# Js Reverse MCP server

Agent View of the PolicyLayer registry record for Js Reverse: identity, probed posture, risk grade, and all 93 tools classified. HTML page: https://policylayer.com/tools/1600822305-js-reverse-mcp

## Facts

- Server id: `1600822305/js-reverse-mcp`
- Homepage: https://github.com/1600822305/js-reverse-mcp
- Registry record: grade F, identity unverified
- Lifecycle: active
- Rate-limited: no
- Tools: 93
- Tool categories present: Destructive, Execute, Read, Write
- Tags: 1600822305 js reverse mcp, admin, automation
- Record last modified: 2026-10-01T02:08:56.087Z

## Tools (93)

| Tool | Category | Risk | Record |
| --- | --- | --- | --- |
| `clear_browser_cache` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/clear-browser-cache.md |
| `clear_cookies` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/clear-cookies.md |
| `clear_network_conditions` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/clear-network-conditions.md |
| `delete_cookie` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/delete-cookie.md |
| `delete_token` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/delete-token.md |
| `remove_breakpoint` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/remove-breakpoint.md |
| `remove_dom_breakpoint` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/remove-dom-breakpoint.md |
| `remove_network_rule` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/remove-network-rule.md |
| `remove_xhr_breakpoint` | Destructive | Critical | https://policylayer.com/tools/1600822305-js-reverse-mcp/remove-xhr-breakpoint.md |
| `add_network_rule` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/add-network-rule.md |
| `api_request` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/api-request.md |
| `batch_replay` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/batch-replay.md |
| `break_on_attribute_modified` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/break-on-attribute-modified.md |
| `break_on_node_removed` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/break-on-node-removed.md |
| `break_on_subtree_modified` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/break-on-subtree-modified.md |
| `break_on_xhr` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/break-on-xhr.md |
| `encode_protobuf` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/encode-protobuf.md |
| `evaluate_on_callframe` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/evaluate-on-callframe.md |
| `evaluate_script` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/evaluate-script.md |
| `hook_crypto_functions` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/hook-crypto-functions.md |
| `hook_function` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/hook-function.md |
| `monitor_events` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/monitor-events.md |
| `monitor_eventsource` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/monitor-eventsource.md |
| `monitor_form_submit` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/monitor-form-submit.md |
| `monitor_input_changes` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/monitor-input-changes.md |
| `navigate_page` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/navigate-page.md |
| `new_page` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/new-page.md |
| `pause` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/pause.md |
| `replay_request` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/replay-request.md |
| `resume` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/resume.md |
| `set_breakpoint` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/set-breakpoint.md |
| `set_breakpoint_on_text` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/set-breakpoint-on-text.md |
| `set_cache_disabled` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/set-cache-disabled.md |
| `set_extra_headers` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/set-extra-headers.md |
| `set_network_conditions` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/set-network-conditions.md |
| `start_js_coverage` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/start-js-coverage.md |
| `step_into` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/step-into.md |
| `step_out` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/step-out.md |
| `step_over` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/step-over.md |
| `stop_eventsource_monitor` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/stop-eventsource-monitor.md |
| `stop_form_monitor` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/stop-form-monitor.md |
| `stop_input_monitor` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/stop-input-monitor.md |
| `stop_monitor` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/stop-monitor.md |
| `stop_websocket_monitor` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/stop-websocket-monitor.md |
| `trace_function` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/trace-function.md |
| `wait_for_request` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/wait-for-request.md |
| `wait_for_response` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/wait-for-response.md |
| `watch_global` | Execute | High | https://policylayer.com/tools/1600822305-js-reverse-mcp/watch-global.md |
| `analyze_encoded_string` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/analyze-encoded-string.md |
| `beautify_script` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/beautify-script.md |
| `decode_protobuf` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/decode-protobuf.md |
| `decode_response` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/decode-response.md |
| `deobfuscate` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/deobfuscate.md |
| `detect_encryption` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/detect-encryption.md |
| `diff_globals` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/diff-globals.md |
| `export_har` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/export-har.md |
| `extract` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/extract.md |
| `extract_form_data` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/extract-form-data.md |
| `extract_metadata` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/extract-metadata.md |
| `find_in_script` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/find-in-script.md |
| `get_console_message` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/get-console-message.md |
| `get_cookies` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/get-cookies.md |
| `get_paused_info` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/get-paused-info.md |
| `get_response_body` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/get-response-body.md |
| `get_script_source` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/get-script-source.md |
| `get_storage` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/get-storage.md |
| `inspect_object` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/inspect-object.md |
| `list_breakpoints` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-breakpoints.md |
| `list_console_messages` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-console-messages.md |
| `list_eventsource_messages` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-eventsource-messages.md |
| `list_globals` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-globals.md |
| `list_hooks` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-hooks.md |
| `list_network_requests` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-network-requests.md |
| `list_network_rules` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-network-rules.md |
| `list_pages` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-pages.md |
| `list_scripts` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-scripts.md |
| `list_tokens` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-tokens.md |
| `list_watchers` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-watchers.md |
| `list_websocket_connections` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-websocket-connections.md |
| `list_websocket_messages` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/list-websocket-messages.md |
| `monitor_websocket` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/monitor-websocket.md |
| `search_in_sources` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/search-in-sources.md |
| `search_network` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/search-network.md |
| `snapshot_globals` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/snapshot-globals.md |
| `stop_js_coverage` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/stop-js-coverage.md |
| `take_screenshot` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/take-screenshot.md |
| `take_snapshot` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/take-snapshot.md |
| `unhook_function` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/unhook-function.md |
| `unwatch_global` | Read | Low | https://policylayer.com/tools/1600822305-js-reverse-mcp/unwatch-global.md |
| `save_token` | Write | Medium | https://policylayer.com/tools/1600822305-js-reverse-mcp/save-token.md |
| `select_page` | Write | Medium | https://policylayer.com/tools/1600822305-js-reverse-mcp/select-page.md |
| `set_active_token` | Write | Medium | https://policylayer.com/tools/1600822305-js-reverse-mcp/set-active-token.md |
| `set_cookie` | Write | Medium | https://policylayer.com/tools/1600822305-js-reverse-mcp/set-cookie.md |

## Tool descriptions

- `clear_browser_cache` — Clears the browser HTTP cache via CDP Network.clearBrowserCache so the
- `clear_cookies` — Clears all browser cookies via CDP Network.clearBrowserCookies. Useful
- `clear_network_conditions` — Resets network emulation (back online, no throttling) and clears any
- `delete_cookie` — Deletes cookies matching the given name (optionally scoped by url,
- `delete_token` — Delete a saved token by name.
- `remove_breakpoint` — Removes a breakpoint by its ID. Use list_breakpoints to see active breakpoints.
- `remove_dom_breakpoint` — Removes a DOM breakpoint from an element.
- `remove_network_rule` — Removes a network interception rule by id. Fetch interception is
- `remove_xhr_breakpoint` — Removes an XHR/Fetch breakpoint.
- `add_network_rule` — Adds a network interception rule (replaces the old intercept_requests).
- `api_request` — Make an HTTP request from the browser context. Supports custom method, headers, body, and automatic token injection. The request is executed inside the browser page using fetch(), so it shares cookies and origin with the page. Use tokenN…
- `batch_replay` — Replays multiple requests in sequence and summarises each response.
- `break_on_attribute_modified` — Sets a breakpoint that triggers when any attribute of an element is modified. Useful for tracking hidden field changes, class modifications, etc.
- `break_on_node_removed` — Sets a breakpoint that triggers when an element is about to be removed from the DOM.
- `break_on_subtree_modified` — Sets a breakpoint that triggers when the DOM subtree of an element is modified (child added/removed). Useful for tracking dynamic content changes.
- `break_on_xhr` — Sets a breakpoint that triggers when an XHR/Fetch request URL contains the specified string.
- `encode_protobuf` — Encode data to protobuf binary format without a .proto schema. Specify field numbers, types, and values to build a protobuf message. Returns hex and base64 encoded output.
- `evaluate_on_callframe` — Evaluates a JavaScript expression in the context of a specific call frame while paused. This allows you to inspect variables and execute code in the paused scope.
- `evaluate_script` — Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON so returned values have to JSON-serializable.
- `hook_crypto_functions` — Automatically hooks common crypto library functions to log encryption/decryption calls. Supports CryptoJS, JSEncrypt, Web Crypto API, and more.
- `hook_function` — Hooks a JavaScript function to log its calls, arguments, and return values. Useful for understanding how functions are used without setting breakpoints.
- `monitor_events` — Monitors DOM events on a specified element or window. Events will be logged to console.
- `monitor_eventsource` — Starts capturing Server-Sent Events (EventSource) messages via CDP.
- `monitor_form_submit` — Monitors form submissions to capture form data before it is sent. Useful for analyzing login forms and finding encryption of passwords.
- `monitor_input_changes` — Monitors changes to input fields in real-time. Captures every keystroke and value change. Useful for tracking password field modifications before encryption.
- `navigate_page` — Navigates the currently selected page to a URL.
- `new_page` — Creates a new page
- `pause` — Pauses JavaScript execution at the current point. Use this to interrupt running code.
- `replay_request` — Re-sends a captured request (by numeric id from search_network) from the
- `resume` — Resumes JavaScript execution after being paused at a breakpoint. Execution continues until the next breakpoint or completion.
- `set_breakpoint` — Sets a breakpoint in a JavaScript file at the specified line. The breakpoint will trigger when the code executes.
- `set_breakpoint_on_text` — Sets a breakpoint on specific code (function name, statement, etc.) by searching for it and automatically determining the exact position. Works with both normal and minified files.
- `set_cache_disabled` — Toggles the browser cache for the page via CDP Network.setCacheDisabled.
- `set_extra_headers` — Sets extra HTTP headers sent with every subsequent request (CDP
- `set_network_conditions` — Emulates network conditions (offline, throttling, latency) and optionally
- `start_js_coverage` — Starts collecting JavaScript code coverage data. This tracks which parts of JavaScript code are executed.
- `step_into` — Steps into the next function call. Use this to enter and debug function bodies.
- `step_out` — Steps out of the current function, continuing until the function returns. Use this to quickly exit a function.
- `step_over` — Steps over to the next statement, treating function calls as a single step. Use this to move through code without entering function bodies.
- `stop_eventsource_monitor` — Stops capturing EventSource messages. Captured data is retained.
- `stop_form_monitor` — Stops monitoring form submissions.
- `stop_input_monitor` — Stops monitoring input field changes.
- `stop_monitor` — Stops an event monitor.
- `stop_websocket_monitor` — Stops capturing WebSocket frames. Captured frames are retained.
- `trace_function` — Traces calls to a function by its name in the source code. Works for ANY function including module-internal functions (webpack/rollup bundled). Uses
- `wait_for_request` — Blocks until a network request matching the filters is observed (across
- `wait_for_response` — Blocks until a network request matching the filters has received a
- `watch_global` — Watches a global variable for changes. When the variable is modified, logs the old and new values to console.
- `analyze_encoded_string` — Analyzes a string to detect its encoding type (Base64, Hex, JWT, URL encoding, etc.) and attempts to decode it.
- `beautify_script` — Beautifies minified/compressed JavaScript code to make it more readable. Supports automatic indentation, line breaks, and formatting.
- `decode_protobuf` — Decode protobuf binary without a .proto schema. Provide inline data (hex/base64) OR a url to fetch and decode (e.g. gRPC-Connect responses). Analyzes wire format to extract field numbers, types, and values, including nested messages.
- `decode_response` — Decodes a captured response body (by numeric id from search_network) as
- `deobfuscate` — AST-based JavaScript deobfuscation (powered by Babel). Parses the code into an AST and applies scope-safe transforms: variable renaming, constant folding, dead/unreachable code elimination, and string/number normalization. Far more relia…
- `detect_encryption` — Detects encryption algorithms, crypto libraries, and encoding methods. By default (scope=
- `diff_globals` — Compares current global variables with a previous snapshot. Shows added, removed, and changed variables. Use after snapshot_globals to find what changed.
- `export_har` — Exports captured network traffic as a HAR 1.2 file (optionally filtered
- `extract` — Unified web content extraction. Use
- `extract_form_data` — Extract form structure and current values, including hidden fields. By default returns all matching forms; pass formIndex to inspect a single form. Password values are masked unless maskPasswords is set to false.
- `extract_metadata` — Extract page metadata including JSON-LD, Open Graph, Twitter cards, and standard meta tags.
- `find_in_script` — Finds a string in a specific script and returns its exact line/column position with surrounding context. Ideal for setting breakpoints in minified files where the entire code is on one line.
- `get_console_message` — Gets a console message by its ID. You can get all messages by calling ${listConsoleMessages.name}.
- `get_cookies` — Reads cookies via the CDP Network domain, including httpOnly cookies
- `get_paused_info` — Gets information about the current paused state including call stack, current location, and scope variables. Use this after a breakpoint is hit to understand the execution context.
- `get_response_body` — Fetches the full response body of a captured request by its numeric id
- `get_script_source` — Gets the source code of a JavaScript script by its script ID. Supports line range (for normal files) or character offset (for minified single-line files). Use list_scripts first to find the script ID.
- `get_storage` — Gets browser storage data including cookies, localStorage, and sessionStorage. Cookies are read via the Chrome DevTools Protocol (Network.getCookies), so httpOnly cookies (where auth/session tokens usually live) are included, along with …
- `inspect_object` — Deeply inspects a JavaScript object, showing its properties, prototype chain, and methods. Useful for understanding object structure.
- `list_breakpoints` — Lists all active breakpoints in the current debugging session.
- `list_console_messages` — List all console messages for the currently selected page since the last navigation.
- `list_eventsource_messages` — Lists captured Server-Sent Events, filterable by URL/content.
- `list_globals` — Lists all global variables on the window object, excluding built-in browser APIs. Useful for finding custom variables, configs, tokens, and encryption functions.
- `list_hooks` — Lists all active function hooks.
- `list_network_requests` — List all requests for the currently selected page since the last navigation.
- `list_network_rules` — Lists active network interception rules and their hit stats.
- `list_pages` — Get a list of pages open in the browser.
- `list_scripts` — Lists all JavaScript scripts loaded in the current page. Returns script ID, URL, and source map information. Use this to find scripts before setting breakpoints or searching.
- `list_tokens` — List all saved authentication tokens. Shows name, type, metadata, and which one is active.
- `list_watchers` — Lists all active global variable watchers.
- `list_websocket_connections` — Lists tracked WebSocket connections and their frame counts.
- `list_websocket_messages` — Lists captured WebSocket frames, filterable by connection, direction,
- `monitor_websocket` — Starts capturing WebSocket frames via the CDP Network domain. Unlike a
- `search_in_sources` — Searches for a string or regex pattern in all loaded JavaScript sources. Returns matching lines with script ID, URL, and line number. Use get_script_source with startLine/endLine to view full context around matches.
- `search_network` — Searches captured network requests (CDP-backed store that survives
- `snapshot_globals` — Takes a snapshot of current global variables for later comparison with diff_globals. Useful for finding what changed after an action (e.g., login, button click).
- `stop_js_coverage` — Stops collecting JavaScript code coverage and generates a detailed report showing which code was executed and which was not.
- `take_screenshot` — Take a screenshot of the page or element.
- `take_snapshot` — Take a text snapshot of the currently selected page based on the a11y tree. The snapshot lists page elements along with a unique identifier (uid). Always use the latest snapshot. Prefer taking a snapshot over taking a screenshot. The sna…
- `unhook_function` — Removes a previously installed function hook.
- `unwatch_global` — Stops watching a global variable and restores original behavior.
- `save_token` — Save an authentication token with a name for later use. Supports multiple tokens for different accounts/services. Use list_tokens to see saved tokens and set_active_token to switch between them.
- `select_page` — Select a page as a context for future tool calls.
- `set_active_token` — Set a saved token as the active token. The active token is automatically used by api_request when no explicit token is provided.
- `set_cookie` — Sets a cookie via the CDP Network domain. Either

## Related servers

- UnClick (1662 tools) — https://policylayer.com/tools/io-github-malamutemayhem-unclick-mcp-server.md
- Apibase (1384 tools) — https://policylayer.com/tools/io-github-whiteknightonhorse-apibase.md
- Delx Mcp A2a (1068 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-mcp-a2a.md
- MCP Framework Personal (912 tools) — https://policylayer.com/tools/inggerman-mcps.md
- Hermoso (896 tools) — https://policylayer.com/tools/hermoso.md
- Nodebench (824 tools) — https://policylayer.com/tools/io-github-homenshum-nodebench.md
- Altium-MCP-Suite (817 tools) — https://policylayer.com/tools/altium-mcp-suite.md
- Eda Agent (777 tools) — https://policylayer.com/tools/eda-agent.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=1600822305-js-reverse-mcp · API: https://policylayer.com/registry/api · Recommended policies for every tool: https://policylayer.com/policies/1600822305-js-reverse-mcp