jsreverser-mcp-playbook

Guides MCP-based frontend JavaScript reverse engineering from page observation through local environment rebuilding.

10|3|Updated Aug 10, 2026
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill jsreverser-mcp-playbook-baiqigo
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: jsreverser-mcp-playbook
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/tools/skills/mcp/JSReverser-MCP/skills/jsreverser-mcp-playbook
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill jsreverser-mcp-playbook-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Reverse engineering frontend JavaScript signature and encryption logic often fails because analysts guess at browser environments instead of working from observed evidence. This Skill enforces a disciplined, evidence-first workflow for locating signature chains, capturing runtime data, and reproducing target parameters locally in Node. ## Core Features & Use Cases - Five-Phase Workflow: Structures work into Observe, Capture, Rebuild, Patch, and DeepDive stages so page evidence always precedes local environment patching. - Task-Driven MCP Tool Routing: Directs the agent to the correct reverse-task tools (start_reverse_task, manage_reverse_task, orchestrate_reverse_task, run_reverse_agent, export_portable_bundle) based on user intent. - Environment Patching Discipline: Drives Node environment rebuilding via proxy env logs, first-divergence tracking, and minimal causal-unit patches rather than blind browser simulation. - Use Case: When asked to reproduce a site's request signature (e.g., an h5st or X-Bogus parameter), the agent hooks fetch/xhr in the page, exports a rebuild bundle, patches the Node environment iteratively, and optionally proceeds to AST deobfuscation or VMP instrumentation. ## Quick Start Use the jsreverser-mcp-playbook to reverse engineer the signature generation logic of the target site, starting a new reverse task and following the observe-capture-rebuild-patch workflow.

Frequently Asked Questions about jsreverser-mcp-playbook

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer a JavaScript request signature with MCP tools?

Start a reverse task, observe the page to identify the target request and candidate scripts, then hook fetch/xhr to capture parameter samples. Export a rebuild bundle and patch a local Node environment iteratively using proxy env logs and first-divergence tracking until the signature reproduces.

What is the correct order for JS reverse engineering workflow?

Follow five phases: Observe the page first, Capture runtime samples with hooks, Rebuild a local Node project from exported evidence, Patch the environment one minimal causal unit at a time, then DeepDive into deobfuscation or VMP analysis only after local reproduction works.

Should I use breakpoints or hooks for JavaScript debugging?

Hooks are preferred and breakpoints are a last resort. Start with fetch/xhr hooks, use preload script injection for first-screen initialization logic, and only fall back to breakpoints when hooks cannot explain the critical context.

Why does local Node environment rebuilding fail to reproduce signatures?

Failures usually come from patching without page evidence or guessing browser APIs. Read the proxy env log first, record the current first divergence, apply one minimal patch per iteration, and return to page observation if two consecutive rounds show no progress.

When should AST deobfuscation be performed in reverse engineering?

Deobfuscation belongs to the DeepDive phase after the target parameter already reproduces locally. If the task only needs the signature value, this phase can be skipped; it is required when the algorithm chain must be maintained or reused long-term.