Back to MCP Trust Indexm8ven
46
/ 100
1 month ago
glama

JS Reverse Strong MCP

Standardizes front-end JavaScript reverse engineering workflows by providing tools for browser observation, runtime sampling, hooking, debugging, network analysis, and local environment reproduction.

→ lwjjike/JSReverser-Strong-MCP· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 15 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 4 credentials: ANTHROPIC_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY, SESSION_STATE_ENCRYPTION_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies15 high12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.13.5GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.13.5GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.13.5GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

highaxios@1.13.5GHSA-777c-7fjr-54vf

Allocation of Resources Without Limits or Throttling in Axios

highaxios@1.13.5GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretANTHROPIC_API_KEY— "your_key"
configANTHROPIC_BASE_URL
configANTHROPIC_MODEL— "claude-3-5-sonnet-20241022"
configBROWSER_CHANNEL
configBROWSER_EXECUTABLE_PATH
configBROWSER_HEADLESS
configBROWSER_ISOLATED
configDEFAULT_LLM_PROVIDER— "anthropic"
🔐 secretGEMINI_API_KEY— gemini 支持两种模式：有 时走 API；没有时会尝试走 GEMINI_CLI_PATH
configGEMINI_CLI_PATH— gemini-cli
configGEMINI_MODEL— gemini-2.0-flash-exp
configLOG_LEVEL
🔐 secretOPENAI_API_KEY
configOPENAI_BASE_URL
configOPENAI_MODEL
configREMOTE_DEBUGGING_PORT
configREMOTE_DEBUGGING_URL
configRUN_BROWSER_TESTS
configRUN_E2E_TESTS
configRUN_GEMINI_CLI_TESTS
configRUN_PERF_TESTS
configSESSION_STATE_CLEANUP_INTERVAL_MS
🔐 secretSESSION_STATE_ENCRYPTION_KEY
configSESSION_STATE_TTL_MS
configUSE_STEALTH_SCRIPTS
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/lwjjike-jsreverser-strong-mcp-1fzi14)](https://m8ven.ai/mcp/lwjjike-jsreverser-strong-mcp-1fzi14)
commit: c211f07345d2b563aa3c385f63de5711c2bfed3d
code hash: 6f581aab7a8a0efb9bbb974c509bc2299cac1cdeac9b48cb6850a70a71808eb5
verified: 6/10/2026, 10:24:37 AM
view raw JSON →