows) or Unix domain socket (Linux/macOS) with JSON-RPC over length-p...

Load a JSON-serialised array of tool calls and execute them sequentially to set up a session. Each entry is {tool, args}. Supported tools: alloc_memory, write_regions, call_addr...

Set arbitrary CPU registers by index. Pass an object mapping register number to value (e.g. {0: 0x60000000, 10: 0, 11: 0x55150}). Supports x0-x30 and floating-point d0-d31. Use ...

Override a specific vtable slot with a custom host function. The slot at vtableAddr + slotIndex*8 is rewritten to point to a stub executing

Invoke an exported symbol while recording every instruction executed (pc, opcode, step), optionally snapshotting named registers per step. Bounded by maxSteps. Use to follow the...

Load VM state into guest memory. Takes ctx values and table values as hex strings and writes them at the specified base addresses. Use to bridge Python LiteVM state into native ...

Write raw bytes into guest memory at a given address via base64 data. Use to update an input buffer between call_symbol invocations without re-allocating, or to patch code/data ...

Write multiple memory regions in a single call. Accepts an array of {address, dataBase64} objects. Essential for atomic code patching: apply all patches in one call to avoid int...

XOR a region of emulated memory with a single-byte key. Returns the XOR result as base64. Use for quick decryption testing — XOR a buffer with a candidate key byte and inspect t...

Listen on a local TCP port for one incoming connection.

Send raw TCP data to a remote host; accepts hex or text input.

Listen on a local UDP port for an incoming datagram.

Send a raw UDP datagram and wait for a response.

Disable network request monitoring

Enable network request monitoring.

Run an ICMP echo probe.

Manage network interception rules.

Manage network request monitoring.

Replay a captured network request with optional changes.

Measure round-trip time to a target URL.

Compute TLS/HTTP fingerprints for bot detection. compute_tls/compute_http build fingerprints from user-supplied lists; parse_client_hello parses a raw ClientHello record (hex) a...

Run an ICMP traceroute.

Navigate back in browser history.

Manage script blocking rules by URL pattern. Blocked scripts are prevented from loading/executing. Actions: add/block (add a rule), remove/unblock (remove a rule), list (show al...

Click a page element by CSS selector.

Start JS+CSS code coverage collection on the active page. Coverage tracks which bytes of each loaded script/stylesheet are actually executed. Use page_coverage_stop to stop coll...

Emulate a mobile device profile.

Execute JavaScript in page context.

Navigate forward in browser history.

Control how JavaScript dialogs (alert/confirm/prompt/beforeunload) are answered. By default installs a persistent handler that auto-dismisses all dialogs. Set dismissAll=false f...

Hover over an element by CSS selector.

Inject JavaScript to run on every page load.

Navigate the page to a URL with wait and network options.

Simulate a key press by name.

Reload the current page.

Execute a named script from the Script Library with optional runtime params (__params__).

Scroll to absolute or relative coordinates.

Select option(s) in a <select> element.

Set the browser viewport dimensions.

Type text into an element.

Wait for an element to appear.

Apply deterministic byte-level mutations to a hex payload.

Build a deterministic payload from field definitions.

Start or stop a Chrome performance trace.

Detect process hollowing (malware technique that unmaps original process image and injects malicious code). Compares process memory sections (.text, .data, .rdata) with on-disk ...

Launch an executable with remote debugging port enabled.

Resume a previously suspended process. Cross-platform: NtResumeProcess (Win32), SIGCONT (Linux), task_resume (macOS).

Suspend a process for forensic snapshotting. Cross-platform: NtSuspendProcess (Win32), SIGSTOP (Linux), task_suspend (macOS). Pair with process_resume to restore. Use before mem...

Start or stop CPU profiling.

Add an interception rule: forward, mock_response, redirect, or block.

Start the local HTTP/HTTPS interception proxy with optional TLS.

Stop the proxy and release all active rules.

Execute a read-only SQL query against a trace database.

Build a deterministic IPv4 or IPv6 packet.

Reload plugins and workflows from configured directories, and directly register extension tools visible in the current profile.

Create, inspect, list, preview, or run an end-to-end reverse-engineering workflow session with artifact root, cross-domain tool calls, and evidence refs.

Send a command to a local Rizin/r2 analysis bridge.

One-stop tool router: accepts a natural language task description, returns recommended tools and next

Execute an extension workflow by workflowId with optional config and timeout overrides.

Execute a registered macro with sequence, parallel, branch, fallback, and retry orchestration.

Deliver a synthetic push message to a service worker via CDP ServiceWorker.deliverPushMessage. Requires an attached CDP session on a SW target.

Dispatch a Background Sync event to a service worker via CDP ServiceWorker.dispatchSyncEvent. Requires an attached CDP session on a SW target.

Enable SSE monitoring by injecting EventSource interceptor.

Start recording debugger traces into a SQLite database for time-travel.

Configure CDP timing jitter.

Inject anti-detection scripts to reduce bot fingerprint exposure.

Set User-Agent and fingerprint.

Run anti-detection checks.

Stop trace recording and return the final session summary.

Direct NT syscall invocation guidance. Resolves SSN for a given NT function and returns a stub template with usage instructions for in-process direct syscall invocation. Bypasse...

Live eBPF syscall attach — spawns a bpftrace process, captures syscall events as structured JSON in real time, and returns them directly. Unlike syscall_ebpf_trace (script-gener...

Trace syscalls on Linux with eBPF. Requires root or CAP_BPF.

Resolve NT syscall service numbers (SSN) from on-disk ntdll.dll. Parses the export table to extract Zw* → SSN mappings and locates a syscall;ret gadget for direct invocation stu...

Correlate captured syscall events with real JS call stacks via debugger integration. Goes beyond static heuristics by querying live CDP call stacks for syscall→JS mapping. Falls...

Start syscall monitoring.

Stop syscall interception and release all captured events.

Cross-tab coordination.

Request cancellation of a background task (MCP 2.0 Tasks protocol). Only tasks in the working state can be cancelled; the tool-defined cancel handler runs if present.

Close an open TCP session.

Open a TCP session.

Write data to an open TCP session.

Bypass certificate pinning via Frida injection (supports the target TLS library and HTTP client frameworks).

Close an open TLS session.

Decrypt a TLS payload using a provided key, nonce, and algorithm.

Enable SSLKEYLOGFILE output for TLS library clients.

Open a TLS session.

Start or stop trace recording into a SQLite database.

Run a reproducible binary transform workbench over base64 inputs: base64, hex, XOR, RC4, AES-CBC/ECB decrypt, zlib/gzip inflate, entropy, previews, and magic hints.

Run semantic code analysis for structure, behavior, and risks.

Call a JNI function in a running Unidbg emulator session.

Emulate a native function with Unidbg when available.

Emulate a native shared library in Unidbg.

Get execution trace from Unidbg session with configurable detail.

Trace V8 deoptimization events during a capture window. Primary path uses CDP Tracing (v8 category, V8.DeoptimizeFrame events — no natives syntax needed, structured reason/type/...

Collect a V8 allocation sampling profile via CDP HeapProfiler. Starts sampling for a capture window (default 5s), then returns the aggregated allocation call tree: per-function ...

Collect and visualize V8 TurboFan IR (sea-of-nodes / Turboshaft graph). Two modes: (1) Provide JS source code — spawns an isolated V8 child with --trace-turbo to generate IR JSO...

Inspect JIT/TurboFan compilation state for functions in a script. Reports optimization tier (interpreted/maglev/turbofan) with V8 optimization status codes. Supports actions: in...

Atomic primitive: start or stop V8 type profiling via CDP Profiler.startTypeProfile() / takeTypeProfile() / stopTypeProfile(). Type profiles record the runtime types flowing thr...

Real wasm-level binary instrumentation: disassembles via wasm2wat, inserts a call to an imported trace function at every function entry, and reassembles via wat2wasm. Unlike was...

Real wasm-level basic-block instrumentation: disassembles via wasm2wat, inserts a call to an imported trace function at every block/loop/if body entry (and function entry), and ...

Generate a JS instrumentation wrapper for a .wasm module.

Run an exported .wasm function.

Optimize a .wasm binary for size or speed.

Transpile .wasm bytecode to C source and header files.

Manage watch expressions for monitoring variable values during debugging.\n\nActions:\n- add: Add a watch expression (requires expression)\n- remove: Remove by watchId\n- list: ...

Run webcrack bundle unpacking and return extracted module graph.

Measure per-frame CPU and GPU cost over a rAF loop using GPU timestamp queries (device.limits.timestampPeriod conversion). Answers

Compile WGSL shader and extract metadata (entry points, bindings, attributes). Validates shader code and detects potential security issues.

GPU timing analysis for side-channel detection. Measures GPU command execution time variance to detect cache-based side-channel attacks (Graz University 2025 research).

Open a WebSocket session.

Send a WebSocket frame.

Solve a widget challenge with hook, manual, or configured external service.

Evaluate a condition against the stepResults argument and execute one of two tool branches. Supports built-in predicates: always_true, always_false, any_step_failed, success_rat...

Enable or disable WebSocket frame capture.

Send a frame through a live in-page WebSocket instance retained by ws_monitor(exposeInstances=true). Enables edit-and-resend replay of WebSocket traffic. Only reaches WebSockets...