api_probe_batch
Probe multiple API endpoints in batch mode
append_session_insight
Append a session insight.
arp_build
Build a deterministic ARP payload for Ethernet/IPv4 style address resolution packets.
asar_extract
Extract files from an Electron ASAR archive.
asar_search
Search text inside an ASAR archive.
ast_transform_apply
Apply transforms to input code or a live page scriptId.
ast_transform_chain
Create and store an in-memory transform chain.
ast_transform_preview
Preview an AST transformation before applying it
binary_decode
Decode binary payloads into hex, utf8, or json output
binary_detect_format
Detect binary payload format and encoding signals.
binary_encode
Encode utf8/hex/json input into base64/hex/url output
binary_entropy_analysis
Compute entropy and byte frequency for a payload.
binary_instrument_capabilities
Report binary instrumentation backend availability.
blackbox_add
Add a script to the debugger blackbox list to skip during stepping
blackbox_add_common
Add common library scripts to the blackbox list (jQuery, React, etc.)
blackbox_list
List all blackboxed patterns
breakpoint
Set, remove, or list breakpoints in JavaScript code
browse_extension_registry
Browse the remote jshookmcp extension registry
browser_attach
Attach to a running browser via CDP.
browser_attach_cdp_target
Attach to a CDP target by targetId.
browser_close
Close browser.
browser_detach_cdp_target
Detach the current CDP target session.
browser_evaluate_cdp_target
Evaluate JS in the attached CDP target.
browser_jsdom_cookies
Manage cookies on a JSDOM session. Isolated from the attached browser.
browser_jsdom_execute
Evaluate JS inside a JSDOM session.
browser_jsdom_parse
Parse HTML into an in-memory JSDOM session. No browser needed.
browser_jsdom_query
Query a JSDOM session with a CSS selector.
browser_jsdom_serialize
Serialize a JSDOM session to HTML.
browser_launch
Launch or connect to a browser.
browser_list_cdp_targets
List CDP targets.
browser_list_tabs
List open tabs.
browser_select_tab
Switch active tab.
browser_status
Browser status.
call_graph_analyze
Analyze runtime function call graph from in-page traces
camoufox_geolocation
Get geolocation for a locale.
camoufox_server
Manage Camoufox WebSocket server.
canvas_engine_fingerprint
Detect Canvas API fingerprinting techniques used by the page
canvas_pick_object_at_point
Pick and inspect a canvas object at specific coordinates
canvas_scene_dump
Extract the full scene tree / display list from a detected canvas engine
canvas_trace_click_handler
Trace a click event through DOM events, engine dispatch, and JS call stack to...
captcha_config
Configure CAPTCHA detection and auto-handling.
captcha_detect
Detect CAPTCHA on the page.
captcha_solver_capabilities
Report CAPTCHA solving mode availability.
captcha_vision_solve
Solve a CAPTCHA with manual flow or a configured external service.
captcha_wait
Wait for manual CAPTCHA solve.
check_debug_port
Check if the target process has a debug port open
checksum_apply
Apply checksum calculation to a network packet
cleanup_artifacts
Clean generated artifacts using age and size retention rules
clear_all_caches
Clear all internal caches. Destructive — prefer smart_cache_cleanup
clear_collected_data
Clear collected script data, caches, and in-memory indexes
collect_code
Collect JavaScript from a target website in summary, priority, incremental, o...
complete_task_handoff
Complete a task handoff.
console_buffers
Manage injected interceptor state.
console_execute
Execute a JavaScript expression in the browser console and return the result
console_get_exceptions
Get captured uncaught exceptions from the page
console_get_logs
Get captured console logs.
console_inject
Inject an in-page script, XHR, fetch, or function monitor.
console_inject_fetch_interceptor
Inject a fetch interceptor.
console_inject_xhr_interceptor
Inject an XMLHttpRequest interceptor.
console_monitor
Enable or disable console monitoring.
create_task_handoff
Create an in-session task handoff.
cross_domain_capabilities
List cross-domain capabilities and workflows.
cross_domain_correlate_all
Run cross-domain evidence correlation across all collected data
cross_domain_evidence_export
Export the shared cross-domain evidence graph as JSON.
cross_domain_evidence_stats
Get node and edge statistics for the shared cross-domain evidence graph.
cross_domain_health
Report cross-domain health.
cross_domain_suggest_workflow
Suggest a cross-domain workflow for a goal.
crypto_compare
Compare two crypto implementations against identical test vectors.
crypto_extract_standalone
Extract cryptographic constants and algorithms from binary data
crypto_test_harness
Run a cryptographic test harness to verify extracted algorithms
debugger_evaluate
Evaluate an expression in the current debugger frame context
debugger_get_paused_state
Get the current paused state (check if debugger is paused and why)
debugger_lifecycle
Manage the debugger lifecycle (enable or disable)
debugger_pause
Pause execution at the next statement
debugger_resume
Resume execution (continue)
debugger_session
Manage debugger session lifecycle (pause, resume, stop)
debugger_step
Step through debugger execution (over, into, out)
debugger_wait_for_paused
Wait for the debugger to pause (useful after setting breakpoints and triggering code)
deobfuscate
Run webcrack-powered JavaScript deobfuscation with bundle unpacking.
detect_crypto
Detect cryptographic algorithms and usage patterns in source code
detect_obfuscation
Detect obfuscation techniques in JavaScript source
diff_heap_snapshots
Compare two heap snapshots from a trace.
doctor_environment
Run environment doctor for dependencies, bridge endpoints, and platform limitations
electron_attach
Attach to an Electron CDP port and optionally evaluate in a matching page.
electron_check_fuses
Read Electron fuse states.
electron_debug_status
Check status of dual-CDP debug sessions launched by electron_launch_debug.
electron_inspect_app
Inspect an Electron app structure.
electron_ipc_sniff
Monitor Electron IPC via renderer-side hooks.
electron_launch_debug
Launch Electron with main and renderer CDP ports.
electron_patch_fuses
Patch Electron fuse states.
electron_scan_userdata
Scan a directory for Electron JSON userdata files.
enumerate_modules
List all loaded modules (DLLs) in a process with their base addresses.
ethernet_frame_build
Build a custom Ethernet frame with specified parameters
evidence_chain
Get full provenance chain from a node ID in specified direction
evidence_export
Export the reverse evidence graph as JSON snapshot or Markdown report.
evidence_query
Query collected evidence with flexible filtering and grouping
execute_sandbox_script
Execute a JavaScript script in an isolated sandbox environment
export_hook_script
Export generated hook templates as a complete, runnable Frida script.
export_trace
Export a trace database to Chrome Trace Event JSON.
extension_execute_in_context
Load an extension and execute a named exported context function
extension_list_installed
List installed extensions from the local extension registry
extension_reload
Reload an installed extension by unloading and loading it again
extension_uninstall
Uninstall an extension from the local extension registry
extract_function_tree
Extract a function and its dependency tree from collected scripts
framework_state_extract
Extract framework component state.
frida_attach
Attach Frida to a local target and open a session.
frida_detach
Detach from a Frida session and clean up resources.
frida_enumerate_functions
Enumerate exported functions for a specific module in a Frida session.
frida_enumerate_modules
Enumerate modules for an attached Frida session.
frida_find_symbols
Search for symbols matching a pattern in a Frida session using ApiResolver.
frida_generate_script
Generate a Frida hook script from a template.
frida_list_sessions
List all active Frida sessions.
frida_run_script
Run a JavaScript script in the context of an attached Frida session
generate_hooks
Generate a Frida interceptor script for a list of symbols.
get_all_scripts
List all loaded scripts.
get_available_plugins
List installed binary analysis plugins.
get_cache_stats
Get cache statistics: entries, sizes, hit rates, and cleanup recommendations
get_call_stack
Get the current call stack (only available when paused at a breakpoint)
get_collection_stats
Get collection, cache, and compression statistics
get_detailed_data
Retrieve large data by detailId.
get_object_properties
Get all properties of an object (when paused, use objectId from variables)
get_scope_variables_enhanced
Get enhanced scope variable information at current debugger position
get_script_source
Get source code of a script.
get_task_context
Read task handoff context.
get_token_budget_stats
Get token budget usage stats, warnings, and optimization suggestions
ghidra_analyze
Analyze a binary and return metadata.
ghidra_bridge
Send an action to a Ghidra bridge server.
ghidra_decompile
Decompile a specific function using Ghidra headless analysis.
graphql_extract_queries
Extract GraphQL queries/mutations from captured network traces
graphql_introspect
Run GraphQL introspection query against a target endpoint
graphql_replay
Replay a GraphQL operation with optional variables via in-page fetch
hook_preset
Apply predefined hook presets for common libraries and frameworks
http2_frame_build
Build a raw HTTP/2 frame.
http2_probe
Probe an HTTP/2 endpoint.
http_plain_request
Send a raw HTTP request over plain TCP.
http_request_build
Build a raw HTTP/1.x request payload.
human_mouse
Move mouse along a Bezier curve with jitter.
human_scroll
Scroll with human-like speed variation.
human_typing
Type text with human-like speed and occasional typos.
icmp_echo_build
Build an ICMP echo request/reply packet
ida_bridge
Send an action to an IDA bridge server.
ida_decompile
Decompile a function using IDA Pro via plugin bridge.
indexeddb_dump
Dump IndexedDB contents.
inject_dll
Inject a DLL into the target process
inject_shellcode
Inject and execute shellcode in a target process.
install_extension
Install an extension from the remote registry via git
instrumentation_artifact
Manage artifacts captured by instrumentation operations.
instrumentation_hook_preset
Apply hook presets inside an instrumentation session.
instrumentation_network_replay
Replay a captured network request inside an instrumentation session.
instrumentation_operation
Manage operations inside an instrumentation session.
instrumentation_session
Manage instrumentation sessions.
jadx_decompile
Decompile an APK class or method using JADX via plugin bridge.
js_analyze_vm
Analyze JSVMP/VM interpreter structure: dispatch type, handler table, opcode map.
js_bundle_search
Search JavaScript bundle contents by keyword or pattern
js_deobfuscate_jsvmp
Deobfuscate JSVMP (JavaScript Virtual Machine Protection) encoded JavaScript
js_deobfuscate_pipeline
Three-stage deobfuscation pipeline: preprocess → deobfuscate → humanize.
js_heap_search
Search JS heap for strings matching a pattern.
js_solve_constraints
Solve opaque predicates and constant expressions in obfuscated code.
list_extension_workflows
List available browser extension automation workflows
list_extensions
List all loaded plugins, workflows, and extension tools
list_macros
List all available macros (built-in + user-defined)
list_page_snapshots
List saved page snapshots.
llm_suggest_names
Use client LLM (via MCP sampling) to suggest meaningful names for obfuscated ...
manage_hooks
Create, inspect, and clear JavaScript runtime hooks
manual_token_cleanup
Clear stale entries and reset counters to free 10-30% of token budget
memory_anticheat_detect
Detect anti-cheat mechanisms in the target process
memory_audit_export
Export the in-memory audit trail for memory operations as JSON.
memory_batch_write
Write multiple memory patches at once.
memory_breakpoint
Set hardware or software memory breakpoints on addresses
memory_check_protection
Check memory protection flags at a specific address.
memory_code_caves
Find code caves (free space) in a process memory region
memory_dump
Dump a range of memory from the target process
memory_dump_region
Dump a memory region to a file for analysis.
memory_first_scan
Start a new memory scan session.
memory_freeze
Freeze a memory address to prevent value changes
memory_group_scan
Search for multiple values at known offsets simultaneously.
memory_guard_pages
List and manage memory guard pages in the target process
memory_heap_anomalies
Detect heap anomalies like corruption, leaks, or overflows
memory_heap_enumerate
Enumerate heap blocks and allocations in process memory
memory_heap_stats
Get heap statistics including allocation counts and sizes
memory_inline_hook_detect
Detect inline hooks (detours) in process memory
memory_integrity_check
Verify memory integrity by checking for unexpected modifications
memory_list_regions
List all memory regions in a process with protection flags.
memory_next_scan
Narrow an existing scan session.
memory_patch_bytes
Patch specific bytes at a memory address
memory_patch_nop
NOP out (neutralize) instructions at a memory address
memory_patch_undo
Undo a previous patch by restoring the original bytes.
memory_pe_headers
Parse PE headers from a loaded module in process memory
memory_pe_imports_exports
List imported and exported functions from a PE module
memory_pointer_chain
Follow pointer chains in process memory for structure traversal
memory_pointer_scan
Find pointers to a target address.
memory_read
Read memory from a process at a specific address. Requires elevated privileges.
memory_scan
Scan process memory for a pattern or value. Requires elevated privileges.
memory_scan_filtered
Scan memory within a filtered set of addresses (secondary scan).
memory_scan_session
Create and manage memory scan sessions for pattern searching
memory_speedhack
Apply speed hack to a process by manipulating timing
memory_structure_analyze
Analyze memory at an address to infer data structure layout.
memory_structure_compare
Compare two memory snapshots to find differences
memory_structure_export_c
Export memory structure definitions as C header code
memory_unknown_scan
Start an unknown initial value scan.
memory_vtable_parse
Parse C++ vtable structures from process memory
memory_write
Write data to process memory at a specific address. Requires elevated privileges.
memory_write_history
Undo or redo the last memory write operation.
memory_write_value
Write a value of specified type to a memory address
miniapp_pkg_analyze
Analyze an unpacked miniapp package.
miniapp_pkg_scan
Scan local directories for miniapp package files.
miniapp_pkg_unpack
Unpack a miniapp package.
mojo_decode_message
Decode a Mojo IPC hex payload into a structured field map
mojo_ipc_capabilities
Report Mojo IPC monitoring availability.
mojo_list_interfaces
List discovered Mojo IPC interfaces and their pending message counts
mojo_messages_get
Retrieve captured Mojo IPC messages from the active monitoring session
mojo_monitor
Start or stop Mojo IPC monitoring for the active Chromium-based target.
native_bridge_status
Check native bridge backend health.
native_symbol_sync
Export native symbols through a bridge server.
network_bot_detect_analyze
Analyze captured requests for bot-detection signals.
network_disable
Disable network request monitoring
network_enable
Enable network request monitoring.
network_export_har
Export captured network traffic as HAR.
network_extract_auth
Extract authentication data from captured network requests.
network_get_requests
Get captured network requests.
network_get_response_body
Get the response body for a captured request.
network_get_stats
Get network statistics.
network_get_status
Get network monitoring status.
network_icmp_probe
Run an ICMP echo probe.
network_intercept
Manage network interception rules.
network_monitor
Manage network request monitoring.
network_replay_request
Replay a captured network request with optional changes.
network_rtt_measure
Measure round-trip time to a target URL.
network_tls_fingerprint
Compute TLS/HTTP fingerprint hashes for bot detection.
network_traceroute
Run an ICMP traceroute.
page_back
Go back in history
page_click
Click an element.
page_cookies
Manage page cookies. Clear requires expectedCount (call get first).
page_emulate_device
Emulate a mobile device.
page_evaluate
Evaluate a JavaScript expression in the page context and return the result
page_forward
Go forward in history
page_hover
Hover over an element.
page_inject_script
Inject JS into the page.
page_local_storage
Manage localStorage.
page_navigate
Navigate to a URL.
page_press_key
Press a keyboard key.
page_reload
Reload current page
page_screenshot
Take a screenshot.
page_script_register
Register a script to be injected into page context
page_script_run
Run a registered script in the page context
page_scroll
Scroll the page.
page_select
Select option(s) in a <select> element.
page_set_viewport
Set viewport size.
page_type
Type text into an element.
page_upload_files
Upload one or more local files into an <input type="file"> element.
page_wait_for_selector
Wait for an element to appear.
payload_mutate
Apply deterministic byte-level mutations to a hex payload.
payload_template_build
Build a deterministic payload from field definitions.
pcap_read
Read and parse a pcap capture file
pcap_write
Write a compact classic PCAP file from deterministic packet byte records.
performance_coverage
Start or stop code coverage recording.
performance_get_metrics
Get page performance metrics.
performance_take_heap_snapshot
Take a V8 heap memory snapshot
performance_trace
Start or stop a Chrome performance trace.
platform_capabilities
Report platform tool backend availability.
process_check_debug_port
Check if a process has a debug port enabled for CDP attachment.
process_launch_debug
Launch an executable with remote debugging port enabled.
process_windows
Get all window handles for a process.
profiler_cpu
Start or stop CPU profiling.
profiler_heap_sampling
Start or stop heap allocation sampling.
proto_auto_detect
Auto-detect a protocol pattern from one or more hex payload samples
proto_define_pattern
Define a protocol pattern with delimiter, byte order, and field layout
proto_export_schema
Export a protocol pattern to a .proto-like schema definition
proto_fingerprint
Identify protocol type from hex payload samples (TLS, HTTP, DNS, WebSocket, SSH).
proto_infer_fields
Infer likely protocol fields from repeated hex payload samples
proto_infer_state_machine
Infer a protocol state machine from captured message sequences
proto_visualize_state
Generate a Mermaid state diagram from a protocol state machine definition
protobuf_decode_raw
Decode base64 protobuf bytes without schema using wire-type aware recursive parser
proxy_add_rule
Add a proxy rule.
proxy_clear_logs
Clear captured proxy logs.
proxy_export_ca
Read the proxy CA certificate.
proxy_get_requests
Read captured proxy requests.
proxy_setup_adb_device
Configure an Android device to use the proxy.
proxy_start
Start the local HTTP/HTTPS proxy.
proxy_status
Read proxy status and CA path.
proxy_stop
Stop the proxy.
query_trace_sql
Query collected trace data using SQL-like syntax for filtering and analysis
raw_ip_packet_build
Build a deterministic IPv4 or IPv6 packet.
reload_extensions
Reload plugins and workflows from configured directories
reset_token_budget
Hard-reset all token budget counters. Destructive — prefer manual_token_cleanup
restore_page_snapshot
Restore a saved page snapshot.
run_extension_workflow
Execute a browser extension automation workflow
run_macro
Execute a recorded or predefined macro for browser automation replay
save_page_snapshot
Save current page state.
script_replace_persist
Persistently replace matching script responses via request interception
search_in_scripts
Search collected scripts by keyword or regex pattern
seek_to_timestamp
Reconstruct trace state at a specific timestamp.
smart_cache_cleanup
Evict LRU and stale entries while preserving hot data
sourcemap_discover
Discover source maps on the current page.
sourcemap_fetch_and_parse
Parse a source map.
sourcemap_parse_v4
Parse source map with ECMA-426 v4 scope/debug-id support; falls back to v3.
sourcemap_reconstruct_tree
Reconstruct source files from a source map.
sse_get_events
Get captured SSE events with filters and pagination
sse_monitor_enable
Enable SSE monitoring by injecting EventSource interceptor
start_trace_recording
Start trace recording into a SQLite database.
state_board
Manage shared state board entries.
state_board_io
Export or import state board entries.
state_board_watch
Start, poll, or stop shared state board watches.
stealth_configure_jitter
Configure CDP timing jitter.
stealth_generate_fingerprint
Generate a browser fingerprint.
stealth_inject
Inject stealth scripts.
stealth_set_user_agent
Set User-Agent and fingerprint.
stealth_verify
Run anti-detection checks.
stop_trace_recording
Stop trace recording and return the final session summary.
summarize_trace
Generate a compact summary of a trace database.
syscall_capture_events
Capture syscall events from the active or last monitoring session.
syscall_correlate_js
Correlate captured syscalls with likely JavaScript functions.
syscall_ebpf_trace
Trace syscalls via Linux eBPF/bpftrace. Requires root or CAP_BPF.
syscall_filter
Filter captured syscall events by syscall name.
syscall_get_stats
Get syscall monitoring statistics.
syscall_start_monitor
Start syscall monitoring using ETW, strace, or dtrace.
syscall_stop_monitor
Stop syscall monitoring.
tab_workflow
Cross-tab coordination.
tls_cert_pin_bypass
Bypass TLS certificate pinning on the target
tls_decrypt_payload
Decrypt a TLS payload using captured key material
tls_keylog_disable
Disable TLS key logging
tls_keylog_enable
Enable TLS key logging for intercepted connections
tls_keylog_lookup_secret
Look up a specific TLS session secret by label
tls_keylog_parse
Parse captured TLS key log entries
tls_keylog_summarize
Summarize TLS key log data with connection statistics
tls_parse_handshake
Parse and analyze a TLS handshake message
trace_get_network_flow
Get a recorded request-scoped network flow from a trace.
trace_recording
Start or stop trace recording into a SQLite database.
understand_code
Run semantic code analysis for structure, behavior, and risks
unidbg_call
Call a JNI function in a running Unidbg emulator session.
unidbg_emulate
Emulate a native function with Unidbg when available.
unidbg_launch
Launch a shared library in Unidbg.
unidbg_trace
Get an execution trace from an Unidbg session (full/basic/instruction modes).
v8_bytecode_decompile
Decompile or extract strings from V8 bytecode files.
v8_bytecode_extract
Attempt V8 bytecode extraction for a script
v8_heap_diff
Diff two V8 heap snapshots
v8_heap_snapshot_analyze
Analyze a captured V8 heap snapshot
v8_heap_snapshot_capture
Capture a V8 heap snapshot
v8_heap_stats
Read V8 heap usage
v8_jit_inspect
Inspect JIT status for a V8 script
v8_object_inspect
Inspect a live JS object by object identifier
v8_version_detect
Detect V8 version and capabilities
wasm_capabilities
Report WASM tool availability.
wasm_decompile
Decompile a .wasm file to pseudo-code.
wasm_detect_obfuscation
Detect obfuscation patterns in a .wasm file.
wasm_disassemble
Disassemble a .wasm file to WAT.
wasm_dump
Dump a captured WebAssembly module from the current page.
wasm_inspect_sections
Inspect sections and metadata of a .wasm file.
wasm_instrument_trace
Generate a JS instrumentation wrapper for a .wasm module.
wasm_memory_inspect
Inspect exported WebAssembly.Memory from the current page.
wasm_offline_run
Run an exported .wasm function.
wasm_optimize
Optimize a .wasm file.
wasm_to_c
Convert a .wasm file to C source and header.
wasm_vmp_trace
Read captured WASM VMP import-call traces from the current page.
watch
Watch a variable or expression for changes during debugging
webcrack_unpack
Run webcrack bundle unpacking and return extracted module graph
webhook
Register and manage webhooks for event notifications
webpack_enumerate
Enumerate webpack modules in current page and search for keywords
widget_challenge_solve
Solve a widget challenge with hook, manual, or configured external service.
ws_get_connections
Get tracked WebSocket connections and frame counts
ws_get_frames
Get captured WebSocket frames with pagination and payload filter
ws_monitor
Enable or disable WebSocket frame capture via CDP Network events.