# Jshookmcp MCP server

Agent View of the PolicyLayer registry record for Jshookmcp: identity, probed posture, risk grade, and all 736 tools classified. HTML page: https://policylayer.com/tools/io-github-vmoranv-jshookmcp

## Facts

- Server id: `@jshookmcp/jshook`
- Install: `npx -y @jshookmcp/jshook`
- Homepage: https://github.com/vmoranv/jshookmcp
- Registry record: grade F, identity unverified
- Lifecycle: active
- Rate-limited: no
- Tools: 736
- Tool categories present: Destructive, Execute, Read, Write
- Tags: io github vmoranv jshookmcp, admin, automation
- Record last modified: 2026-09-27T14:09:06.302Z

## Tools (736)

| Tool | Category | Risk | Record |
| --- | --- | --- | --- |
| `adb_uninstall` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-uninstall.md |
| `cleanup_artifacts` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cleanup-artifacts.md |
| `clear_all_caches` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/clear-all-caches.md |
| `clear_collected_data` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/clear-collected-data.md |
| `dart_destroy_session` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-destroy-session.md |
| `exploit_cache_clear` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-cache-clear.md |
| `exploit_cache_invalidate` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-cache-invalidate.md |
| `extension_uninstall` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/extension-uninstall.md |
| `ghidra_decompile` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ghidra-decompile.md |
| `ida_decompile` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ida-decompile.md |
| `jadx_decompile_apk` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/jadx-decompile-apk.md |
| `manual_token_cleanup` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/manual-token-cleanup.md |
| `memory_antidetection` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-antidetection.md |
| `memory_batch_edit` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-batch-edit.md |
| `memory_scan_session` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-scan-session.md |
| `memory_unregister_type` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-unregister-type.md |
| `nemu_destroy_session` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-destroy-session.md |
| `page_cookies` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-cookies.md |
| `page_local_storage` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-local-storage.md |
| `page_session_storage` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-session-storage.md |
| `proxy_clear_logs` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-clear-logs.md |
| `proxy_clear_rules` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-clear-rules.md |
| `proxy_remove_rule` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-remove-rule.md |
| `reset_token_budget` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/reset-token-budget.md |
| `session_progress_clear` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/session-progress-clear.md |
| `snapshot_restore` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/snapshot-restore.md |
| `tls_keylog_seal` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-keylog-seal.md |
| `v8_heap_snapshot_delete` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-snapshot-delete.md |
| `webhook` | Destructive | Critical | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webhook.md |
| `activate_tools` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/activate-tools.md |
| `adb_app_cold_start_trace` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-app-cold-start-trace.md |
| `adb_dumpsys` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-dumpsys.md |
| `adb_input_keyevent` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-input-keyevent.md |
| `adb_input_swipe` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-input-swipe.md |
| `adb_input_tap` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-input-tap.md |
| `adb_input_text` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-input-text.md |
| `adb_install` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-install.md |
| `adb_port_forward` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-port-forward.md |
| `adb_shell` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-shell.md |
| `adb_webview_attach` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-webview-attach.md |
| `ai_hook` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ai-hook.md |
| `analysis_deflat_control_flow` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/analysis-deflat-control-flow.md |
| `antidebug_bypass` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/antidebug-bypass.md |
| `api_probe_batch` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/api-probe-batch.md |
| `apk_sign` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-sign.md |
| `apktool_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apktool-build.md |
| `arp_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/arp-build.md |
| `ast_transform_apply` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ast-transform-apply.md |
| `ast_transform_chain` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ast-transform-chain.md |
| `binary_ninja_bridge` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-ninja-bridge.md |
| `breakpoint` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/breakpoint.md |
| `browser_attach` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-attach.md |
| `browser_attach_cdp_target` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-attach-cdp-target.md |
| `browser_close` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-close.md |
| `browser_codegen_start` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-codegen-start.md |
| `browser_codegen_stop` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-codegen-stop.md |
| `browser_cpu_profile_start` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-cpu-profile-start.md |
| `browser_cpu_profile_stop` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-cpu-profile-stop.md |
| `browser_detach_cdp_target` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-detach-cdp-target.md |
| `browser_evaluate_cdp_target` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-evaluate-cdp-target.md |
| `browser_jsdom_execute` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-jsdom-execute.md |
| `browser_jsdom_parse` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-jsdom-parse.md |
| `browser_launch` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-launch.md |
| `browser_performance_observer` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-performance-observer.md |
| `browser_select_tab` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-select-tab.md |
| `browser_trace_start` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-trace-start.md |
| `browser_trace_stop` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-trace-stop.md |
| `call_tool` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/call-tool.md |
| `camoufox_server` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/camoufox-server.md |
| `canvas_inject_draw_hook` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-inject-draw-hook.md |
| `canvas_trace_click_handler` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-trace-click-handler.md |
| `captcha_vision_solve` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/captcha-vision-solve.md |
| `captcha_wait` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/captcha-wait.md |
| `console_buffers` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-buffers.md |
| `console_execute` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-execute.md |
| `console_inject` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-inject.md |
| `console_inject_fetch_interceptor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-inject-fetch-interceptor.md |
| `console_inject_xhr_interceptor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-inject-xhr-interceptor.md |
| `cross_domain_correlate_all` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-correlate-all.md |
| `crypto_extract_standalone` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/crypto-extract-standalone.md |
| `crypto_test_harness` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/crypto-test-harness.md |
| `dart_call_function` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-call-function.md |
| `dart_create_session` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-create-session.md |
| `dart_trace_execution` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-trace-execution.md |
| `debugger_evaluate` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-evaluate.md |
| `debugger_lifecycle` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-lifecycle.md |
| `debugger_pause` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-pause.md |
| `debugger_resume` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-resume.md |
| `debugger_run_to_location` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-run-to-location.md |
| `debugger_step` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-step.md |
| `debugger_wait_for_paused` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-wait-for-paused.md |
| `deobfuscate` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/deobfuscate.md |
| `doctor_environment` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/doctor-environment.md |
| `electron_attach` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-attach.md |
| `electron_launch_debug` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-launch-debug.md |
| `electron_patch_fuses` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-patch-fuses.md |
| `ethernet_frame_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ethernet-frame-build.md |
| `execute_sandbox_script` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/execute-sandbox-script.md |
| `exploit_build_format_string` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-build-format-string.md |
| `exploit_build_heap_spray` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-build-heap-spray.md |
| `exploit_build_jop_chain` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-build-jop-chain.md |
| `exploit_build_ret2dlresolve` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-build-ret2dlresolve.md |
| `exploit_build_rop_chain` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-build-rop-chain.md |
| `exploit_build_stack_pivot` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-build-stack-pivot.md |
| `exploit_cache_configure` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-cache-configure.md |
| `exploit_calculate_offsets` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-calculate-offsets.md |
| `exploit_discover_one_gadget` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-discover-one-gadget.md |
| `exploit_encode_shellcode` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-encode-shellcode.md |
| `exploit_find_gadgets` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-find-gadgets.md |
| `exploit_find_jmp_esp` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-find-jmp-esp.md |
| `exploit_generate_egghunter` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-generate-egghunter.md |
| `exploit_generate_pattern` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-generate-pattern.md |
| `exploit_generate_pwntools` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-generate-pwntools.md |
| `exploit_solve_constraints` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-solve-constraints.md |
| `exploit_verify_rop_chain` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-verify-rop-chain.md |
| `extension_execute_in_context` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/extension-execute-in-context.md |
| `extension_install` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/extension-install.md |
| `extension_reload` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/extension-reload.md |
| `fetch_stream_monitor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/fetch-stream-monitor.md |
| `frida_attach` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-attach.md |
| `frida_attach_interceptor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-attach-interceptor.md |
| `frida_detach` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-detach.md |
| `frida_dex_dump` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-dex-dump.md |
| `frida_generate_script` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-generate-script.md |
| `frida_memory_scan` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-memory-scan.md |
| `frida_resume` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-resume.md |
| `frida_run_script` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-run-script.md |
| `frida_spawn` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-spawn.md |
| `generate_hooks` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/generate-hooks.md |
| `ghidra_bridge` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ghidra-bridge.md |
| `graphql_replay` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/graphql-replay.md |
| `graphql_subscribe` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/graphql-subscribe.md |
| `grpc_frame_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/grpc-frame-build.md |
| `hook_preset` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/hook-preset.md |
| `http_plain_request` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/http-plain-request.md |
| `http_request_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/http-request-build.md |
| `http2_frame_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/http2-frame-build.md |
| `http2_probe` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/http2-probe.md |
| `human_mouse` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/human-mouse.md |
| `human_scroll` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/human-scroll.md |
| `human_typing` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/human-typing.md |
| `icmp_echo_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/icmp-echo-build.md |
| `ida_bridge` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ida-bridge.md |
| `inject_dll` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/inject-dll.md |
| `inject_shellcode` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/inject-shellcode.md |
| `install_extension` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/install-extension.md |
| `instrumentation_hook_preset` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-hook-preset.md |
| `instrumentation_network_replay` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-network-replay.md |
| `instrumentation_operation` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-operation.md |
| `instrumentation_session` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-session.md |
| `js_deobfuscate_pipeline` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-deobfuscate-pipeline.md |
| `js_solve_constraints` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-solve-constraints.md |
| `js_symbolic_execute` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-symbolic-execute.md |
| `js_symbolic_execute_jsvmp` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-symbolic-execute-jsvmp.md |
| `manage_hooks` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/manage-hooks.md |
| `memory_allocate` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-allocate.md |
| `memory_auto_assemble` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-auto-assemble.md |
| `memory_auto_assemble_disable` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-auto-assemble-disable.md |
| `memory_batch_write` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-batch-write.md |
| `memory_breakpoint` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-breakpoint.md |
| `memory_call_stack` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-call-stack.md |
| `memory_cheat_table` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-cheat-table.md |
| `memory_find_accesses` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-find-accesses.md |
| `memory_first_scan` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-first-scan.md |
| `memory_free` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-free.md |
| `memory_freeze` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-freeze.md |
| `memory_hypervisor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-hypervisor.md |
| `memory_inject_dll` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-inject-dll.md |
| `memory_inject_shellcode` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-inject-shellcode.md |
| `memory_next_scan` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-next-scan.md |
| `memory_patch_bytes` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-patch-bytes.md |
| `memory_patch_nop` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-patch-nop.md |
| `memory_pointer_chain` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-pointer-chain.md |
| `memory_process_control` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-process-control.md |
| `memory_protect` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-protect.md |
| `memory_remote` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-remote.md |
| `memory_scan` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-scan.md |
| `memory_speedhack` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-speedhack.md |
| `memory_trace_code` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-trace-code.md |
| `memory_unknown_scan` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-unknown-scan.md |
| `memory_watch` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-watch.md |
| `memory_write` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-write.md |
| `memory_write_value` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-write-value.md |
| `miniapp_pkg_unpack` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/miniapp-pkg-unpack.md |
| `mojo_encode_message` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-encode-message.md |
| `mojo_monitor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-monitor.md |
| `mojo_verify_live` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-verify-live.md |
| `nemu_alloc_memory` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-alloc-memory.md |
| `nemu_bind_all_imports` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-bind-all-imports.md |
| `nemu_bind_host_fn` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-bind-host-fn.md |
| `nemu_call_address` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-call-address.md |
| `nemu_call_jni_export` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-call-jni-export.md |
| `nemu_call_symbol` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-call-symbol.md |
| `nemu_create_jni_handle` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-create-jni-handle.md |
| `nemu_create_session` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-create-session.md |
| `nemu_gdbserver` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-gdbserver.md |
| `nemu_load_apk_library` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-load-apk-library.md |
| `nemu_load_library` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-load-library.md |
| `nemu_load_library_chain` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-load-library-chain.md |
| `nemu_mem_map` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-mem-map.md |
| `nemu_new_byte_array` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-new-byte-array.md |
| `nemu_patch_apply` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-patch-apply.md |
| `nemu_prepare_tls` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-prepare-tls.md |
| `nemu_relay` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-relay.md |
| `nemu_session_load` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-session-load.md |
| `nemu_set_registers` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-set-registers.md |
| `nemu_set_vtable_slot` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-set-vtable-slot.md |
| `nemu_trace` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-trace.md |
| `nemu_vm_state_load` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-vm-state-load.md |
| `nemu_write_memory` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-write-memory.md |
| `nemu_write_regions` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-write-regions.md |
| `nemu_xor_region` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-xor-region.md |
| `net_raw_tcp_listen` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/net-raw-tcp-listen.md |
| `net_raw_tcp_send` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/net-raw-tcp-send.md |
| `net_raw_udp_listen` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/net-raw-udp-listen.md |
| `net_raw_udp_send` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/net-raw-udp-send.md |
| `network_disable` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-disable.md |
| `network_enable` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-enable.md |
| `network_icmp_probe` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-icmp-probe.md |
| `network_intercept` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-intercept.md |
| `network_monitor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-monitor.md |
| `network_replay_request` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-replay-request.md |
| `network_rtt_measure` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-rtt-measure.md |
| `network_tls_fingerprint` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-tls-fingerprint.md |
| `network_traceroute` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-traceroute.md |
| `page_back` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-back.md |
| `page_block_script` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-block-script.md |
| `page_click` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-click.md |
| `page_coverage_start` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-coverage-start.md |
| `page_emulate_device` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-emulate-device.md |
| `page_evaluate` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-evaluate.md |
| `page_forward` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-forward.md |
| `page_handle_dialog` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-handle-dialog.md |
| `page_hover` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-hover.md |
| `page_inject_script` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-inject-script.md |
| `page_navigate` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-navigate.md |
| `page_press_key` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-press-key.md |
| `page_reload` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-reload.md |
| `page_script_run` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-script-run.md |
| `page_scroll` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-scroll.md |
| `page_select` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-select.md |
| `page_set_viewport` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-set-viewport.md |
| `page_type` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-type.md |
| `page_wait_for_selector` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-wait-for-selector.md |
| `payload_mutate` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/payload-mutate.md |
| `payload_template_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/payload-template-build.md |
| `performance_trace` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/performance-trace.md |
| `process_detect_hollowing` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-detect-hollowing.md |
| `process_launch_debug` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-launch-debug.md |
| `process_resume` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-resume.md |
| `process_suspend` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-suspend.md |
| `profiler_cpu` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/profiler-cpu.md |
| `proxy_add_rule` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-add-rule.md |
| `proxy_start` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-start.md |
| `proxy_stop` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-stop.md |
| `query_trace_sql` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/query-trace-sql.md |
| `raw_ip_packet_build` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/raw-ip-packet-build.md |
| `reload_extensions` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/reload-extensions.md |
| `reverse_session` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/reverse-session.md |
| `rizin_bridge` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/rizin-bridge.md |
| `route_tool` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/route-tool.md |
| `run_extension_workflow` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/run-extension-workflow.md |
| `run_macro` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/run-macro.md |
| `service_worker_deliver_push` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/service-worker-deliver-push.md |
| `service_worker_dispatch_sync` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/service-worker-dispatch-sync.md |
| `sse_monitor_enable` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sse-monitor-enable.md |
| `start_trace_recording` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/start-trace-recording.md |
| `stealth_configure_jitter` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/stealth-configure-jitter.md |
| `stealth_inject` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/stealth-inject.md |
| `stealth_set_user_agent` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/stealth-set-user-agent.md |
| `stealth_verify` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/stealth-verify.md |
| `stop_trace_recording` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/stop-trace-recording.md |
| `syscall_direct_invoke` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-direct-invoke.md |
| `syscall_ebpf_attach` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-ebpf-attach.md |
| `syscall_ebpf_trace` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-ebpf-trace.md |
| `syscall_resolve_ssn` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-resolve-ssn.md |
| `syscall_stack_capture` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-stack-capture.md |
| `syscall_start_monitor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-start-monitor.md |
| `syscall_stop_monitor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-stop-monitor.md |
| `tab_workflow` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tab-workflow.md |
| `tasks_cancel` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tasks-cancel.md |
| `tcp_close` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tcp-close.md |
| `tcp_open` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tcp-open.md |
| `tcp_write` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tcp-write.md |
| `tls_cert_pin_bypass_frida` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-cert-pin-bypass-frida.md |
| `tls_close` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-close.md |
| `tls_decrypt_payload` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-decrypt-payload.md |
| `tls_keylog_enable` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-keylog-enable.md |
| `tls_open` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-open.md |
| `trace_recording` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/trace-recording.md |
| `transform_workbench` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/transform-workbench.md |
| `understand_code` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/understand-code.md |
| `unidbg_call` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/unidbg-call.md |
| `unidbg_emulate` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/unidbg-emulate.md |
| `unidbg_launch` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/unidbg-launch.md |
| `unidbg_trace` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/unidbg-trace.md |
| `v8_deopt_trace` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-deopt-trace.md |
| `v8_heap_sampling` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-sampling.md |
| `v8_turbofan_graph` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-turbofan-graph.md |
| `v8_turbofan_inspect` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-turbofan-inspect.md |
| `v8_type_profile` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-type-profile.md |
| `wasm_instrument_binary` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-instrument-binary.md |
| `wasm_instrument_block` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-instrument-block.md |
| `wasm_instrument_trace` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-instrument-trace.md |
| `wasm_offline_run` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-offline-run.md |
| `wasm_optimize` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-optimize.md |
| `wasm_to_c` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-to-c.md |
| `watch` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/watch.md |
| `webcrack_unpack` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webcrack-unpack.md |
| `webgpu_frame_timing` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-frame-timing.md |
| `webgpu_shader_compile` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-shader-compile.md |
| `webgpu_timing_analysis` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-timing-analysis.md |
| `websocket_open` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/websocket-open.md |
| `websocket_send_frame` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/websocket-send-frame.md |
| `widget_challenge_solve` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/widget-challenge-solve.md |
| `workflow_conditional_step` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/workflow-conditional-step.md |
| `ws_monitor` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ws-monitor.md |
| `ws_send_frame` | Execute | High | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ws-send-frame.md |
| `adb_apk_analyze` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-apk-analyze.md |
| `adb_apk_pull` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-apk-pull.md |
| `adb_device_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-device-list.md |
| `adb_file_pull` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-file-pull.md |
| `adb_getprop` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-getprop.md |
| `adb_logcat_query` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-logcat-query.md |
| `adb_package_summary` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-package-summary.md |
| `adb_proc_maps` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-proc-maps.md |
| `adb_pull_native_libs` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-pull-native-libs.md |
| `adb_root_check` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-root-check.md |
| `adb_screenrecord` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-screenrecord.md |
| `adb_screenshot` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-screenshot.md |
| `adb_ui_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-ui-dump.md |
| `adb_webview_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-webview-list.md |
| `ai_suggest_exploits` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ai-suggest-exploits.md |
| `analysis_ast_match` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/analysis-ast-match.md |
| `analysis_data_flow` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/analysis-data-flow.md |
| `analysis_decode_string_array` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/analysis-decode-string-array.md |
| `analysis_security_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/analysis-security-scan.md |
| `antidebug_detect_protections` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/antidebug-detect-protections.md |
| `apk_dex_intake` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-dex-intake.md |
| `apk_manifest_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-manifest-dump.md |
| `apk_manifest_query` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-manifest-query.md |
| `apk_native_libs_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-native-libs-list.md |
| `apk_packer_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-packer-detect.md |
| `apk_packer_list_signatures` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-packer-list-signatures.md |
| `apk_signing_block_parse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-signing-block-parse.md |
| `apk_static_triage` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apk-static-triage.md |
| `apktool_decode` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/apktool-decode.md |
| `append_session_insight` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/append-session-insight.md |
| `asar_deobfuscate` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/asar-deobfuscate.md |
| `asar_extract` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/asar-extract.md |
| `asar_search` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/asar-search.md |
| `ast_transform_beautify` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ast-transform-beautify.md |
| `ast_transform_preview` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ast-transform-preview.md |
| `binary_decode` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-decode.md |
| `binary_detect_format` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-detect-format.md |
| `binary_encode` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-encode.md |
| `binary_entropy_analysis` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-entropy-analysis.md |
| `binary_entropy_profile` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-entropy-profile.md |
| `binary_instrument_capabilities` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-instrument-capabilities.md |
| `binary_key_extract` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-key-extract.md |
| `binary_strings_extract` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/binary-strings-extract.md |
| `blackbox_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/blackbox-list.md |
| `browse_extension_registry` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browse-extension-registry.md |
| `browser_cdp_performance_metrics` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-cdp-performance-metrics.md |
| `browser_get_metrics` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-get-metrics.md |
| `browser_jsdom_query` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-jsdom-query.md |
| `browser_jsdom_serialize` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-jsdom-serialize.md |
| `browser_list_cdp_targets` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-list-cdp-targets.md |
| `browser_list_tabs` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-list-tabs.md |
| `browser_list_workers` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-list-workers.md |
| `browser_passkey_seed` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-passkey-seed.md |
| `browser_resource_timing` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-resource-timing.md |
| `browser_status` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-status.md |
| `browser_worker_scripts` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-worker-scripts.md |
| `call_graph_analyze` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/call-graph-analyze.md |
| `camoufox_geolocation` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/camoufox-geolocation.md |
| `canvas_dump_shaders` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-dump-shaders.md |
| `canvas_engine_fingerprint` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-engine-fingerprint.md |
| `canvas_memory_invariants` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-memory-invariants.md |
| `canvas_pick_object_at_point` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-pick-object-at-point.md |
| `canvas_scene_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-scene-dump.md |
| `canvas_scene_search` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/canvas-scene-search.md |
| `captcha_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/captcha-detect.md |
| `captcha_solver_capabilities` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/captcha-solver-capabilities.md |
| `check_debug_port` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/check-debug-port.md |
| `collect_code` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/collect-code.md |
| `console_get_exceptions` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-get-exceptions.md |
| `console_get_logs` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-get-logs.md |
| `console_monitor` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/console-monitor.md |
| `coverage_report` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/coverage-report.md |
| `cross_domain_capabilities` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-capabilities.md |
| `cross_domain_evidence_query` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-evidence-query.md |
| `cross_domain_evidence_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-evidence-stats.md |
| `cross_domain_health` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-health.md |
| `cross_domain_suggest_workflow` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-suggest-workflow.md |
| `cross_domain_synonym` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-synonym.md |
| `crypto_compare` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/crypto-compare.md |
| `dart_call_graph` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-call-graph.md |
| `dart_inspect_object_pool` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-inspect-object-pool.md |
| `dart_list_functions` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-list-functions.md |
| `dart_load_snapshot` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-load-snapshot.md |
| `dart_object_pool_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-object-pool-dump.md |
| `dart_pc_descriptors` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-pc-descriptors.md |
| `dart_smi_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-smi-scan.md |
| `dart_snapshot_header_parse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-snapshot-header-parse.md |
| `dart_strings_extract` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-strings-extract.md |
| `dart_version_fingerprint` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-version-fingerprint.md |
| `debugger_capture_hit` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-capture-hit.md |
| `debugger_get_paused_state` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-get-paused-state.md |
| `describe_tool` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/describe-tool.md |
| `detect_crypto` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/detect-crypto.md |
| `detect_obfuscation` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/detect-obfuscation.md |
| `dex_scan_file` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dex-scan-file.md |
| `diff_heap_snapshots` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/diff-heap-snapshots.md |
| `dns_cname_chain` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dns-cname-chain.md |
| `dns_probe` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dns-probe.md |
| `dns_reverse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dns-reverse.md |
| `electron_check_fuses` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-check-fuses.md |
| `electron_debug_status` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-debug-status.md |
| `electron_inspect_app` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-inspect-app.md |
| `electron_ipc_sniff` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-ipc-sniff.md |
| `electron_scan_userdata` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-scan-userdata.md |
| `electron_verify_integrity` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-verify-integrity.md |
| `electron_verify_signature` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/electron-verify-signature.md |
| `enumerate_modules` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/enumerate-modules.md |
| `evidence_chain` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/evidence-chain.md |
| `evidence_query` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/evidence-query.md |
| `exploit_analyze_mitigations` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-analyze-mitigations.md |
| `exploit_cache_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/exploit-cache-stats.md |
| `extension_info` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/extension-info.md |
| `extension_list_installed` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/extension-list-installed.md |
| `extract_function_tree` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/extract-function-tree.md |
| `fetch_stream_export_capture` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/fetch-stream-export-capture.md |
| `fetch_stream_get_events` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/fetch-stream-get-events.md |
| `flutter_packages_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/flutter-packages-detect.md |
| `framework_state_extract` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/framework-state-extract.md |
| `frida_enumerate_functions` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-enumerate-functions.md |
| `frida_enumerate_modules` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-enumerate-modules.md |
| `frida_find_symbols` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-find-symbols.md |
| `frida_list_sessions` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-list-sessions.md |
| `frida_memory_read` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/frida-memory-read.md |
| `get_all_scripts` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-all-scripts.md |
| `get_available_plugins` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-available-plugins.md |
| `get_cache_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-cache-stats.md |
| `get_call_stack` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-call-stack.md |
| `get_collection_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-collection-stats.md |
| `get_detailed_data` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-detailed-data.md |
| `get_object_properties` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-object-properties.md |
| `get_offloaded_data` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-offloaded-data.md |
| `get_scope_variables_enhanced` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-scope-variables-enhanced.md |
| `get_script_source` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-script-source.md |
| `get_task_context` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-task-context.md |
| `get_token_budget_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/get-token-budget-stats.md |
| `ghidra_analyze` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ghidra-analyze.md |
| `graphql_enum_schema` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/graphql-enum-schema.md |
| `graphql_extract_queries` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/graphql-extract-queries.md |
| `graphql_introspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/graphql-introspect.md |
| `grpc_frame_parse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/grpc-frame-parse.md |
| `grpc_get_calls` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/grpc-get-calls.md |
| `grpc_monitor` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/grpc-monitor.md |
| `http2_frame_parse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/http2-frame-parse.md |
| `indexeddb_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/indexeddb-dump.md |
| `instrumentation_session_diff` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-session-diff.md |
| `jadx_decompile` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/jadx-decompile.md |
| `jadx_search_code` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/jadx-search-code.md |
| `js_analyze_vm` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-analyze-vm.md |
| `js_bundle_search` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-bundle-search.md |
| `js_deobfuscate_jsvmp` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-deobfuscate-jsvmp.md |
| `js_heap_search` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/js-heap-search.md |
| `list_extension_workflows` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/list-extension-workflows.md |
| `list_extensions` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/list-extensions.md |
| `list_macros` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/list-macros.md |
| `list_page_snapshots` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/list-page-snapshots.md |
| `llm_suggest_names` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/llm-suggest-names.md |
| `maintenance_detect_gpu` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/maintenance-detect-gpu.md |
| `memory_anticheat_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-anticheat-detect.md |
| `memory_antidetection_check` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-antidetection-check.md |
| `memory_aob_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-aob-scan.md |
| `memory_check_protection` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-check-protection.md |
| `memory_code_caves` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-code-caves.md |
| `memory_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-dump.md |
| `memory_dump_region` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-dump-region.md |
| `memory_emulator_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-emulator-detect.md |
| `memory_find_references` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-find-references.md |
| `memory_group_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-group-scan.md |
| `memory_guard_pages` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-guard-pages.md |
| `memory_handle_enum` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-handle-enum.md |
| `memory_heap_anomalies` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-heap-anomalies.md |
| `memory_heap_enumerate` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-heap-enumerate.md |
| `memory_heap_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-heap-stats.md |
| `memory_inline_hook_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-inline-hook-detect.md |
| `memory_integrity_check` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-integrity-check.md |
| `memory_list_regions` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-list-regions.md |
| `memory_list_types` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-list-types.md |
| `memory_mono_assemblies` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-mono-assemblies.md |
| `memory_mono_classes` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-mono-classes.md |
| `memory_mono_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-mono-detect.md |
| `memory_mono_fields` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-mono-fields.md |
| `memory_mono_methods` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-mono-methods.md |
| `memory_mono_objects` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-mono-objects.md |
| `memory_parse_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-parse-dump.md |
| `memory_pe_headers` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-pe-headers.md |
| `memory_pe_imports_exports` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-pe-imports-exports.md |
| `memory_pointer_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-pointer-scan.md |
| `memory_read` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-read.md |
| `memory_read_typed` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-read-typed.md |
| `memory_region_compare` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-region-compare.md |
| `memory_region_enumerate` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-region-enumerate.md |
| `memory_rtti_info` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-rtti-info.md |
| `memory_scan_filtered` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-scan-filtered.md |
| `memory_search_string` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-search-string.md |
| `memory_structure_analyze` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-structure-analyze.md |
| `memory_structure_compare` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-structure-compare.md |
| `memory_vtable_parse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-vtable-parse.md |
| `miniapp_pkg_analyze` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/miniapp-pkg-analyze.md |
| `miniapp_pkg_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/miniapp-pkg-scan.md |
| `mojo_decode_message` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-decode-message.md |
| `mojo_ipc_capabilities` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-ipc-capabilities.md |
| `mojo_list_interfaces` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-list-interfaces.md |
| `mojo_messages_get` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-messages-get.md |
| `mojo_messages_summarize` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/mojo-messages-summarize.md |
| `native_bridge_status` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/native-bridge-status.md |
| `native_symbol_sync` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/native-symbol-sync.md |
| `nemu_bytecode_decode` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-bytecode-decode.md |
| `nemu_bytecode_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-bytecode-scan.md |
| `nemu_capabilities` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-capabilities.md |
| `nemu_data_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-data-dump.md |
| `nemu_dlsym_diag` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-dlsym-diag.md |
| `nemu_dump_frame` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-dump-frame.md |
| `nemu_extract_apk_libs` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-extract-apk-libs.md |
| `nemu_get_jni_stub` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-get-jni-stub.md |
| `nemu_inspect_imports` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-inspect-imports.md |
| `nemu_jni_diag` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-jni-diag.md |
| `nemu_jni_handles` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-jni-handles.md |
| `nemu_list_sessions` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-list-sessions.md |
| `nemu_list_symbols` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-list-symbols.md |
| `nemu_mem_inspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-mem-inspect.md |
| `nemu_pointer_chain` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-pointer-chain.md |
| `nemu_read_byte_array` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-read-byte-array.md |
| `nemu_read_memory` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-read-memory.md |
| `nemu_scan_memory` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-scan-memory.md |
| `nemu_session_info` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-session-info.md |
| `nemu_vm_state_compare` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-vm-state-compare.md |
| `nemu_vm_state_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-vm-state-dump.md |
| `network_bot_detect_analyze` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-bot-detect-analyze.md |
| `network_extract_auth` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-extract-auth.md |
| `network_get_requests` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-get-requests.md |
| `network_get_response_body` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-get-response-body.md |
| `network_get_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-get-stats.md |
| `network_get_status` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-get-status.md |
| `network_http2_fingerprint` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-http2-fingerprint.md |
| `network_latency_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-latency-stats.md |
| `page_coverage_stop` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-coverage-stop.md |
| `page_list_frames` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-list-frames.md |
| `page_screenshot` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-screenshot.md |
| `page_storage_info` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-storage-info.md |
| `pcap_read` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/pcap-read.md |
| `pcapng_read` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/pcapng-read.md |
| `performance_get_metrics` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/performance-get-metrics.md |
| `platform_capabilities` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/platform-capabilities.md |
| `process_check_debug_port` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-check-debug-port.md |
| `process_detect_apc` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-detect-apc.md |
| `process_enum_handles` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-enum-handles.md |
| `process_enum_threads` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-enum-threads.md |
| `process_find` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-find.md |
| `process_get` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-get.md |
| `process_hollowing_scan` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-hollowing-scan.md |
| `process_kill` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-kill.md |
| `process_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-list.md |
| `process_windows` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/process-windows.md |
| `proto_auto_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-auto-detect.md |
| `proto_define_pattern` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-define-pattern.md |
| `proto_dissect_dns` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-dissect-dns.md |
| `proto_dissect_http` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-dissect-http.md |
| `proto_fingerprint` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-fingerprint.md |
| `proto_infer_fields` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-infer-fields.md |
| `proto_infer_state_machine` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-infer-state-machine.md |
| `proto_visualize_state` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-visualize-state.md |
| `protobuf_decode_raw` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/protobuf-decode-raw.md |
| `proxy_get_requests` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-get-requests.md |
| `proxy_list_rules` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-list-rules.md |
| `proxy_status` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-status.md |
| `search_in_scripts` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/search-in-scripts.md |
| `seek_to_timestamp` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/seek-to-timestamp.md |
| `session_progress_coverage` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/session-progress-coverage.md |
| `session_progress_record` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/session-progress-record.md |
| `skia_correlate_objects` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/skia-correlate-objects.md |
| `skia_detect_renderer` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/skia-detect-renderer.md |
| `skia_extract_scene` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/skia-extract-scene.md |
| `smart_cache_cleanup` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/smart-cache-cleanup.md |
| `snapshot_create` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/snapshot-create.md |
| `snapshot_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/snapshot-list.md |
| `sourcemap_coverage` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sourcemap-coverage.md |
| `sourcemap_diff` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sourcemap-diff.md |
| `sourcemap_discover` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sourcemap-discover.md |
| `sourcemap_fetch_and_parse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sourcemap-fetch-and-parse.md |
| `sourcemap_lookup` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sourcemap-lookup.md |
| `sourcemap_parse_v4` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sourcemap-parse-v4.md |
| `sse_get_events` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sse-get-events.md |
| `state_board_io` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/state-board-io.md |
| `state_board_watch` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/state-board-watch.md |
| `summarize_trace` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/summarize-trace.md |
| `syscall_capture_events` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-capture-events.md |
| `syscall_correlate_js` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-correlate-js.md |
| `syscall_filter` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-filter.md |
| `syscall_get_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-get-stats.md |
| `syscall_origin_map` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-origin-map.md |
| `syscall_pattern_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-pattern-detect.md |
| `syscall_trace_compare` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-trace-compare.md |
| `tasks_get` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tasks-get.md |
| `tasks_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tasks-list.md |
| `tasks_result` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tasks-result.md |
| `tcp_read_until` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tcp-read-until.md |
| `tls_cipher_suites` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-cipher-suites.md |
| `tls_keylog_lookup_secret` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-keylog-lookup-secret.md |
| `tls_keylog_parse` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-keylog-parse.md |
| `tls_keylog_summarize` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-keylog-summarize.md |
| `tls_parse_certificate` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-parse-certificate.md |
| `tls_parse_handshake` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-parse-handshake.md |
| `tls_probe_endpoint` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-probe-endpoint.md |
| `tls_read_until` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-read-until.md |
| `trace_get_network_flow` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/trace-get-network-flow.md |
| `trace_get_samples` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/trace-get-samples.md |
| `v8_allocation_track` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-allocation-track.md |
| `v8_bytecode_decompile` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-bytecode-decompile.md |
| `v8_bytecode_extract` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-bytecode-extract.md |
| `v8_function_retained` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-function-retained.md |
| `v8_heap_diff` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-diff.md |
| `v8_heap_find_leaks` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-find-leaks.md |
| `v8_heap_retainers` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-retainers.md |
| `v8_heap_snapshot_analyze` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-snapshot-analyze.md |
| `v8_heap_snapshot_capture` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-snapshot-capture.md |
| `v8_heap_snapshot_export` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-snapshot-export.md |
| `v8_heap_snapshot_list` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-snapshot-list.md |
| `v8_heap_stats` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-heap-stats.md |
| `v8_object_compare` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-object-compare.md |
| `v8_object_inspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-object-inspect.md |
| `v8_version_detect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-version-detect.md |
| `v8_wasm_inspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-wasm-inspect.md |
| `v8_weakrefs_inspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/v8-weakrefs-inspect.md |
| `wasm_capabilities` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-capabilities.md |
| `wasm_decompile` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-decompile.md |
| `wasm_detect_obfuscation` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-detect-obfuscation.md |
| `wasm_diff` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-diff.md |
| `wasm_disassemble` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-disassemble.md |
| `wasm_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-dump.md |
| `wasm_inspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-inspect.md |
| `wasm_inspect_sections` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-inspect-sections.md |
| `wasm_memory_inspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-memory-inspect.md |
| `wasm_string_extract` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-string-extract.md |
| `wasm_vmp_trace` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/wasm-vmp-trace.md |
| `webgpu_adapter_info` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-adapter-info.md |
| `webgpu_capture_commands` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-capture-commands.md |
| `webgpu_error_capture` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-error-capture.md |
| `webgpu_memory_layout` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-memory-layout.md |
| `webgpu_pipeline_dump` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-pipeline-dump.md |
| `webgpu_shader_disassemble` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-shader-disassemble.md |
| `webgpu_shader_source_capture` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webgpu-shader-source-capture.md |
| `webpack_enumerate` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webpack-enumerate.md |
| `webrtc_get_events` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webrtc-get-events.md |
| `webrtc_monitor` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webrtc-monitor.md |
| `websocket_read_frame` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/websocket-read-frame.md |
| `workflow_run_inspect` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/workflow-run-inspect.md |
| `workflow_suggest` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/workflow-suggest.md |
| `ws_get_connections` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ws-get-connections.md |
| `ws_get_frames` | Read | Low | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ws-get-frames.md |
| `adb_file_push` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/adb-file-push.md |
| `android_runtime_dump_session` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/android-runtime-dump-session.md |
| `asar_repack` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/asar-repack.md |
| `blackbox_add` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/blackbox-add.md |
| `blackbox_add_common` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/blackbox-add-common.md |
| `browser_font_fingerprint` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-font-fingerprint.md |
| `browser_jsdom_cookies` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/browser-jsdom-cookies.md |
| `captcha_config` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/captcha-config.md |
| `checksum_apply` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/checksum-apply.md |
| `complete_task_handoff` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/complete-task-handoff.md |
| `coordination_restore_snapshot` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/coordination-restore-snapshot.md |
| `create_task_handoff` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/create-task-handoff.md |
| `cross_domain_evidence_export` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/cross-domain-evidence-export.md |
| `dart_symbolize` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dart-symbolize.md |
| `deactivate_tools` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/deactivate-tools.md |
| `debugger_disassemble` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-disassemble.md |
| `debugger_session` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/debugger-session.md |
| `dns_bulk_resolve` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dns-bulk-resolve.md |
| `dns_resolve` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/dns-resolve.md |
| `evidence_export` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/evidence-export.md |
| `export_hook_script` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/export-hook-script.md |
| `export_trace` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/export-trace.md |
| `grpc_export_capture` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/grpc-export-capture.md |
| `instrumentation_artifact` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-artifact.md |
| `instrumentation_session_export` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-session-export.md |
| `instrumentation_session_merge` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/instrumentation-session-merge.md |
| `memory_assemble` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-assemble.md |
| `memory_audit_export` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-audit-export.md |
| `memory_bookmark` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-bookmark.md |
| `memory_freeze_export` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-freeze-export.md |
| `memory_generate_signature` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-generate-signature.md |
| `memory_patch_undo` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-patch-undo.md |
| `memory_pointer_map` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-pointer-map.md |
| `memory_register_type` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-register-type.md |
| `memory_reverse_mwt` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-reverse-mwt.md |
| `memory_structure_export_c` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-structure-export-c.md |
| `memory_type_define` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-type-define.md |
| `memory_write_history` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/memory-write-history.md |
| `nemu_dump_got` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-dump-got.md |
| `nemu_mem_shadow` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-mem-shadow.md |
| `nemu_regs_restore` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-regs-restore.md |
| `nemu_regs_save` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-regs-save.md |
| `nemu_set_pac_key` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-set-pac-key.md |
| `nemu_setup_java_field` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-setup-java-field.md |
| `nemu_setup_java_mock` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-setup-java-mock.md |
| `nemu_setup_java_mocks` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/nemu-setup-java-mocks.md |
| `network_export_har` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/network-export-har.md |
| `page_script_register` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-script-register.md |
| `page_upload_files` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/page-upload-files.md |
| `pcap_write` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/pcap-write.md |
| `pcapng_write` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/pcapng-write.md |
| `proto_export_schema` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proto-export-schema.md |
| `proxy_export_ca` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-export-ca.md |
| `proxy_setup_adb_device` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/proxy-setup-adb-device.md |
| `restore_page_snapshot` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/restore-page-snapshot.md |
| `save_page_snapshot` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/save-page-snapshot.md |
| `script_replace_persist` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/script-replace-persist.md |
| `sourcemap_reconstruct_tree` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sourcemap-reconstruct-tree.md |
| `sse_export_capture` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/sse-export-capture.md |
| `state_board` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/state-board.md |
| `stealth_generate_fingerprint` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/stealth-generate-fingerprint.md |
| `syscall_trace_export` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/syscall-trace-export.md |
| `tls_cert_pin_bypass` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-cert-pin-bypass.md |
| `tls_keylog_disable` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-keylog-disable.md |
| `tls_write` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/tls-write.md |
| `update_task_handoff` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/update-task-handoff.md |
| `webrtc_export_capture` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/webrtc-export-capture.md |
| `websocket_close` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/websocket-close.md |
| `workflow_retry_policy` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/workflow-retry-policy.md |
| `ws_export_capture` | Write | Medium | https://policylayer.com/tools/io-github-vmoranv-jshookmcp/ws-export-capture.md |

## Tool descriptions

- `adb_uninstall` — Uninstall a package from a device, optionally keeping app data.
- `cleanup_artifacts` — Clean generated artifacts by age and size.
- `clear_all_caches` — Clear all internal caches. Destructive — prefer smart_cache_cleanup.
- `clear_collected_data` — Clear collected script data, caches, and in-memory indexes.
- `dart_destroy_session` — Destroy a Dart snapshot session created by dart_create_session, releasing the cached parsed snapshot. Returns destroyed=true if the session existed, false if it was unknown or already swept by the idle TTL.
- `exploit_cache_clear` — Clear all cached exploit-dev results. Use when binaries have been modified or to free memory.
- `exploit_cache_invalidate` — Invalidate cached exploit-dev results for a specific binary (by path). Computes the binary hash and removes all matching cache entries. Call without binaryPath to clear the entire cache. Use when binaries have been recompiled or modified.
- `extension_uninstall` — Uninstall an extension from the local registry.
- `ghidra_decompile` — Decompile a function using Ghidra.
- `ida_decompile` — Decompile a function using IDA Pro.
- `jadx_decompile_apk` — High-level JADX APK decompile: decompile the whole APK to a stable output directory and return sourcesDir for jadx_search_code.
- `manual_token_cleanup` — Clear stale entries and reset counters to free 10-30% of token budget.
- `memory_antidetection` — Anti-detection hardening toolkit. Actions: check (run all detectors — kernel callbacks, instrumentation callback, AMSI/ETW status, chaos mode, platform info), harden (apply AMSI/ETW patches + process masquerade + self-defense — destructi…
- `memory_batch_edit` — Write a value to ALL addresses in a scan session at once. Thin wrapper that iterates through the session address list and calls writeValue for each. Capped at 1000 addresses per call with a clear error when exceeded. Destructive — an aud…
- `memory_scan_session` — Manage scan sessions. Actions: list (all sessions), delete (by sessionId), export (as JSON).
- `memory_unregister_type` — Remove a registered custom scan type by name.
- `nemu_destroy_session` — Destroy an emulator session and free its memory (mapped library, stack, JNI tables).
- `page_cookies` — Manage page cookies; clear requires matching expectedCount.
- `page_local_storage` — Read, write, delete, or clear localStorage entries for the current origin.
- `page_session_storage` — Read, write, delete, or clear sessionStorage entries for the current origin.
- `proxy_clear_logs` — Clear all captured proxy request/response logs.
- `proxy_clear_rules` — Clear active proxy interception rules while keeping the proxy running.
- `proxy_remove_rule` — Remove a single proxy interception rule by endpointId. Returns the removed rule record.
- `reset_token_budget` — Hard-reset all token budget counters. Destructive — prefer manual_token_cleanup.
- `session_progress_clear` — Clear session progress entries. With no
- `snapshot_restore` — Restore a directory to a recorded shadow-git snapshot. DESTRUCTIVE: files modified after the snapshot are overwritten, files created after it are DELETED, and files deleted after it are written back (full revert semantics). The isolated …
- `tls_keylog_seal` — Encrypt the current keylog file in place with a fresh ephemeral key and securely wipe the plaintext source. Mitigates disk-forensics exposure (pagefile/hibernation/TEMP scraping) of captured TLS secrets. The returned keyHex is not persis…
- `v8_heap_snapshot_delete` — Delete persisted V8 heap snapshot artifact files (.heapsnapshot data + .meta.json sidecar) and drop the matching in-memory cache entry. Use deleteAll=true to remove every persisted snapshot. Does not affect the live V8 heap.
- `webhook` — Manage webhook endpoints for external callbacks. Actions: create, list, delete, commands.
- `activate_tools` — Dynamically register specific tools by name, regardless of current base tier.
- `adb_app_cold_start_trace` — High-level Android startup trace: force-stop, clear logcat, start activity with -W, wait, collect PID-filtered logs, and parse launch/Looper timing.
- `adb_dumpsys` — Run adb shell dumpsys for a service and return parsed structured output. Supports key-value extraction, array parsing, and section detection. Common services: package, activity, window, battery, meminfo, alarm, cpuinfo, diskstats, netsta…
- `adb_input_keyevent` — Send an Android keyevent name or numeric key code through adb shell input.
- `adb_input_swipe` — Send a touchscreen swipe event through adb shell input.
- `adb_input_tap` — Send a touchscreen tap event through adb shell input.
- `adb_input_text` — Send text through adb shell input text with Android-safe whitespace encoding.
- `adb_install` — Install one APK or a split-APK set onto a device with parsed success output.
- `adb_port_forward` — Manage ADB forward/reverse port mappings for device-host bridge workflows.
- `adb_shell` — Execute an ADB shell command on a specific device.
- `adb_webview_attach` — Attach to a WebView via ADB; returns WebSocket debugger URL for CDP.
- `ai_hook` — Manage AI hooks. Actions: inject (inject code into page), get_data (retrieve captured hook data), list (all active hooks), clear (remove hook data by id or all), toggle (enable/disable a hook), export (export data as JSON/CSV).
- `analysis_deflat_control_flow` — Flatten switch-dispatch control flow back to straight-line code.
- `antidebug_bypass` — Bypass one or more anti-debug protection types. Specify types to apply; omit or use [
- `api_probe_batch` — Batch-probe API endpoints in browser context with auto token injection and HTML skip.
- `apk_sign` — Sign an APK with apksigner using a caller-supplied keystore. Pairs with apktool_build for a full repack-and-sign workflow.
- `apktool_build` — Rebuild an APK from a decoded apktool source directory (closes the patch-and-repack loop with apk_sign).
- `arp_build` — Build a deterministic ARP payload for Ethernet/IPv4.
- `ast_transform_apply` — Apply transforms to input code or a live page scriptId.
- `ast_transform_chain` — Create and store an in-memory transform chain.
- `binary_ninja_bridge` — Send a command to a local Binary Ninja analysis bridge.
- `breakpoint` — Manage breakpoints: code (line/script), function-name, XHR (URL pattern), event listener, event category, and exception breakpoints.\n\nActions:\n- set: Create a breakpoint. Type determines required params.\n- remove: Remove a breakpoint…
- `browser_attach` — Connect to a running browser.
- `browser_attach_cdp_target` — Attach to a CDP target by targetId.
- `browser_close` — Close the browser and release all resources.
- `browser_codegen_start` — Start recording browser actions as replayable steps.
- `browser_codegen_stop` — Stop recording browser actions and return cleaned replay steps.
- `browser_cpu_profile_start` — Atomic primitive: begin CDP CPU profiling on the active page (Profiler.start). Pair with browser_cpu_profile_stop to save the .cpuprofile. Set samplingInterval to 30-100 µs for high-resolution profiles (default 1000 µs / 1 ms).
- `browser_cpu_profile_stop` — Atomic primitive: stop CDP CPU profiling, rank hot functions by sample count, and persist the raw profile to artifacts/profiles/ (or a custom path). The hot function list is derived from the samples array — modern Chrome profiles do not …
- `browser_detach_cdp_target` — Detach the current CDP target session.
- `browser_evaluate_cdp_target` — Evaluate JS in the attached CDP target.
- `browser_jsdom_execute` — Evaluate JS inside a JSDOM session. Requires explicit authorization — arbitrary code execution.
- `browser_jsdom_parse` — Parse HTML into an in-memory JSDOM session. No browser needed.
- `browser_launch` — Launch Chromium/Camoufox or connect to a running browser.
- `browser_performance_observer` — Atomic primitive: subscribe to PerformanceObserver entry types in the active page and return both buffered and live entries observed during a collection window. Entry types are passed through to PerformanceObserver.observe({ type }) verb…
- `browser_select_tab` — Switch active tab by index, URL pattern, or title pattern.
- `browser_trace_start` — Atomic primitive: begin a Chrome performance trace on the active page via page.tracing.start(). Pair with browser_trace_stop to save the trace to disk. Use a sensible categories list when you have a specific hypothesis (e.g. [
- `browser_trace_stop` — Atomic primitive: stop the Chrome performance trace started by browser_trace_start and persist it to artifacts/traces/ (or to a custom path). Returns event count, file size, and a Chrome DevTools hint. Fails clearly if tracing was never …
- `call_tool` — Execute an already-active tool by name.
- `camoufox_server` — Start, close, or check status of a Camoufox anti-detect server.
- `canvas_inject_draw_hook` — Intercept Canvas 2D (drawImage/fillText/strokeText) and WebGL (drawArrays/drawElements) draw calls into a ring buffer on the page. Actions: install (wrap prototypes), read (dump captured calls), uninstall (restore). Set timing=true at in…
- `canvas_trace_click_handler` — Trace a click event from DOM to JS call stack.
- `captcha_vision_solve` — Solve a CAPTCHA with manual flow or a configured external service.
- `captcha_wait` — Block until the user manually solves the CAPTCHA.
- `console_buffers` — Manage injected interceptor state.
- `console_execute` — Evaluate a JS expression in the browser console context.
- `console_inject` — Inject an in-page script, XHR, fetch, or function monitor.
- `console_inject_fetch_interceptor` — Inject a fetch interceptor.
- `console_inject_xhr_interceptor` — Inject an XMLHttpRequest interceptor.
- `cross_domain_correlate_all` — Run the built-in skia, mojo, syscall, and binary correlators and merge the results into the shared evidence graph.
- `crypto_extract_standalone` — Extract crypto/sign/encrypt function from current page and generate standalone runnable code.
- `crypto_test_harness` — Run extracted crypto code in worker_threads + vm sandbox and return deterministic test results.
- `dart_call_function` — Execute a Dart function in the ARM64 emulator by address or name, with simplified runtime (mock built-ins, tagged pointers). Pass a sessionId to reuse the cached snapshot; the executor still initialises fresh CPU state per call (register…
- `dart_create_session` — Parse a Dart AOT snapshot once and cache it under a sessionId, so subsequent dart_load_snapshot / dart_list_functions / dart_call_graph / dart_inspect_object_pool / dart_call_function / dart_trace_execution calls can pass sessionId and s…
- `dart_trace_execution` — Trace Dart function execution step-by-step, emitting each instruction with register state (PC, x0-x30, PP, THR). Pass a sessionId to reuse the cached snapshot.
- `debugger_evaluate` — Evaluate a JavaScript expression. context=
- `debugger_lifecycle` — Enable or disable the CDP debugger session.
- `debugger_pause` — Pause execution at the next statement.
- `debugger_resume` — Resume execution.
- `debugger_run_to_location` — Run execution until a source location by setting a temporary code breakpoint, resuming, waiting for pause, and removing the breakpoint.
- `debugger_step` — Step execution: into (enter next call), over (skip next call), out (exit current function).
- `debugger_wait_for_paused` — Wait for debugger pause after setting breakpoints.
- `deobfuscate` — Run webcrack-powered JavaScript deobfuscation with bundle unpacking.
- `doctor_environment` — Run environment doctor: dependencies, bridges, platform limits.
- `electron_attach` — Attach to an Electron CDP port and optionally evaluate in a matching page.
- `electron_launch_debug` — Launch Electron with main and renderer CDP ports.
- `electron_patch_fuses` — Patch Electron fuse states.
- `ethernet_frame_build` — Build a deterministic Ethernet II frame from source/destination MAC addresses, EtherType, and payload bytes.
- `execute_sandbox_script` — Execute JavaScript in an isolated sandbox.
- `exploit_build_format_string` — Generate format string exploit payload for arbitrary write. Uses %hn (2-byte) writes for reliability. Returns hex payload and reliability assessment.
- `exploit_build_heap_spray` — Generate heap spray payload for predictable heap layout. Supports V8 (ArrayBuffer), IE (BSTR), and generic (ArrayBuffer) spray targets. Returns spray code, allocation count, and predictability score.
- `exploit_build_jop_chain` — Build a JOP (Jump-Oriented Programming) chain from binary gadgets.
- `exploit_build_ret2dlresolve` — Build a ret2dlresolve payload that forges ELF dynamic-linker structures to resolve
- `exploit_build_rop_chain` — Construct a ROP chain for a specified goal (execve, write_memory, call_function). Automatically searches for required gadgets and chains them. Returns hex chain and gadget list. User must provide command/address/function as needed.
- `exploit_build_stack_pivot` — Find and assemble stack pivot gadgets from a binary. Stack pivots redirect the stack pointer (ESP/RSP) to a controlled buffer, enabling ROP chains when limited stack space is available. Detects xchg(add/sub/mov,sp), push/pop(sp), leave, …
- `exploit_cache_configure` — Update exploit-dev cache configuration (TTLs, memory limits, enable/disable). Changes take effect immediately.
- `exploit_calculate_offsets` — Calculate buffer overflow offset from crash value and De Bruijn pattern. Used to determine exact EIP/RIP overwrite offset.
- `exploit_discover_one_gadget` — Discover one-gadget (single-address shell-spawning) offsets for common libc versions.
- `exploit_encode_shellcode` — Encode shellcode to avoid bad characters or detection. Supports alphanumeric, unicode, XOR, and fnstenv encodings. Returns encoded shellcode and decoder stub. User must provide raw shellcode.
- `exploit_find_gadgets` — Search for ROP/JOP/COP/COOP gadgets in a binary file. Returns addresses, instructions, and bytes for each gadget. Supports filtering by regex pattern and gadget type. User must provide target binary.
- `exploit_find_jmp_esp` — Find
- `exploit_generate_egghunter` — Generate egghunter shellcode for constrained buffer sizes. An egghunter searches process memory for a 4-byte
- `exploit_generate_pattern` — Generate De Bruijn sequence for offset finding. Every 4-byte substring is unique, allowing precise offset calculation from crash dumps.
- `exploit_generate_pwntools` — Generate a pwntools-compatible Python exploit script (exploit.py).
- `exploit_solve_constraints` — Solve a system of constraints using the Z3 SMT solver.
- `exploit_verify_rop_chain` — Verify a user-supplied ROP chain against an exploit goal using Z3.
- `extension_execute_in_context` — Load an extension and execute a named exported context function.
- `extension_install` — Install/register an extension from a manifest, local package directory, local module file, or remote module URL.
- `extension_reload` — Reload an installed extension by unloading and loading it again.
- `fetch_stream_monitor` — Enable or disable capture of fetch()-based streams. Wraps window.fetch and, for responses with content-type text/event-stream, clones the body and parses the SSE frame stream into events. Covers the LLM / GraphQL-subscription streaming t…
- `frida_attach` — Attach Frida to a local target and open a session.
- `frida_attach_interceptor` — Generate a real Frida Interceptor.attach block for a symbol and optionally install it in a session.
- `frida_detach` — Detach from a Frida session and clean up resources.
- `frida_dex_dump` — Run frida-dexdump as a high-level Android DEX dump helper by package/process name or PID.
- `frida_generate_script` — Generate a Frida interceptor or hook script from built-in templates.
- `frida_memory_scan` — Scan process memory for a byte pattern via Frida Memory.scanSync. Searches a named module, an explicit address range, or all readable ranges by default. Pass async:true to scan in a background task (MCP 2.0 Tasks) and poll with tasks_get…
- `frida_resume` — Resume a target previously spawned for early Frida instrumentation.
- `frida_run_script` — Execute a Frida JavaScript snippet inside an attached Frida session. Pass async:true to run in a background task (MCP 2.0 Tasks) and poll with tasks_get/tasks_result — useful for long-running or persistent instrumentation scripts that wo…
- `frida_spawn` — Spawn a target through Frida for early instrumentation before normal execution.
- `generate_hooks` — Generate a Frida interceptor script for a list of symbols.
- `ghidra_bridge` — Send a command to a Ghidra headless analysis bridge.
- `graphql_replay` — Replay a GraphQL operation with optional variables, batch array, or Apollo persisted-query (APQ) extensions.
- `graphql_subscribe` — Open a GraphQL subscription WebSocket, perform the graphql-transport-ws (or legacy graphql-ws) handshake, send a subscribe frame, and collect frames for collectMs. Runs in-page so the browser-session auth (cookies + connectionPayload) is…
- `grpc_frame_build` — Encode one or more messages into a gRPC / gRPC-Web length-prefixed body. Inverse of grpc_frame_parse — for constructing test or replay bodies. Each message takes payloadHex plus optional compressed / isTrailer flags.
- `hook_preset` — Install a pre-built JavaScript hook from 20+ built-in presets (eval, atob/btoa, Proxy, Reflect, Object.defineProperty, etc.), or provide customTemplate/customTemplates to install your own reusable hook bodies. Use listPresets=true to see…
- `http_plain_request` — Send a raw HTTP request over plain TCP.
- `http_request_build` — Build a raw HTTP/1.x request payload.
- `http2_frame_build` — Build a raw HTTP/2 frame.
- `http2_probe` — Probe an HTTP/2 endpoint.
- `human_mouse` — Move mouse along a Bezier curve with jitter.
- `human_scroll` — Scroll with randomized speed and pauses to mimic human behavior.
- `human_typing` — Type text with human-like speed and occasional typos.
- `icmp_echo_build` — Build a deterministic ICMPv4 echo request or reply payload with an automatically computed checksum.
- `ida_bridge` — Send a command to an IDA Pro plugin bridge.
- `inject_dll` — Inject a DLL into a target process. Requires elevated privileges. Target process and payload are validated before injection.
- `inject_shellcode` — Allocate and execute raw shellcode in a target process. Requires elevated privileges. Target process and payload are validated before injection.
- `install_extension` — Install an extension from the remote registry.
- `instrumentation_hook_preset` — Apply hook presets inside an instrumentation session.
- `instrumentation_network_replay` — Replay a captured network request inside an instrumentation session.
- `instrumentation_operation` — Manage operations inside an instrumentation session.
- `instrumentation_session` — Start, stop, or query status of an instrumentation recording session. Destroying a session archives it read-only (the last 8 destroyed sessions are retained, oldest evicted) so export/diff/merge/status can still inspect it.
- `js_deobfuscate_pipeline` — Three-stage deobfuscation pipeline: preprocess → deobfuscate → humanize.
- `js_solve_constraints` — Solve opaque predicates and constant expressions in obfuscated code.
- `js_symbolic_execute` — Symbolic execution of JavaScript: explore all feasible execution paths, collect path constraints, and solve them. Best for control-flow-flattened code with complex branching.
- `js_symbolic_execute_jsvmp` — Symbolic execution of JSVMP bytecode: step through instructions symbolically to infer original logic, constraints, and confidence score. Use after js_analyze_vm to get instructions.
- `manage_hooks` — Create, inspect, and clear JavaScript runtime hooks.
- `memory_allocate` — Allocate executable memory in target process (VirtualAllocEx wrapper). Win32 only. Requires JSHOOK_INJECTION_ENABLE=1.
- `memory_auto_assemble` — Execute a Cheat Engine-style Auto Assembler script. Parses [ENABLE]/[DISABLE] sections and executes ENABLE commands. Supported commands: ALLOC(name,size), DEALLOC(name), LABEL(name[,addr]), REGISTERSYMBOL(name), AOBSCAN(name,pattern), AS…
- `memory_auto_assemble_disable` — Execute the DISABLE section of a previously-run Auto Assembler script. Pass the disableScript returned by memory_auto_assemble. Executes DISABLE commands, running DEALLOC last (CE convention). Win32 only — requires native process access.
- `memory_batch_write` — Write multiple memory patches at once. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_breakpoint` — Breakpoint via hardware debug registers (DR0-DR3) or software INT3 (0xCC). Actions: set, remove, list, trace. Hardware BPs (type=\
- `memory_call_stack` — Walk the call stack of a target process thread using the x64 RBP frame-pointer chain. Suspends the thread, reads the CONTEXT to get RBP/RSP/RIP, then follows the linked list of saved_RBP / return_address frames via ReadProcessMemory. Res…
- `memory_cheat_table` — Import, export, sign, or verify Cheat Engine .CT files. Export: converts JSON entries to valid .CT XML. Import: parses .CT XML to JSON. Sign: HMAC-SHA256 sign the XML using a secret (from JSHOOK_TABLE_SECRET env var, state_board
- `memory_find_accesses` — Find what writes to or accesses a memory address (Cheat Engine MWT workflow). Sets a hardware breakpoint on the target address, auto-rearms after each hit, captures the faulting instruction address + context + timestamp, and optionally d…
- `memory_first_scan` — Start a new memory scan session.
- `memory_free` — Free remote memory in target process (VirtualFreeEx wrapper). Win32 only. Requires JSHOOK_INJECTION_ENABLE=1.
- `memory_freeze` — Freeze or unfreeze a memory address. Freeze continuously writes a value to prevent changes; unfreeze stops it.
- `memory_hypervisor` — EPT Hypervisor Phase 1: VMXON, VMCS setup, basic VM-exit handler design, CPUID spoofing. Intel VT-x only. Requires BYOVD kernel driver for MSR reads and VMXON region preparation. Gate: JSHOOK_HYPERVISOR_ENABLE=1 + admin. Actions: capabil…
- `memory_inject_dll` — Inject a DLL into target process. Win32 only. Modes: loadlibrary (LoadLibraryW injection) or manualmap (manual mapping). Requires JSHOOK_INJECTION_ENABLE=1.
- `memory_inject_shellcode` — Inject shellcode into target process. Win32 only. Methods: createremote (CreateRemoteThread) or ntcreatethread (NtCreateThreadEx). Requires JSHOOK_INJECTION_ENABLE=1.
- `memory_next_scan` — Narrow an existing scan session. Supports delta modes: changed_by (value changed by exactly N), increased_by (value increased by at least N), decreased_by (value decreased by at least N), changed_by_variable (returns per-address delta in…
- `memory_patch_bytes` — Write bytes to target process at address. Saves original bytes for undo. Use for runtime code patching.
- `memory_patch_nop` — NOP out instructions at address (replace with 0x90). Useful for disabling checks or jumps.
- `memory_pointer_chain` — Pointer chain operations: scan (multi-level BFS), autoscan (auto-discover pointer chains by recursively scanning for pointers that point to or near the target address), validate, resolve, or export as JSON. autoscan is Cheat Engine\
- `memory_process_control` — Suspend or resume a target process for consistent memory snapshots. Suspend freezes all threads (NtSuspendProcess on Win32, SIGSTOP on Linux, task_suspend on macOS) so memory reads/scans see a consistent state. Resume thaws all threads. …
- `memory_protect` — Change memory page protection for a region in the target process. Wraps VirtualProtectEx (Win32) / mprotect (Linux) / mach_vm_protect (macOS). Protection: r (read-only), rw (read-write), rx (read-execute), rwx (all), none (no-access). Re…
- `memory_remote` — Connect to a remote jshookmcp MCP server via WebSocket for remote debugging. Enables ceserver-style remote memory operations: connect to a remote instance, forward tool calls (memory read/write, process enumerate, etc.), and receive resu…
- `memory_scan` — Scan process memory for a pattern or value. Requires elevated privileges. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_speedhack` — Hook time APIs (GetTickCount64/GetTickCount/QueryPerformanceCounter/QueryPerformanceFrequency/timeGetTime/GetSystemTimeAsFileTime) to scale process time via an in-process SSE2 trampoline. time via an in-process SSE2 trampoline. Actions: …
- `memory_trace_code` — Ultimap-style instruction-level code tracing. Sets INT3 (0xCC) software breakpoints at function entry points and logs every execution. Aggregates hit counts per address to produce a hot-code-path heat map. Win32-only — requires the Win32…
- `memory_unknown_scan` — Start an unknown initial value scan.
- `memory_watch` — Poll a memory address until its value changes (like scanmem\
- `memory_write` — Write data to process memory at a given address. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_write_value` — Write a typed value to a memory address. Supports undo/redo via memory_write_history(action=undo|redo).
- `miniapp_pkg_unpack` — Unpack a miniapp package.
- `mojo_encode_message` — Encode a structured Mojo IPC message into a hex payload.
- `mojo_monitor` — Start or stop Mojo IPC monitoring for the active Chromium-based target.
- `mojo_verify_live` — Generate a Frida verification script that probes a target Chromium process for known Mojo C-API exports (MojoWriteMessage, MojoWriteMessageNew) across modules. Uses a curated symbol database covering Chromium M96+ across Win32, Linux, an…
- `nemu_alloc_memory` — Allocate raw guest memory (NOT a JNI handle — a real char* address). Optionally fill with initial data via fillBytes (base64). Returns the guest address to pass as an integer arg to call_symbol. Use at the start of a session to stage enc…
- `nemu_bind_all_imports` — Batch-bind host functions to ALL resolved import stubs in the GOT. Reads the GOT table (0x74000 range), finds every unique resolved address, and binds the given JS function body to each. Call after load_library to mock every unresolved s…
- `nemu_bind_host_fn` — Register a JavaScript host function at a specific guest address, overriding any existing stub. The function receives guest registers (ctx.x(0)..x(7)), can read/write guest memory (ctx.read/ctx.write), and returns a BigInt value placed in…
- `nemu_call_address` — Call a function at an arbitrary guest address (e.g. a native method registered via RegisterNatives). Uses AArch64 AAPCS with args in x0..x7; returns x0. Set injectJni=true to prepend guest JNIEnv* as x0 + thiz=0 as x1 (standard JNI metho…
- `nemu_call_jni_export` — Invoke an exported
- `nemu_call_symbol` — Invoke an exported function by name following AArch64 AAPCS (integer args in x0..x7, result in x0). Auto-detects JNI signatures. Set injectJni=false to force raw arguments. Set debug=true for auto-NOP on NULL indirect calls + auto TLS prep.
- `nemu_create_jni_handle` — Create a mock JNI object handle pre-populated with controlled data. Use BEFORE calling JNI functions to seed the handle table so that GetStringUTFChars / GetObjectArrayElement / GetIntField return expected values. Returns the handle id t…
- `nemu_create_session` — Create an isolated ARM64 emulator session and return its sessionId. Each session owns its own CPU registers, guest stack, and JNI object table, so concurrent analyses never interfere. Destroy it with nemu_destroy_session when done; idle …
- `nemu_gdbserver` — GDB Remote Serial Protocol (RSP) TCP server. Starts a real TCP server on host:port that GDB clients can connect to. Provides full register read/write, memory read/write, step, continue, software breakpoints (Z0/z0), vCont extended step/c…
- `nemu_load_apk_library` — Extract a specific arm64-v8a .so from an APK by name and load it into a session in one step (no temp files). Pair with nemu_extract_apk_libs to discover library names.
- `nemu_load_library` — Load an AArch64 ELF shared object (.so) from a filesystem path into a session, mapping its segments and resolving exported symbols. Prerequisite for list_symbols / call_symbol / call_jni_export.
- `nemu_load_library_chain` — Load a chain of dependent libraries into a session, resolving inter-library imports. Pass dependency .so paths as dependencyPaths (loaded first in order), then the primary .so path. Each dependency exports are visible to the primary and …
- `nemu_mem_map` — Map a memory region in guest address space. Use to extend the mapped area for output buffers or scratch data that would otherwise cause unmapped-memory faults. Idempotent — safe to call on already-mapped regions.
- `nemu_new_byte_array` — Wrap base64 bytes as a JNI jbyteArray handle to pass as an argument into call_jni_export (e.g. the plaintext a signing routine consumes). Returns the handle.
- `nemu_patch_apply` — Apply multiple memory patches in a single call. Each patch is {address, dataBase64, writeProtect?}. Faster than repeated nemu_write_memory calls — essential for atomic code patches that must be applied together to avoid intermediate corr…
- `nemu_prepare_tls` — Map the TPIDR_EL0 (thread-pointer) TLS block so its memory is accessible for pre-population via nemu_write_regions. Returns the TLS base address. Use this before writing data to TLS offsets (e.g. frame-table pointer at +0x1768) that nati…
- `nemu_relay` — Connect to a remote native-emulator session via IPC relay. Proxies nemu operations through a named pipe (Windows) or Unix domain socket (Linux/macOS) with JSON-RPC over length-prefixed frames. Use to drive ARM64 nemu sessions on a Linux …
- `nemu_session_load` — Load a JSON-serialised array of tool calls and execute them sequentially to set up a session. Each entry is {tool, args}. Supported tools: alloc_memory, write_regions, call_address, call_symbol, prepare_tls, setup_java_mocks, map_memory,…
- `nemu_set_registers` — Set arbitrary CPU registers by index. Pass an object mapping register number to value (e.g. {0: 0x60000000, 10: 0, 11: 0x55150}). Supports x0-x30 and floating-point d0-d31. Use to fix up loop variables or inject context pointers before/a…
- `nemu_set_vtable_slot` — Override a specific vtable slot with a custom host function. The slot at vtableAddr + slotIndex*8 is rewritten to point to a stub executing
- `nemu_trace` — Invoke an exported symbol while recording every instruction executed (pc, opcode, step), optionally snapshotting named registers per step. Bounded by maxSteps. Use to follow the control flow / algorithm of an obfuscated native function.
- `nemu_vm_state_load` — Load VM state into guest memory. Takes ctx values and table values as hex strings and writes them at the specified base addresses. Use to bridge Python LiteVM state into native VM: run Python vm.run(), dump ctx/table as hex, then load in…
- `nemu_write_memory` — Write raw bytes into guest memory at a given address via base64 data. Use to update an input buffer between call_symbol invocations without re-allocating, or to patch code/data in place.
- `nemu_write_regions` — Write multiple memory regions in a single call. Accepts an array of {address, dataBase64} objects. Essential for atomic code patching: apply all patches in one call to avoid intermediate corrupt states.
- `nemu_xor_region` — XOR a region of emulated memory with a single-byte key. Returns the XOR result as base64. Use for quick decryption testing — XOR a buffer with a candidate key byte and inspect the preview without modifying guest state. Set dryRun=false t…
- `net_raw_tcp_listen` — Listen on a local TCP port for one incoming connection.
- `net_raw_tcp_send` — Send raw TCP data to a remote host; accepts hex or text input.
- `net_raw_udp_listen` — Listen on a local UDP port for an incoming datagram.
- `net_raw_udp_send` — Send a raw UDP datagram and wait for a response.
- `network_disable` — Disable network request monitoring
- `network_enable` — Enable network request monitoring.
- `network_icmp_probe` — Run an ICMP echo probe.
- `network_intercept` — Manage network interception rules.
- `network_monitor` — Manage network request monitoring.
- `network_replay_request` — Replay a captured network request with optional changes.
- `network_rtt_measure` — Measure round-trip time to a target URL.
- `network_tls_fingerprint` — Compute TLS/HTTP fingerprints for bot detection. compute_tls/compute_http build fingerprints from user-supplied lists; parse_client_hello parses a raw ClientHello record (hex) and emits JA3 + JA4 from the real wire bytes; analyze_request…
- `network_traceroute` — Run an ICMP traceroute.
- `page_back` — Navigate back in browser history.
- `page_block_script` — Manage script blocking rules by URL pattern. Blocked scripts are prevented from loading/executing. Actions: add/block (add a rule), remove/unblock (remove a rule), list (show all rules), clear (remove all).
- `page_click` — Click a page element by CSS selector.
- `page_coverage_start` — Start JS+CSS code coverage collection on the active page. Coverage tracks which bytes of each loaded script/stylesheet are actually executed. Use page_coverage_stop to stop collection and retrieve results.
- `page_emulate_device` — Emulate a mobile device profile.
- `page_evaluate` — Execute JavaScript in page context.
- `page_forward` — Navigate forward in browser history.
- `page_handle_dialog` — Control how JavaScript dialogs (alert/confirm/prompt/beforeunload) are answered. By default installs a persistent handler that auto-dismisses all dialogs. Set dismissAll=false for one-shot handling of the next dialog.
- `page_hover` — Hover over an element by CSS selector.
- `page_inject_script` — Inject JavaScript to run on every page load.
- `page_navigate` — Navigate the page to a URL with wait and network options.
- `page_press_key` — Simulate a key press by name.
- `page_reload` — Reload the current page.
- `page_script_run` — Execute a named script from the Script Library with optional runtime params (__params__).
- `page_scroll` — Scroll to absolute or relative coordinates.
- `page_select` — Select option(s) in a <select> element.
- `page_set_viewport` — Set the browser viewport dimensions.
- `page_type` — Type text into an element.
- `page_wait_for_selector` — Wait for an element to appear.
- `payload_mutate` — Apply deterministic byte-level mutations to a hex payload.
- `payload_template_build` — Build a deterministic payload from field definitions.
- `performance_trace` — Start or stop a Chrome performance trace.
- `process_detect_hollowing` — Detect process hollowing (malware technique that unmaps original process image and injects malicious code). Compares process memory sections (.text, .data, .rdata) with on-disk PE file using SHA-256 hashes. Returns detection result with …
- `process_launch_debug` — Launch an executable with remote debugging port enabled.
- `process_resume` — Resume a previously suspended process. Cross-platform: NtResumeProcess (Win32), SIGCONT (Linux), task_resume (macOS).
- `process_suspend` — Suspend a process for forensic snapshotting. Cross-platform: NtSuspendProcess (Win32), SIGSTOP (Linux), task_suspend (macOS). Pair with process_resume to restore. Use before memory_scan/dump for a consistent snapshot. Requires admin/root…
- `profiler_cpu` — Start or stop CPU profiling.
- `proxy_add_rule` — Add an interception rule: forward, mock_response, redirect, or block.
- `proxy_start` — Start the local HTTP/HTTPS interception proxy with optional TLS.
- `proxy_stop` — Stop the proxy and release all active rules.
- `query_trace_sql` — Execute a read-only SQL query against a trace database.
- `raw_ip_packet_build` — Build a deterministic IPv4 or IPv6 packet.
- `reload_extensions` — Reload plugins and workflows from configured directories, and directly register extension tools visible in the current profile.
- `reverse_session` — Create, inspect, list, preview, or run an end-to-end reverse-engineering workflow session with artifact root, cross-domain tool calls, and evidence refs.
- `rizin_bridge` — Send a command to a local Rizin/r2 analysis bridge.
- `route_tool` — One-stop tool router: accepts a natural language task description, returns recommended tools and next
- `run_extension_workflow` — Execute an extension workflow by workflowId with optional config and timeout overrides.
- `run_macro` — Execute a registered macro with sequence, parallel, branch, fallback, and retry orchestration.
- `service_worker_deliver_push` — Deliver a synthetic push message to a service worker via CDP ServiceWorker.deliverPushMessage. Requires an attached CDP session on a SW target.
- `service_worker_dispatch_sync` — Dispatch a Background Sync event to a service worker via CDP ServiceWorker.dispatchSyncEvent. Requires an attached CDP session on a SW target.
- `sse_monitor_enable` — Enable SSE monitoring by injecting EventSource interceptor.
- `start_trace_recording` — Start recording debugger traces into a SQLite database for time-travel.
- `stealth_configure_jitter` — Configure CDP timing jitter.
- `stealth_inject` — Inject anti-detection scripts to reduce bot fingerprint exposure.
- `stealth_set_user_agent` — Set User-Agent and fingerprint.
- `stealth_verify` — Run anti-detection checks.
- `stop_trace_recording` — Stop trace recording and return the final session summary.
- `syscall_direct_invoke` — Direct NT syscall invocation guidance. Resolves SSN for a given NT function and returns a stub template with usage instructions for in-process direct syscall invocation. Bypasses user-mode hooks on ntdll.dll. Win32 only.
- `syscall_ebpf_attach` — Live eBPF syscall attach — spawns a bpftrace process, captures syscall events as structured JSON in real time, and returns them directly. Unlike syscall_ebpf_trace (script-generator), this tool actually runs bpftrace and captures output.…
- `syscall_ebpf_trace` — Trace syscalls on Linux with eBPF. Requires root or CAP_BPF.
- `syscall_resolve_ssn` — Resolve NT syscall service numbers (SSN) from on-disk ntdll.dll. Parses the export table to extract Zw* → SSN mappings and locates a syscall;ret gadget for direct invocation stubs. Win32 only.
- `syscall_stack_capture` — Correlate captured syscall events with real JS call stacks via debugger integration. Goes beyond static heuristics by querying live CDP call stacks for syscall→JS mapping. Falls back to heuristic-only mode when no debugger is attached.
- `syscall_start_monitor` — Start syscall monitoring.
- `syscall_stop_monitor` — Stop syscall interception and release all captured events.
- `tab_workflow` — Cross-tab coordination.
- `tasks_cancel` — Request cancellation of a background task (MCP 2.0 Tasks protocol). Only tasks in the working state can be cancelled; the tool-defined cancel handler runs if present.
- `tcp_close` — Close an open TCP session.
- `tcp_open` — Open a TCP session.
- `tcp_write` — Write data to an open TCP session.
- `tls_cert_pin_bypass_frida` — Bypass certificate pinning via Frida injection (supports the target TLS library and HTTP client frameworks).
- `tls_close` — Close an open TLS session.
- `tls_decrypt_payload` — Decrypt a TLS payload using a provided key, nonce, and algorithm.
- `tls_keylog_enable` — Enable SSLKEYLOGFILE output for TLS library clients.
- `tls_open` — Open a TLS session.
- `trace_recording` — Start or stop trace recording into a SQLite database.
- `transform_workbench` — Run a reproducible binary transform workbench over base64 inputs: base64, hex, XOR, RC4, AES-CBC/ECB decrypt, zlib/gzip inflate, entropy, previews, and magic hints.
- `understand_code` — Run semantic code analysis for structure, behavior, and risks.
- `unidbg_call` — Call a JNI function in a running Unidbg emulator session.
- `unidbg_emulate` — Emulate a native function with Unidbg when available.
- `unidbg_launch` — Emulate a native shared library in Unidbg.
- `unidbg_trace` — Get execution trace from Unidbg session with configurable detail.
- `v8_deopt_trace` — Trace V8 deoptimization events during a capture window. Primary path uses CDP Tracing (v8 category, V8.DeoptimizeFrame events — no natives syntax needed, structured reason/type/line data, timestamps aligned with profiler_cpu). Falls back…
- `v8_heap_sampling` — Collect a V8 allocation sampling profile via CDP HeapProfiler. Starts sampling for a capture window (default 5s), then returns the aggregated allocation call tree: per-function self/total bytes + sample count, sorted by total bytes alloc…
- `v8_turbofan_graph` — Collect and visualize V8 TurboFan IR (sea-of-nodes / Turboshaft graph). Two modes: (1) Provide JS source code — spawns an isolated V8 child with --trace-turbo to generate IR JSON, then parses nodes, edges, phases, and opcode histogram. (…
- `v8_turbofan_inspect` — Inspect JIT/TurboFan compilation state for functions in a script. Reports optimization tier (interpreted/maglev/turbofan) with V8 optimization status codes. Supports actions: inspect (default), optimize (%OptimizeFunctionOnNextCall), deo…
- `v8_type_profile` — Atomic primitive: start or stop V8 type profiling via CDP Profiler.startTypeProfile() / takeTypeProfile() / stopTypeProfile(). Type profiles record the runtime types flowing through each function entry (type:Array, type:Object, type:numb…
- `wasm_instrument_binary` — Real wasm-level binary instrumentation: disassembles via wasm2wat, inserts a call to an imported trace function at every function entry, and reassembles via wat2wasm. Unlike wasm_instrument_trace (which only proxies JS-visible exports), …
- `wasm_instrument_block` — Real wasm-level basic-block instrumentation: disassembles via wasm2wat, inserts a call to an imported trace function at every block/loop/if body entry (and function entry), and reassembles via wat2wasm. Unlike wasm_instrument_binary (fun…
- `wasm_instrument_trace` — Generate a JS instrumentation wrapper for a .wasm module.
- `wasm_offline_run` — Run an exported .wasm function.
- `wasm_optimize` — Optimize a .wasm binary for size or speed.
- `wasm_to_c` — Transpile .wasm bytecode to C source and header files.
- `watch` — Manage watch expressions for monitoring variable values during debugging.\n\nActions:\n- add: Add a watch expression (requires expression)\n- remove: Remove by watchId\n- list: List all watches\n- evaluate_all: Evaluate all enabled watch…
- `webcrack_unpack` — Run webcrack bundle unpacking and return extracted module graph.
- `webgpu_frame_timing` — Measure per-frame CPU and GPU cost over a rAF loop using GPU timestamp queries (device.limits.timestampPeriod conversion). Answers
- `webgpu_shader_compile` — Compile WGSL shader and extract metadata (entry points, bindings, attributes). Validates shader code and detects potential security issues.
- `webgpu_timing_analysis` — GPU timing analysis for side-channel detection. Measures GPU command execution time variance to detect cache-based side-channel attacks (Graz University 2025 research).
- `websocket_open` — Open a WebSocket session.
- `websocket_send_frame` — Send a WebSocket frame.
- `widget_challenge_solve` — Solve a widget challenge with hook, manual, or configured external service.
- `workflow_conditional_step` — Evaluate a condition against the stepResults argument and execute one of two tool branches. Supports built-in predicates: always_true, always_false, any_step_failed, success_rate_gte_N (N=0-100), variable_equals_KEY_VALUE, variable_conta…
- `ws_monitor` — Enable or disable WebSocket frame capture.
- `ws_send_frame` — Send a frame through a live in-page WebSocket instance retained by ws_monitor(exposeInstances=true). Enables edit-and-resend replay of WebSocket traffic. Only reaches WebSockets created AFTER exposeInstances was enabled (existing sockets…
- `adb_apk_analyze` — Analyze an installed APK: package, permissions, activities, and security info.
- `adb_apk_pull` — Pull an APK from a device to the local filesystem.
- `adb_device_list` — List all connected Android devices and emulators.
- `adb_file_pull` — Pull a file from an Android device using normal ADB permissions.
- `adb_getprop` — Dump and parse Android system properties (getprop) into a structured map with a curated device fingerprint (model, SDK, ABI, build fingerprint, security patch, bootloader lock).
- `adb_logcat_query` — Capture and filter Android logcat output in-process without shell grep pipelines.
- `adb_package_summary` — Return structured Android package metadata: launcher, uid, versions, permissions, components, and native library dirs.
- `adb_proc_maps` — Read and parse /proc/PID/maps from a device, resolving PID from packageName when needed.
- `adb_pull_native_libs` — Pull native shared libraries (.so) for an installed app from a device.
- `adb_root_check` — Probe root indicators such as su, Magisk, test-keys, SELinux, and shell uid.
- `adb_screenrecord` — Record a short MP4 screen capture through adb shell screenrecord and pull it locally.
- `adb_screenshot` — Capture a PNG screenshot through adb exec-out screencap -p.
- `adb_ui_dump` — Capture Android UI hierarchy via uiautomator dump. Runs uiautomator dump on-device, pulls the XML, and returns parsed UI tree. Useful for UI automation verification, layout inspection, and accessibility tree analysis.
- `adb_webview_list` — List debuggable WebView targets connected via ADB.
- `ai_suggest_exploits` — Use LLM to suggest exploit primitives and attack chains for a given vulnerability. Returns theoretical exploitation steps, references, and required conditions. IMPORTANT: Does NOT generate executable payloads or malicious code.
- `analysis_ast_match` — Match AST nodes by type and optional property filter.
- `analysis_data_flow` — Trace data flow through JavaScript: identify sources (user input, network, storage), sinks (XSS, eval, SQL injection, command execution), sanitizer pass-through points, and tainted variable propagation paths. Useful for finding injection…
- `analysis_decode_string_array` — Decode literal string-array access back to strings.
- `analysis_security_scan` — Static security scan of JavaScript: detect hardcoded secrets (API keys, tokens), dangerous functions (eval, Function constructor), XSS sinks (innerHTML, document.write), SQL injection patterns, and weak crypto (Math.random). Returns stru…
- `antidebug_detect_protections` — Detect anti-debug protections in current page with bypass recommendations.
- `apk_dex_intake` — Build a cohesive APK/DEX intake evidence packet: ZIP entries, manifest summary, DEX headers, native libraries, generic surface hints, caller-supplied hint matches, and next actions.
- `apk_manifest_dump` — Extract AndroidManifest.xml from an APK for quick inspection.
- `apk_manifest_query` — Return a compact structured AndroidManifest summary: package, launcher activity, app class, SDKs, permissions, components, providers, and SDK/surface hints.
- `apk_native_libs_list` — List packaged native shared libraries (.so) inside an APK.
- `apk_packer_detect` — Detect Android APK packers by matching
- `apk_packer_list_signatures` — List the in-process signature table used by
- `apk_signing_block_parse` — Read-only parser for the APK Signing Block (schemes v2/v3/v3.1/v4) plus key-rotation lineage detection and residue-block / dex-prefix / magic-offset anomaly flags. Never mutates the APK.
- `apk_static_triage` — One-shot APK triage: ZIP metadata, manifest summary, native libs, asset hints, likely packers/protectors, and recommended next steps.
- `apktool_decode` — Decode an APK using apktool to inspect resources, manifest, and smali output.
- `append_session_insight` — Record a persisted insight for the current session.
- `asar_deobfuscate` — Scan every .js file inside an ASAR archive for obfuscation indicators (string-array arrays, webpack bundles, control-flow flattening, dynamic code, minification) and classify each file. Flagged files are optionally extracted to a directo…
- `asar_extract` — Extract and list files from an Electron ASAR package.
- `asar_search` — Grep text patterns inside ASAR archive contents without extraction.
- `ast_transform_beautify` — Pretty-print minified or obfuscated JavaScript: re-emit the parsed source with standard 2-space indentation and normalised spacing. Formatting only — the AST is preserved, so program semantics do not change. Unparseable input is returned…
- `ast_transform_preview` — Preview lightweight AST-like transforms (string/regex based) and return before/after diff.
- `binary_decode` — Decode binary payloads, transport encodings, and compressed blobs into hex, utf8, or json output.
- `binary_detect_format` — Detect binary payload format and encoding signals.
- `binary_encode` — Encode utf8/hex/json input into transport encodings or compressed base64 blobs.
- `binary_entropy_analysis` — Compute entropy and byte frequency for a payload.
- `binary_entropy_profile` — Compute Shannon entropy across fixed-size chunks of a binary file to locate encrypted / packed / compressed sections. High-entropy regions (>=7.0 bits/byte) are likely encrypted or compressed; low-entropy (<4.0) are typically code or tex…
- `binary_instrument_capabilities` — Report binary instrumentation backend availability.
- `binary_key_extract` — Scan a binary for hardcoded key candidates (raw high-entropy, Base64, hex). Read-only — no decryption.
- `binary_strings_extract` — Extract printable ASCII/UTF-16LE strings from a binary file with regex filtering.
- `blackbox_list` — List script blackbox patterns.
- `browse_extension_registry` — Browse the online extension registry for installable plugins and workflows.
- `browser_cdp_performance_metrics` — Atomic primitive: fetch browser runtime metrics via CDP Performance.getMetrics() on the active page. Returns raw CDP-level counters (LayoutCount, RecalcStyleCount, ScriptDuration, TaskDuration, JSHeapUsedSize, Nodes, Documents, Frames, .…
- `browser_get_metrics` — Atomic primitive: collect page performance metrics via PerformanceMonitor — Web Vitals (FCP, LCP, CLS, TTFB), DOM timing (domContentLoaded, loadComplete), engine-level counters (scriptDuration, layoutDuration, recalcStyleDuration) and JS…
- `browser_jsdom_query` — Query a JSDOM session with a CSS selector.
- `browser_jsdom_serialize` — Serialize a JSDOM session to HTML.
- `browser_list_cdp_targets` — List CDP targets with optional type/URL/title filters.
- `browser_list_tabs` — List open browser tabs with URLs and titles.
- `browser_list_workers` — Enumerate Service Worker / Shared Worker / dedicated Web Worker targets via Target.getTargets. Use browser_worker_scripts(targetId=...) afterwards to dump a worker
- `browser_passkey_seed` — Seed a WebAuthn/Passkey credential into the browser for test automation.
- `browser_resource_timing` — Atomic primitive: read Resource Timing API entries for the active page and decompose each resource into dns / connect / tls / ttfb / download phases plus transfer and body sizes. Optionally include Server-Timing headers and filter by URL…
- `browser_status` — Report browser status: running, tab count, version.
- `browser_worker_scripts` — Attach a CDP session to a worker target and dump its parsed scripts (equivalent to get_all_scripts, but scoped to a worker). Debugger.scriptParsed is replayed on Debugger.enable, so already-loaded worker scripts are returned.
- `call_graph_analyze` — Analyze runtime function call graph from in-page traces.
- `camoufox_geolocation` — Get geolocation for a locale.
- `canvas_dump_shaders` — Dump the linked shader programs (vertex + fragment source, uniforms) running on the target canvas. Uses engine introspection where available (Three.js renderer.info.programs, BABYLON.Effect.ShadersStore, Laya.Shader registry) and the WEB…
- `canvas_engine_fingerprint` — Detect Canvas/WebGL game engines in the page.
- `canvas_memory_invariants` — Assert runtime invariants about WebGL context lifetime, engine state consistency, and texture/program leaks. Reports checks[], violations[] (with severity + safe-cleanup fix), and a recommendations[] block. Honest scope: only JS-observab…
- `canvas_pick_object_at_point` — Pick / hit-test the topmost object at a given screen coordinate using the engine
- `canvas_scene_dump` — Extract the full scene tree / display list from a detected canvas engine.
- `canvas_scene_search` — Search a previously-dumped scene tree (canvas_scene_dump output) for nodes by name regex and/or type. Pure-compute — no browser session required. Returns matching nodes with their path from root, depth, and engine-specific properties.
- `captcha_detect` — Detect CAPTCHAs on the current page.
- `captcha_solver_capabilities` — Report CAPTCHA solving mode availability.
- `check_debug_port` — Check if a process is being debugged using NtQueryInformationProcess (ProcessDebugPort).
- `collect_code` — Collect JavaScript from a target website with configurable strategy.
- `console_get_exceptions` — Get captured uncaught exceptions from the page
- `console_get_logs` — Retrieve captured console logs with type and time filters.
- `console_monitor` — Toggle console log capture (log, warn, error, info, debug).
- `coverage_report` — Report which tools have been called in the current runtime and which known tools remain uncalled.
- `cross_domain_capabilities` — List all cross-domain capability categories and available workflows.
- `cross_domain_evidence_query` — Query the shared evidence graph by URL, heap address, function, script, node type, metadata, or chain.
- `cross_domain_evidence_stats` — Get node and edge statistics for the shared cross-domain evidence graph.
- `cross_domain_health` — Report health status of cross-domain bridges and correlators.
- `cross_domain_suggest_workflow` — Recommend a multi-domain workflow to achieve a specific analysis goal.
- `cross_domain_synonym` — Map natural-language queries to tool recommendations using a lightweight synonym graph. Pure TS — no LLM. Useful for discovering which tools implement a concept described in plain English (e.g.
- `crypto_compare` — Compare two crypto implementations against identical test vectors.
- `dart_call_graph` — Build a best-effort static call graph from a Dart AOT snapshot: nodes are Code objects, edges are ObjectPool entries whose value matches another Code entry point (caller to callee). Pass a sessionId to reuse a cached snapshot. Honest bou…
- `dart_inspect_object_pool` — Dump an ObjectPool at a specific address, showing all entries with types and values. Pass a sessionId to reuse a cached snapshot.
- `dart_list_functions` — List all Dart Code objects (compiled functions) from a loaded snapshot, with entry point address, size, and name (if available). Pass a sessionId to reuse a cached snapshot.
- `dart_load_snapshot` — Load and parse a Dart AOT snapshot from libapp.so, extracting metadata and statistics (Code objects, ObjectPool entries, clusters). Pass a sessionId from dart_create_session to reuse an already-parsed snapshot (skips re-parsing libapp.so).
- `dart_object_pool_dump` — Read-only static dump of the Dart isolate ObjectPool in a libapp.so: classify each slot as smi/mint/double/string/classRef/functionRef/pool/null/unknown.
- `dart_pc_descriptors` — Parse PcDescriptors for one or all Dart functions in a loaded snapshot and resolve call targets by decoding ARM64 BL instructions at each call-site PC offset. Returns structured call-site entries with pcOffset, kind (1=icCall, 2=unoptSta…
- `dart_smi_scan` — Recover Dart Small Integer (Smi) constants from a libapp.so by reading aligned little-endian words and stripping the heap-pointer tag bit.
- `dart_snapshot_header_parse` — Parse the Dart isolate snapshot header in a libapp.so: magic, kind, 32-byte hash, features, target arch. Read-only.
- `dart_strings_extract` — Stream-extract ASCII/UTF-16LE strings from a Dart AOT libapp.so and classify them (urls, paths, classNames, packageRefs, cryptoKeywords, Dart identifiers, plus customRules). ReDoS-guarded.
- `dart_version_fingerprint` — Identify Flutter/Dart SDK release from a libapp.so by combining header parse with a built-in (and optionally user-supplied) hash table.
- `debugger_capture_hit` — Wait for the next debugger pause and capture call stack plus optional top-frame scope variables.
- `debugger_get_paused_state` — Get current paused state and reason.
- `describe_tool` — Get detailed information about a specific tool, including its input schema.
- `detect_crypto` — Detect cryptographic algorithms and usage patterns in source code.
- `detect_obfuscation` — Detect obfuscation techniques in JavaScript source.
- `dex_scan_file` — Scan a binary/memory-dump file for DEX or CompactDex magic and optionally extract hits.
- `diff_heap_snapshots` — Compare two heap snapshots from a trace.
- `dns_cname_chain` — Trace the full CNAME chain for a hostname.
- `dns_probe` — Run a DNS query and return structured status instead of throwing.
- `dns_reverse` — Reverse DNS lookup — find hostnames for an IP address.
- `electron_check_fuses` — Read Electron fuse states.
- `electron_debug_status` — Check status of dual-CDP debug sessions launched by electron_launch_debug.
- `electron_inspect_app` — Analyze Electron app structure: main/renderer entry, preload, IPC.
- `electron_ipc_sniff` — Monitor Electron IPC messages.
- `electron_scan_userdata` — Scan a directory for Electron JSON userdata files.
- `electron_verify_integrity` — Verify Electron ASAR integrity: parse the ElectronAsarIntegrity JSON embedded in the main binary, locate each referenced ASAR, and compare the on-disk SHA256/SHA512 hash against the embedded hash. A mismatch means the ASAR was tampered w…
- `electron_verify_signature` — Inspect a packaged Electron binary
- `enumerate_modules` — List all loaded modules (DLLs) in a process with their base addresses.
- `evidence_chain` — Get full provenance chain from a node ID in specified direction.
- `evidence_query` — Query reverse evidence graph by URL, function name, or script ID to find associated nodes.
- `exploit_analyze_mitigations` — Detect binary security mitigations (NX/DEP, PIE/ASLR, stack canary, RELRO, FORTIFY_SOURCE, CFG). Returns boolean flags for each protection. CFG (Control Flow Guard) is detected on Windows PE via IMAGE_DLLCHARACTERISTICS_GUARD_CF (0x4000).
- `exploit_cache_stats` — Get exploit-dev cache statistics including hit rate, memory usage, and entry count. Used for performance monitoring and cache tuning.
- `extension_info` — Read installed extension manifest details without importing plugin code.
- `extension_list_installed` — List installed extensions from the local registry.
- `extract_function_tree` — Extract a function and its dependency tree from collected scripts.
- `fetch_stream_export_capture` — Export events captured by the fetch()-based stream monitor to artifacts/captures as JSON or NDJSON.
- `fetch_stream_get_events` — Get events captured by the fetch()-based stream monitor (text/event-stream consumed via fetch). Set fullData=true to include full event data.
- `flutter_packages_detect` — Detect third-party Dart
- `framework_state_extract` — Extract React/Vue/Svelte/Solid component state and meta-framework info.
- `frida_enumerate_functions` — Enumerate exported functions for a specific module in a Frida session.
- `frida_enumerate_modules` — List loaded modules in an attached Frida session.
- `frida_find_symbols` — Search for symbols matching a pattern in a Frida session.
- `frida_list_sessions` — List all active Frida attach sessions with target info.
- `frida_memory_read` — Read raw bytes from a Frida session via ptr(address).readByteArray. Returns hex; capped at 65536 bytes per call.
- `get_all_scripts` — List all scripts loaded by the page with optional source.
- `get_available_plugins` — List installed binary analysis plugins.
- `get_cache_stats` — Get cache statistics: entries, sizes, hit rates, and cleanup recommendations.
- `get_call_stack` — Get the current call stack.
- `get_collection_stats` — Get collection, cache, and compression statistics.
- `get_detailed_data` — Retrieve large data by detailId.
- `get_object_properties` — Get properties of an object by objectId.
- `get_offloaded_data` — Retrieve the original bytes of a field that was offloaded to disk (see the
- `get_scope_variables_enhanced` — Enhanced scope variable inspection with deep object traversal.
- `get_script_source` — Retrieve source code of a script by ID or URL pattern.
- `get_task_context` — Read persisted task handoff context and session insights.
- `get_token_budget_stats` — Get token budget usage stats, warnings, and optimization suggestions.
- `ghidra_analyze` — Analyze a binary and return metadata.
- `graphql_enum_schema` — Enumerate GraphQL fields from server suggestion errors with introspection fallback.
- `graphql_extract_queries` — Extract GraphQL queries/mutations from captured network traces.
- `graphql_introspect` — Run GraphQL introspection and optional Apollo Federation _service.sdl probing.
- `grpc_frame_parse` — Split a captured gRPC / gRPC-Web body into its length-prefixed messages. Each message is 1 compressed-flag byte + 4-byte big-endian length + payload. Detects gRPC-Web trailer frames (flag bit 7) and the compression flag (bit 0). Lenient:…
- `grpc_get_calls` — Get captured gRPC / gRPC-Web calls with parsed message summaries. Set fullMessages=true to include the parsed message arrays (each carries payloadBase64 — feed to protobuf_decode_raw). Without fullMessages only per-call counts and flags …
- `grpc_monitor` — Enable or disable live capture of gRPC / gRPC-Web calls. gRPC calls are detected by content-type application/grpc(-web)?(+proto)? on the HTTP/2 response. On loadingFinished the response body is pulled (base64) and split into length-prefi…
- `http2_frame_parse` — Decode a raw HTTP/2 frame (hex string) back into its header fields and type-specific payload (SETTINGS entries, PING opaque data, WINDOW_UPDATE increment, RST_STREAM/GOAWAY error codes, GOAWAY debug data). Inverse of http2_frame_build. L…
- `indexeddb_dump` — Export IndexedDB databases and records. Supports keyRange queries (IDBKeyRange.bound/lower/upper), indexName (query a specific index), count (count-only mode), and cursor pagination (stream large stores in batches).
- `instrumentation_session_diff` — Diff two instrumentation session snapshots: operations added/removed/common (by id) plus artifact fingerprints and per-type counts. Pure compare, mutates nothing.
- `jadx_decompile` — Decompile an APK class or method with JADX CLI.
- `jadx_search_code` — Ripgrep-backed search over jadx output. Pass decompileDir for read-only search, or apkPath to auto-decompile to a temporary directory first.
- `js_analyze_vm` — Analyze JSVMP/VM interpreter: dispatch type, handler table, opcode map.
- `js_bundle_search` — Fetch a remote JS bundle and search it with named regex patterns, with caching and noise filtering.
- `js_deobfuscate_jsvmp` — Deobfuscate JSVMP/VM-protected JavaScript: extract VM bytecode and restore original logic.
- `js_heap_search` — Search JS heap for strings matching a pattern.
- `list_extension_workflows` — List runtime-loaded extension workflows from plugins/ or workflows/ directories.
- `list_extensions` — List all loaded plugins, workflows, and extension tools.
- `list_macros` — List all available macros.
- `list_page_snapshots` — List saved page snapshots.
- `llm_suggest_names` — Use LLM to suggest meaningful names for obfuscated identifiers.
- `maintenance_detect_gpu` — Detect GPU family from WebGL/WebGPU renderer strings. Classifies into NVIDIA, AMD, Intel, Apple, Mali, Adreno, PowerVR, Vivante, Broadcom, Qualcomm, Microsoft. Pure-TS classifier — no browser needed. Provide at least one of webglRenderer…
- `memory_anticheat_detect` — Scan process imports for anti-debug/anti-cheat mechanisms: IsDebuggerPresent, NtQueryInformationProcess, timing checks (QPC, GetTickCount), thread hiding, heap flag checks, and DR register inspection. Each detection includes a bypass sug…
- `memory_antidetection_check` — Pre-flight anti-detection security audit. READ-ONLY — no patches or modifications. Checks: (1) ETW/AMSI patch status, (2) debugger attached to self via IsDebuggerPresent, (3) HVCI (Hypervisor-protected Code Integrity) and VBS (Virtualiza…
- `memory_aob_scan` — Array-of-Bytes scan with wildcard and operator support (CE 7.6 parity). Search for byte patterns like
- `memory_check_protection` — Check memory protection flags at a specific address. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_code_caves` — Find code caves (runs of 0x00 or 0xCC) in executable sections of loaded modules. Returns largest caves first.
- `memory_dump` — Dump memory region as hex with ASCII column. Outputs a formatted hex dump similar to xxd.
- `memory_dump_region` — Dump a process memory region to a binary file for offline analysis. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_emulator_detect` — Detect if a target process is a known console emulator (ArtMoney parity). Supports: PCSX2, Dolphin, RPCS3, Yuzu, Cemu, ePSXe, PPSSPP, xemu. Detection uses process name matching + optional module fingerprint confirmation. Returns emulator…
- `memory_find_references` — Find all references to an address in executable memory (x64dbg parity). Scans all executable regions for CALL rel32, JMP rel32, Jcc rel32, LEA [RIP+disp32], and MOV [RIP+disp32] instructions that reference the target address. Uses pure-T…
- `memory_group_scan` — Search for multiple values at known offsets simultaneously.
- `memory_guard_pages` — Find all memory regions with PAGE_GUARD protection in a process. Guard pages are often used as anti-tampering mechanisms or stack overflow detection.
- `memory_handle_enum` — Enumerate all open handles in a target process via NtQuerySystemInformation. Returns handle value, object type, access mask, and object name for each handle. Filterable by type: File, Key, Process, Thread, Token, Section, etc. Useful for…
- `memory_heap_anomalies` — Detect heap anomalies: heap spray patterns (many same-size blocks), possible use-after-free (non-zero free blocks), and suspicious block sizes (0 or >100MB).
- `memory_heap_enumerate` — Enumerate all heaps and heap blocks in a process via Toolhelp32 snapshot. Returns heap list with block counts, sizes, and overall statistics.
- `memory_heap_stats` — Get detailed heap statistics with size distribution buckets (0-64B, 64B-1KB, 1-64KB, 64KB-1MB, >1MB), fragmentation ratio, and aggregate metrics.
- `memory_inline_hook_detect` — Detect hooks in process modules. scanMode
- `memory_integrity_check` — Check executable memory regions against their corresponding on-disk PE files (.text sections) to detect modifications like inline hooks or code patches.
- `memory_list_regions` — List all memory regions in a process with protection flags. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_list_types` — List all registered custom scan types.
- `memory_mono_assemblies` — List Mono assemblies loaded in the root domain of a Unity/Mono process. Returns assembly name, address, and image address. Optionally filter by name substring.
- `memory_mono_classes` — List Mono classes in a specific assembly from a Unity/Mono process. Reads the MonoImage type definition table (MONO_TABLE_TYPEDEF) and resolves class names from the string heap. Optionally filter by namespace.
- `memory_mono_detect` — Detect Mono or IL2CPP runtime in a target process. Returns runtime kind (mono/il2cpp), module name, pointer size, and root domain address if resolved. Works on Unity games and other Mono/.NET applications.
- `memory_mono_fields` — Read field values from a Mono object at the given address. Resolves the class via vtable pointer, walks MonoClass fields, and decodes each field value with type-aware heuristics (int, float, string pointer detection).
- `memory_mono_methods` — Inspect method count for a Mono class in a Unity/Mono process. Full method name enumeration requires walking the MonoMethod table from MonoImage (not yet implemented — returns methodCount from the type definition table).
- `memory_mono_objects` — Find live Mono objects of a specific class in the managed heap. Resolves class vtable, then scans writable heap regions for vtable pointer matches. Returns object addresses with class name and estimated size.
- `memory_parse_dump` — Parse a Windows Minidump (.dmp) file and extract forensic information: loaded modules (base/size/name/timestamp), threads (ID/stack/context), memory ranges (64-bit or 32-bit), system info (OS/CPU), and exception records. Optionally resol…
- `memory_pe_headers` — Parse PE headers (DOS, NT, File, Optional) from a module base address in process memory. Returns machine type, entry point, image base, section count, and data directory info.
- `memory_pe_imports_exports` — Parse import and/or export tables from a PE module in process memory. Returns DLL names, function names, ordinals, hints, and forwarded exports. Cross-platform: parses ELF .dynsym / Mach-O LC_SYMTAB from disk when moduleName is given on …
- `memory_pointer_scan` — Find pointers to a target address.
- `memory_read` — Read memory from a process at a specific address. Requires elevated privileges. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_read_typed` — Read process memory as typed numeric values with explicit endianness. Decodes consecutive values starting at address via koffi endian-sensitive integer types (uint64_le / int32_be / …) — no manual byte swapping needed. 64-bit values are …
- `memory_region_compare` — Compare two memory regions byte-by-byte and return a diff summary. Equivalent to Cheat Engine
- `memory_region_enumerate` — Enumerate memory regions in a target process. Cross-platform: Windows (VirtualQueryEx), macOS (mach_vm_region), Linux (/proc/pid/maps). Returns base address, size, protection (r/w/x/rw/rx/rwx), state, type (image/mapped/private), and mod…
- `memory_rtti_info` — Parse MSVC RTTI (Run-Time Type Information) at an object address. Reads vtable pointer, follows the Complete Object Locator chain, extracts class name, base classes, and class hierarchy descriptor. Equivalent to CE\
- `memory_scan_filtered` — Refine a previous memory scan with filtered addresses. If pid is omitted, the active browser renderer PID is auto-discovered from the current browser session.
- `memory_search_string` — Search process memory for strings matching a pattern. Wraps memory_first_scan with valueType=string for convenience and adds substring/regex post-filtering. Optionally also searches for UTF-16LE (wide) strings.
- `memory_structure_analyze` — Analyze memory at an address to infer data structure layout.
- `memory_structure_compare` — Compare struct instances to identify differing vs constant fields. Two modes: (1) Pairwise—compare address1 vs address2. (2) Group comparison (CE dissect data parity)—pass arrays of addresses in group1Addresses and group2Addresses. Group…
- `memory_vtable_parse` — Parse a vtable to enumerate virtual function pointers and resolve them to module+offset. Also attempts RTTI parsing for class name and inheritance hierarchy.
- `miniapp_pkg_analyze` — Analyze an unpacked miniapp package.
- `miniapp_pkg_scan` — Scan local directories for miniapp package files.
- `mojo_decode_message` — Decode a Mojo IPC hex payload into a structured field map.
- `mojo_ipc_capabilities` — Report Mojo IPC monitoring availability.
- `mojo_list_interfaces` — List discovered Mojo IPC interfaces and their pending message counts.
- `mojo_messages_get` — Retrieve captured Mojo IPC messages from the active monitoring session.
- `mojo_messages_summarize` — Aggregate the captured Mojo IPC buffer (non-destructive) into interface/method/direction breakdowns, top-N lists, and a capture time window. Does not drain the buffer.
- `native_bridge_status` — Check native bridge backend health.
- `native_symbol_sync` — Export native symbols to connected analysis backends. Supports json/csv/idc/sqlite output; an optional sinceHash requests an incremental export (only changed symbols) from backends that support it.
- `nemu_bytecode_decode` — Decode a u32 LiteVM bytecode word into its opcode fields: group (G0-G7), sub-opcode, a1 register index, fl field index, imm signed offset, and validity. Matches the Python LiteVM Opcode.is_valid_opcode() semantics. No session needed — pu…
- `nemu_bytecode_scan` — Scan a guest memory region and decode all valid LiteVM bytecode words. Reads
- `nemu_capabilities` — Report native-emulator backend availability, supported features, and explicit ISA/SIMD gaps. Unsupported opcodes fail loudly instead of being reported as emulated.
- `nemu_data_dump` — Read a guest memory region and format it as a structured table of u32 or u64 values. Each row shows offset, hex value, ASCII preview, and optional annotations. Auto-classifies each word as pointer, bytecode, ASCII, or raw data. Pointers …
- `nemu_dlsym_diag` — Read the dlsym resolution log from the current session. Tracks every symbol lookup the emulated code requested via dlsym() — essential for discovering which VM handler names an obfuscated dispatch engine tries to resolve. Actions: read (…
- `nemu_dump_frame` — Read and decode a CreateLitevm frame structure from guest memory. Parses the 256-byte frame fields: chain pointer, bytecode count, frame data, and sub-function flags. Essential for understanding the VM dispatch state at any point during …
- `nemu_extract_apk_libs` — List the loadable arm64-v8a native libraries (.so) packaged inside an APK, with their byte sizes. Use nemu_load_apk_library to load one. Note: libapp.so (Flutter Dart AOT) is listed but is not executable here — route it to the Dart layer.
- `nemu_get_jni_stub` — Get the guest stub address for a JNI table index. Pass a specific
- `nemu_inspect_imports` — Inspect an AArch64 ELF .so before emulation and list imported symbols from dynamic relocations, including GOT offsets and whether each import is backed by the built-in bionic stubs. Use this to diagnose PLT/GOT NULL indirect-call failure…
- `nemu_jni_diag` — Read the JNI diagnostic log for a session. Tracks every JNI function call (FindClass, GetMethodID, CallIntMethod, etc.) and unimplemented stub invocations. Use after nemu_call_symbol or nemu_trace to see what Java methods the native code…
- `nemu_jni_handles` — List all JNI object handles allocated in a session, with their kind and summary. Handles are opaque IDs (jclass, jstring, jbyteArray, jobject) that native code passes around. Use to verify mock setups and debug handle leaks. Optionally f…
- `nemu_list_sessions` — List active emulator sessions with their creation and last-use timestamps.
- `nemu_list_symbols` — List the exported function symbols of the loaded library — the names callable via call_symbol / call_jni_export.
- `nemu_mem_inspect` — Single convergence entry point for the guest-memory inspection family — one tool, five
- `nemu_pointer_chain` — Walk a chain of pointers in guest memory. Starting from
- `nemu_read_byte_array` — Resolve a jbyteArray handle (e.g. a native call
- `nemu_read_memory` — Read raw bytes from guest memory at a given address. Returns a bounded preview by default; set includeDataBase64=true for full base64 within the configured cap.
- `nemu_scan_memory` — Scan emulated memory for a byte pattern (like Volatility). Searches a guest address range for an exact byte match using Boyer-Moore-Horspool. Returns a list of matched addresses. Skips unmapped regions silently — use nemu_mem_map to exte…
- `nemu_session_info` — Inspect one emulator session without executing native code. Returns timestamps, exported symbols, unresolved imports, constructor faults, and active session count.
- `nemu_vm_state_compare` — Compare native VM state (read from guest memory) against an expected state (e.g. Python LiteVM dump). For each of ctx, table, and output, reports whether they match and lists the first mismatches. Use to cross-validate native VM executio…
- `nemu_vm_state_dump` — Dump LiteVM state from guest memory at specified base addresses. Reads ctx (32×64-bit), table (32×64-bit), and optional output buffer. Returns structured hex values suitable for comparison with Python LiteVM dumps. Use after nemu_call_sy…
- `network_bot_detect_analyze` — Analyze captured requests for bot-detection signals. Optionally supply a JA3/JA4 TLS fingerprint (from network_tls_fingerprint parse_client_hello) plus user-defined knownBad hash lists; matching hashes raise the bot score. Ships NO hardc…
- `network_extract_auth` — Extract authentication data from captured network requests.
- `network_get_requests` — Get captured network requests.
- `network_get_response_body` — Get the response body for a captured request.
- `network_get_stats` — Get network statistics.
- `network_get_status` — Get network monitoring status.
- `network_http2_fingerprint` — Compute an Akamai-style HTTP/2 fingerprint from one or more captured HTTP/2 frames (the client connection preface: SETTINGS + stream-0 WINDOW_UPDATE + any PRIORITY frames). Returns the canonical
- `network_latency_stats` — Measure repeated latency and compute percentile stats.
- `page_coverage_stop` — Stop coverage collection and return per-script JS+CSS coverage results. Includes total bytes, used bytes, and coverage percentage per URL.
- `page_list_frames` — List page frames for frame targeting.
- `page_screenshot` — Capture a page or element screenshot.
- `page_storage_info` — Query navigator.storage.estimate() for {usage, quota} and navigator.storage.persisted() to inspect the origin storage budget and persistence status (offline/PWA reverse engineering).
- `pcap_read` — Read a classic PCAP file and return compact deterministic packet summaries. PCAPNG is intentionally not supported.
- `pcapng_read` — Read a PCAPNG (pcap-ng) capture file and return structured Section/Interface/Packet blocks. Supports Section Header, Interface Description, Enhanced/Simple Packet, Name Resolution, and Interface Statistics blocks; unknown block types are…
- `performance_get_metrics` — Get page performance metrics.
- `platform_capabilities` — Report platform tool backend availability.
- `process_check_debug_port` — Check if a process has a debug port enabled for CDP attachment.
- `process_detect_apc` — Detect APC (Asynchronous Procedure Call) injection in a process. Enumerates threads, probes each thread APC queue via NtQueryInformationThread(ThreadApcState), and detects threads in alertable wait state (SleepEx/WaitForMultipleObjectsEx…
- `process_enum_handles` — Enumerate open handles for a process using NtQuerySystemInformation. Resolves handle type and object name, decodes access masks, identifies security risks (high-privilege handles to sensitive processes, dangerous Token handles, inheritab…
- `process_enum_threads` — Enumerate all threads in a process. Returns thread IDs, with optional per-thread context and diagnostics. Cross-platform: Win32 uses CreateToolhelp32Snapshot; Linux reads /proc/{pid}/task; macOS uses
- `process_find` — Search for processes by name pattern. Returns a list of matching processes with PID, name, path, and window information.
- `process_get` — Get detailed information about a specific process by PID, including command line, parent PID, and debug port status.
- `process_hollowing_scan` — Pure-TS static hollowing indicator scan. Analyses /proc/pid/maps (RWX regions), /proc/pid/exe (deleted backing file), and PE headers (suspicious section names, RWX sections, entry point anomalies, mismatched binary path) without requirin…
- `process_kill` — Terminate a process by PID. Requires appropriate privileges.
- `process_list` — List all running processes. This is an alias for process_find with an empty pattern.
- `process_windows` — Get all window handles for a process.
- `proto_auto_detect` — Auto-detect a protocol pattern from one or more hex payload samples.
- `proto_define_pattern` — Define a protocol pattern with delimiter, byte order, and field layout.
- `proto_dissect_dns` — Dissect a raw DNS payload (RFC 1035 + EDNS(0)) into header flags, questions, answers, authorities, and additionals with full compression-pointer handling and OPT pseudo-record decoding.
- `proto_dissect_http` — Dissect a raw HTTP/1.x request or response payload (RFC 7230) into the start line, headers, and body. Unwinds chunked transfer-encoding and reports Content-Length / Content-Type / Content-Encoding hints.
- `proto_fingerprint` — Identify protocol type from hex payload samples.
- `proto_infer_fields` — Infer likely protocol fields from repeated hex payload samples.
- `proto_infer_state_machine` — Infer a protocol state machine from captured message sequences.
- `proto_visualize_state` — Generate a Mermaid state diagram from a protocol state machine definition.
- `protobuf_decode_raw` — Decode protobuf bytes. Raw wire-format walk by default; schema mode returns ProtoJSON, expands valid google.protobuf.Any messages, preserves open-enum numeric values, and reports unknown fields with raw bytes plus wire details.
- `proxy_get_requests` — Read captured proxy request/response metadata, body previews, and timing.
- `proxy_list_rules` — List active proxy interception rules tracked by this handler.
- `proxy_status` — Report proxy status, listen port, and CA certificate path.
- `search_in_scripts` — Search collected scripts by keyword or regex pattern.
- `seek_to_timestamp` — Reconstruct trace state at a specific timestamp.
- `session_progress_coverage` — Query the session progress ledger: per-kind entry counts plus the matching entries sorted newest-first (by first-recorded time). Use it to audit reverse-engineering coverage and surface uncovered areas. Pass
- `session_progress_record` — Record a piece of reverse-engineering progress evidence for the current session (a hooked process, a hook point, or a decoded protocol field). Recording the same (kind, key) pair again is idempotent: it updates
- `skia_correlate_objects` — Correlate requested Skia node identifiers with the extracted scene tree.
- `skia_detect_renderer` — Detect the active Skia renderer backend from the current page context.
- `skia_extract_scene` — Extract a lightweight Skia scene tree from the selected canvas.
- `smart_cache_cleanup` — Evict LRU and stale entries while preserving hot data.
- `snapshot_create` — Create a shadow-git snapshot of a scan-artifact directory (artifacts, HAR, screenshots, debugger-sessions, ...) so it can be rolled back later. Uses an ISOLATED git object store outside the target directory — the project .git is never to…
- `snapshot_list` — List shadow-git snapshots recorded for a directory, newest first.
- `sourcemap_coverage` — Summarize mapped and unmapped source coverage.
- `sourcemap_diff` — Compare two source map revisions: which sources were added/removed, per-source mapping segment deltas, and generated-position shifts beyond a configurable threshold (default 1 line).
- `sourcemap_discover` — Discover source maps on the current page.
- `sourcemap_fetch_and_parse` — Fetch a source map from URL and parse to original sources.
- `sourcemap_lookup` — Resolve generated code position to original source (default), or — when originalSource is supplied — resolve original source:line:column back to the generated position. Supports indexed (sectioned) source maps transparently.
- `sourcemap_parse_v4` — Parse source map with ECMA-426 v4 scope/debug-id support; falls back to v3.
- `sse_get_events` — Get captured SSE events with filters and pagination.
- `state_board_io` — Serialize state board to JSON or restore from a previous export.
- `state_board_watch` — Watch state board keys for changes with configurable polling.
- `summarize_trace` — Generate a compact summary of a trace database.
- `syscall_capture_events` — Capture syscall events from the active or last monitoring session.
- `syscall_correlate_js` — Correlate captured syscalls with likely JavaScript functions.
- `syscall_filter` — Filter captured syscall events by name, PID, or return value.
- `syscall_get_stats` — Get syscall monitoring statistics.
- `syscall_origin_map` — Build a unified syscall→JS origin map by integrating live CDP call stacks (syscall_stack_capture) with static timing heuristics (syscall_correlate_js). Aggregates recent syscall events by JavaScript function so callers can see which JS f…
- `syscall_pattern_detect` — Scan captured syscall events for behavioral patterns relevant to reverse engineering: anti-debug probes (ptrace / IsDebuggerPresent), system fingerprinting (uname / getuid), filesystem enumeration (openat + getdents), network beaconing (…
- `syscall_trace_compare` — Diff two syscall trace snapshots to find appeared/disappeared syscalls and frequency changes. Useful for understanding what OS calls a JS operation triggers. Capture baseline events → perform the operation → capture target events → pass …
- `tasks_get` — Get the current state of a background task (MCP 2.0 Tasks protocol). Returns status (working/completed/failed/cancelled), progress and message.
- `tasks_list` — List recent background tasks tracked by the server (MCP 2.0 Tasks protocol). Expired tasks are pruned automatically based on their TTL.
- `tasks_result` — Fetch the payload/result of a background task (MCP 2.0 Tasks protocol). Optionally waits (polls) up to waitMs for the task to reach a terminal state.
- `tcp_read_until` — Read from an open TCP session until a delimiter or byte limit is reached.
- `tls_cipher_suites` — List TLS cipher suites with IANA id, protocol, key-exchange / authentication / encryption / MAC split, and AEAD flag (each dimension derived from the suite name).
- `tls_keylog_lookup_secret` — Look up a TLS secret by client random hex from the parsed keylog.
- `tls_keylog_parse` — Parse an SSLKEYLOGFILE and summarize available key material.
- `tls_keylog_summarize` — Summarize an SSLKEYLOGFILE: per-label distribution, secret-type classification (TLS 1.2 master-secret vs TLS 1.3 traffic-secret kinds), TLS version inference, and unique session (client_random) count.
- `tls_parse_certificate` — Parse a TLS Certificate message from raw hex and extract X.509 details (subject/issuer/SAN/validity/keyUsage), SHA-256 fingerprint, and SPKI pin hash (Android Network Security Config / HPKP format).
- `tls_parse_handshake` — Parse TLS handshake metadata from raw hex. For payload decryption, use tls_decrypt_payload with explicit keyHex/nonceHex/authTagHex.
- `tls_probe_endpoint` — Probe a TLS endpoint and report handshake and certificate details.
- `tls_read_until` — Read from an open TLS session until a delimiter or byte limit is reached.
- `trace_get_network_flow` — Get a recorded request-scoped network flow from a trace.
- `trace_get_samples` — Query recorded CPU profile samples. mode=
- `v8_allocation_track` — Track live V8 allocations via CDP HeapProfiler object tracking. Enables the HeapProfiler, calls startTrackingHeapObjects({ trackAllocations: true }) to collect lastSeenObjectId events for a capture window (default 3s), then stopTrackingH…
- `v8_bytecode_decompile` — Decompile or extract strings from V8 bytecode files.
- `v8_bytecode_extract` — Extract V8 bytecode for a script by scriptId, with source fallback.
- `v8_function_retained` — Find all heap objects retained by functions matching a name pattern. Walks the dominator tree to find objects whose constructor/class name matches the given pattern, then returns each with its retainer chain. Useful for understanding whi…
- `v8_heap_diff` — Compare two heap snapshots to find allocation changes.
- `v8_heap_find_leaks` — Find suspected memory leaks in a heap snapshot. Returns leak candidates sorted by confidence, including detached DOM nodes, large arrays, closure leaks, and unexpectedly large retained objects.
- `v8_heap_retainers` — Trace retainer chains from suspect leak objects back to GC roots. For each nodeId, walks the immediate-dominator chain to produce a
- `v8_heap_snapshot_analyze` — Analyze a heap snapshot: class histogram (object count/sizes by constructor), statistics (total objects, detached DOM nodes), optional dominator tree, and leak detection.
- `v8_heap_snapshot_capture` — Capture a V8 heap snapshot for offline analysis. The snapshot is persisted to artifacts/heap-snapshots/ (data + sidecar meta) so it survives a server restart; set persist=false to keep it in-memory only.
- `v8_heap_snapshot_export` — Export a heap snapshot as a complete .heapsnapshot JSON file under artifacts/heap-snapshots/, loadable by the Chrome DevTools Memory panel. The file path is returned; the snapshot content is written to disk, not injected into the respons…
- `v8_heap_snapshot_list` — List V8 heap snapshots — both in-memory (current session) and persisted to artifacts/heap-snapshots/ (survive a server restart). Reports id, capture time, size, source (in-memory/persisted), simulated flag, and expiry status, plus aggreg…
- `v8_heap_stats` — Report V8 heap statistics: used, total, external.
- `v8_object_compare` — Compare heap objects by shallow/retained size, class name, and property count. Same-snapshot mode (objectIds only) does all-pairs comparison (n-choose-2). Cross-snapshot mode (anotherSnapshotId + anotherObjectIds) does pairwise A[i]↔B[i]…
- `v8_object_inspect` — Inspect a live JS object by objectId with property enumeration.
- `v8_version_detect` — Detect V8 engine version, flags, and runtime capabilities.
- `v8_wasm_inspect` — Inspect WebAssembly modules and garbage-collected WASM objects in the page. Discovers .wasm script resources via performance.getEntriesByType, detects WASM GC (struct/array/ref-types) availability, and enumerates feature flags (gc/thread…
- `v8_weakrefs_inspect` — Enumerate WeakRef and FinalizationRegistry instances in the page via Runtime.evaluate. Inspects registered finalization callbacks and live WeakRef targets, reporting how many WeakRefs are dereferenced vs cleared and which FinalizationReg…
- `wasm_capabilities` — Report WASM tool availability.
- `wasm_decompile` — Decompile .wasm bytecode to readable pseudo-code with type info.
- `wasm_detect_obfuscation` — Detect WASM obfuscation: opaque predicates, control-flow flattening, bogus ops.
- `wasm_diff` — Patch-diff two .wasm binaries (original vs. patched) for vulnerability research: disassembles both via wasm2wat and emits a structured function-level diff (added/removed/changed) plus a per-function WAT line-level unified diff. The full …
- `wasm_disassemble` — Disassemble a .wasm binary to WAT text format.
- `wasm_dump` — Dump a captured WebAssembly module from the current page.
- `wasm_inspect` — Pure-TS wasm binary structural inspector (no wabt dependency). Parses the module surface — types, imports, functions (with name-section recovery), tables, memories, globals, exports, start, element/data/code segment counts, and custom se…
- `wasm_inspect_sections` — Parse .wasm section headers: imports, exports, memory, tables, code.
- `wasm_memory_inspect` — Inspect exported WebAssembly.Memory from the current page. Pages often load multiple WASM modules (crypto/DRM/app) — the response always includes totalInstances + an instance inventory; pass instanceIndex to target a specific module.
- `wasm_string_extract` — Extract printable strings from a .wasm binary, grouped by section, with name-section function-name recovery and classification (url/base64/hex-hash/file-path). Wasm-aware alternative to generic binary strings tools.
- `wasm_vmp_trace` — Read captured WASM VMP import-call traces from the current page.
- `webgpu_adapter_info` — Get WebGPU adapter information (vendor, architecture, device). Used for fingerprinting GPU capabilities and detecting hardware-level vulnerabilities.
- `webgpu_capture_commands` — Capture GPU command queue submissions (render passes, compute dispatches). Used for analyzing GPU workload and detecting malicious shader behavior.
- `webgpu_error_capture` — Capture WebGPU validation/out-of-memory/internal errors the target app swallows (via device uncapturederror), plus the current device.lost state. Optionally wraps createBuffer/createTexture in error scopes to attribute failures to specif…
- `webgpu_memory_layout` — Analyze GPU memory allocations and buffer usage. Identifies memory layout patterns that may be vulnerable to side-channel attacks. With track=true, snapshots are stored on the shared state board (webgpu_memory_<canvasId>) and the respons…
- `webgpu_pipeline_dump` — Enumerate active render/compute pipelines, bind-group layouts, and render-pass descriptors by hooking GPUDevice createRenderPipeline / createComputePipeline / createBindGroupLayout (plus async variants). Captures the full descriptor (ver…
- `webgpu_shader_disassemble` — Parse WGSL or SPIR-V shader into AST and generate human-readable disassembly. Used for reverse engineering shader logic. SPIR-V input (hex/base64) is reflected into entry points, bindings, structs, and locations without compilation.
- `webgpu_shader_source_capture` — Capture WGSL shader sources a running app compiles via GPUDevice.createShaderModule — the only artifact revealing what a compute/render pipeline computes (e.g. physics vs. cryptominer). Pairs with webgpu_capture_commands to reconstruct w…
- `webpack_enumerate` — Enumerate webpack modules in current page and search for keywords.
- `webrtc_get_events` — Get messages captured by the WebRTC data-channel monitor. Set fullData=true to include full message data. Filter by channel label and direction (sent/received).
- `webrtc_monitor` — Enable or disable capture of WebRTC data-channel traffic. Wraps RTCPeerConnection in-page (no CDP coverage for RTCDataChannel): intercepts createDataChannel (local channels) and the datachannel event (remote channels), capturing both out…
- `websocket_read_frame` — Read the next queued WebSocket frame from an open session.
- `workflow_run_inspect` — Inspect the global workflow run store: list recent run_extension_workflow / run_macro runs, get a run entry by runId, or fetch the last successful run summary (runId, status, durationMs, stepResultKeys) for a workflow or macro id.
- `workflow_suggest` — Suggest the next extension workflow to run from the chainsWith / prerequisites chain metadata declared by loaded workflows. Pass the workflow ids already executed in this session; the server stays stateless. Candidates chained from an ex…
- `ws_get_connections` — Get tracked WebSocket connections, frame counts, and timing metadata.
- `ws_get_frames` — Get captured WebSocket frames with pagination and payload filter.
- `adb_file_push` — Push a local file to an Android device using normal ADB permissions.
- `android_runtime_dump_session` — Create or inspect a managed Android runtime dump session from Frida/ADB dump artifacts, DEX files, and /proc/PID/maps snapshots.
- `asar_repack` — Pack a directory tree into an Electron ASAR archive (inverse of asar_extract). Walks the input directory and writes a valid .asar (4xUInt32LE pickle prefix + JSON header + data segment) that parseAsarBuffer and Electron accept. Closes th…
- `blackbox_add` — Blackbox scripts (skip during debugging)\n\nUsage:\n- Skip third-party library c...
- `blackbox_add_common` — Blackbox all common libraries (one-click)\n\nIncludes:\n- jquery, react, vue, an...
- `browser_font_fingerprint` — Enumerate locally-installed fonts for fingerprint analysis. Primary path is the Local Font Access API (queryLocalFonts, Chromium 103+); when unavailable or denied, falls back to a small document.fonts.check probe set. Returns the detecte…
- `browser_jsdom_cookies` — Manage cookies on a JSDOM session. Isolated from the attached browser.
- `captcha_config` — Configure CAPTCHA detection sensitivity and solver backend.
- `checksum_apply` — Apply a deterministic 16-bit Internet checksum across a payload slice, optionally zeroing and writing the checksum field back into the packet.
- `complete_task_handoff` — Mark a task handoff as completed.
- `coordination_restore_snapshot` — Restore a saved page snapshot including IndexedDB data. Navigates to the captured URL, re-injects cookies, localStorage, sessionStorage, and IndexedDB records from the snapshot.
- `create_task_handoff` — Create a persisted task handoff for cross-tool coordination.
- `cross_domain_evidence_export` — Export the shared cross-domain evidence graph as JSON.
- `dart_symbolize` — Resolve obfuscated Dart identifiers using a developer-supplied Flutter --save-obfuscation-map JSON (flat, pairs, or object shape).
- `deactivate_tools` — Remove previously activated tools to free context.
- `debugger_disassemble` — Disassemble V8 bytecode / instructions at the current paused location (or a given scriptId). Resolves the target scriptId automatically from the current paused call frame — useful when paused inside obfuscated/VM code to decide whether t…
- `debugger_session` — Manage debugger sessions. Actions: save (persist current session to file), load (restore session from file/JSON), export (export session as JSON string), list (list saved sessions in ./debugger-sessions/).
- `dns_bulk_resolve` — Resolve many hostnames concurrently with per-host status.
- `dns_resolve` — Resolve a hostname to DNS records using the system resolver or an optional DNS server.
- `evidence_export` — Export the reverse evidence graph as JSON snapshot or Markdown report.
- `export_hook_script` — Export generated hook templates as a complete, runnable Frida script.
- `export_trace` — Export a trace database. format=
- `grpc_export_capture` — Export captured gRPC / gRPC-Web calls to artifacts/captures as JSON or NDJSON.
- `instrumentation_artifact` — Manage artifacts captured by instrumentation operations.
- `instrumentation_session_export` — Export an instrumentation session snapshot to an artifacts JSON file.
- `instrumentation_session_merge` — Merge two sessions into a new session: copies operations (with id remapping) and artifacts from both sources. Original sessions are untouched.
- `memory_assemble` — Assemble x64 assembly instructions to machine code bytes (x64dbg inline assembler parity). Uses Keystone assembler via koffi FFI (keystone.dll) if available on Windows, with a built-in fallback opcode table for common instructions (NOP, …
- `memory_audit_export` — Export the in-memory audit trail for memory operations as JSON.
- `memory_bookmark` — Manage address bookmarks for a process. Actions: add (bookmark an address with optional label and color), remove (delete a bookmark), list (show all bookmarks for the PID), clear (remove all bookmarks for the PID). Labels help categorize…
- `memory_freeze_export` — Export all active freeze entries as structured JSON. Returns an array of freeze entries with freezeId, pid, address, value, valueType, intervalMs, and active flag. Optional pid filter to scope the export to a single process. Pure data ex…
- `memory_generate_signature` — Generate an update-resistant AOB (Array-of-Bytes) signature from bytes at a memory address. Detects relative offsets in CALL/JMP/LEA/Jcc instructions and replaces the displacement bytes with wildcards (??), making the signature survive m…
- `memory_patch_undo` — Undo a previous patch by restoring the original bytes.
- `memory_pointer_map` — Save, load, or compare pointer maps for cross-instance filtering (Cheat Engine .PTR parity). save: serialize pointer scan results to a .ptr.json file in <project>/.ptr/. load: deserialize a pointer map from file. compare: load 2+ pointer…
- `memory_register_type` — Register a custom value type for memory scanning (Cheat Engine parity). Registered types can be used as valueType in memory_first_scan, memory_unknown_scan, etc. Types are session-scoped (live as long as the domain handler instance).
- `memory_reverse_mwt` — Reverse memory write trace — given a code address, find what data addresses the instruction accesses. Inverse of memory_find_accesses. Disassembles the instruction at the given address using Capstone, then resolves RIP-relative and absol…
- `memory_structure_export_c` — Export an inferred structure as a C-style struct definition, ReClass.NET XML, Rust #[repr(C)], or C# [StructLayout] with explicit FieldOffset attributes. C export auto-detects composite types (Vector3, Matrix4x4, pointer arrays).
- `memory_type_define` — Override field types in an inferred structure. Actions: set (define a type at offset+size), list (show all overrides), clear (remove all overrides). Overrides are applied in subsequent memory_structure_analyze calls. Supported types: int…
- `memory_write_history` — Undo or redo the last memory write operation. Pass pid to scope the operation to a specific process — per-PID undo prevents reverting an unrelated process
- `nemu_dump_got` — Dump the PLT trampoline → GOT → symbol mapping for an AArch64 ELF shared object. Scans .text for the 4-instruction trampoline pattern (adrp x16 → ldr x17 → add x17,x16,x17 → br x17) used by obfuscated SO files and cross-references each s…
- `nemu_mem_shadow` — Add a shadow memory overlay at a specific address. Reads from shadow take priority over underlying memory — use to provide mock data at addresses that would otherwise crash (e.g. address 0 where SO ELF header resides). Does NOT modify th…
- `nemu_regs_restore` — Restore GPR registers from a previously-saved snapshot (created by nemu_regs_save). Partially restores: only registers that were saved are written back. Use after an obfuscated function call to recover decode/context registers.
- `nemu_regs_save` — Save a named snapshot of current GPR registers (x0-x30, sp). Returns a snapshot id usable with nemu_regs_restore. The snapshot persists until the session is destroyed or the name is overwritten. Use to preserve registers before calling a…
- `nemu_set_pac_key` — Configure the ARMv8.3 Pointer Authentication key set used by PACIA/PACIB/AUTIA/AUTIB/PACGA instructions in this emulator session. Set a 128-bit key (32 hex chars) by key slot (ia/ib/da/db/ga) to match keys dumped from a real device via F…
- `nemu_setup_java_field` — Register a mock Java field the emulated native code reads back via JNI (GetFieldID/GetStaticFieldID + Get<Type>Field). Declaratively specify the value with valueInt, valueString, or valueBytes (base64) — the
- `nemu_setup_java_mock` — Register a mock Java method for JNI callbacks. returnInt/returnString/returnBytes for single constant; returnMap (JSON) for per-key dispatch: first Java arg matched as key→{type,value}. Single-constant is fallback for unmatched keys.
- `nemu_setup_java_mocks` — Batch-register multiple Java method mocks in one call. Each entry in the array has the same fields as nemu_setup_java_mock: className, methodName, signature, plus one return value (returnInt, returnString, returnBytes, returnObject, retu…
- `network_export_har` — Export captured network traffic as HAR.
- `page_script_register` — Register a named reusable JS snippet in the Script Library. Execute with page_script_run.
- `page_upload_files` — Upload one or more local files into an <input type=
- `pcap_write` — Write a compact classic PCAP file from deterministic packet byte records.
- `pcapng_write` — Write a PCAPNG (pcap-ng) capture file from one or more interfaces and deterministic packet byte records. Emits a Section Header Block, an Interface Description Block per interface, and an Enhanced Packet Block per packet.
- `proto_export_schema` — Export a protocol pattern to a schema definition. format: proto (default, .proto-like text), ksy (Kaitai Struct for Wireshark/010 Editor), json-schema (draft-07).
- `proxy_export_ca` — Read the proxy CA certificate.
- `proxy_setup_adb_device` — Configure an Android device to use the proxy.
- `restore_page_snapshot` — Restore a saved page snapshot.
- `save_page_snapshot` — Save current page state.
- `script_replace_persist` — Persistently replace matching script responses.
- `sourcemap_reconstruct_tree` — Reconstruct source files from a source map. When a vendor stripped sourcesContent, set inferMissing=true to emit a best-effort name+position skeleton (from mapping segments) instead of a placeholder. Set emitScopes=true to also decode th…
- `sse_export_capture` — Export captured SSE events to artifacts/captures as JSON or NDJSON.
- `state_board` — CRUD operations on the cross-tool shared state board. TTL contract for set: omitting ttlSeconds defaults to 24h expiry; ttlSeconds: 0 means explicit permanent (no expiry, bounded only by the LRU cap); any other value is honored verbatim.…
- `stealth_generate_fingerprint` — Generate a browser fingerprint.
- `syscall_trace_export` — Export captured syscall events to portable NDJSON with optional time-range filtering and deduplication. Returns both structured array and NDJSON string.
- `tls_cert_pin_bypass` — Return a certificate pinning bypass strategy for the selected platform.
- `tls_keylog_disable` — Disable SSLKEYLOGFILE capture and unset the environment variable.
- `tls_write` — Write data to an open TLS session.
- `update_task_handoff` — Update task handoff status or metadata without completing it.
- `webrtc_export_capture` — Export messages captured by the WebRTC data-channel monitor to artifacts/captures as JSON or NDJSON.
- `websocket_close` — Close an open WebSocket session.
- `workflow_retry_policy` — Configure a global retry policy with exponential backoff for workflow steps. The stored policy is applied by run_extension_workflow / run_macro when individual nodes lack an explicit retry config. Returns the normalised policy.
- `ws_export_capture` — Export captured WebSocket frames to artifacts/captures as JSON or NDJSON.

## Related servers

- UnClick (1662 tools) — https://policylayer.com/tools/io-github-malamutemayhem-unclick-mcp-server.md
- Delx Protocol — Agent Recovery & Continuity (1076 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-protocol.md
- Delx Mcp A2a (1068 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-mcp-a2a.md
- MCP Framework Personal (912 tools) — https://policylayer.com/tools/inggerman-mcps.md
- Nodebench (824 tools) — https://policylayer.com/tools/io-github-homenshum-nodebench.md
- Eda Agent (777 tools) — https://policylayer.com/tools/eda-agent.md
- Delx MCP Server (740 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-mcp-server.md
- Binance MCP Server (734 tools) — https://policylayer.com/tools/nirholas-binance-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-vmoranv-jshookmcp · API: https://policylayer.com/registry/api · Recommended policies for every tool: https://policylayer.com/policies/io-github-vmoranv-jshookmcp