whitenightshadow/camoufox-reverse-mcp — explained in plain English
Analysis updated 2026-08-10 · repo last pushed 2026-07-29
Trace a website's API signing function by capturing network requests and following the JavaScript call stack.
Analyze JSVMP-protected anti-bot code by instrumenting the obfuscated script and logging what it checks.
Log into a target site and intercept the POST request to see how parameters are encrypted.
Record which browser properties an anti-bot script reads without the site detecting it.
| whitenightshadow/camoufox-reverse-mcp | poseljacob/agentic-video-editor | flashml-org/flashlib | |
|---|---|---|---|
| Stars | 413 | 417 | 408 |
| Language | Python | Python | Python |
| Last pushed | 2026-07-29 | — | — |
| Maintenance | Active | — | — |
| Setup difficulty | hard | moderate | moderate |
| Complexity | 4/5 | 3/5 | 4/5 |
| Audience | developer | developer | researcher |
Figures from each repo's GitHub metadata at analysis time.
Requires the Camoufox anti-detection browser, 3 advanced tools need a custom C++ fork of it.
camoufox-reverse-mcp connects AI coding assistants like Cursor or Claude Code to a special anti-detection browser, so the AI can help you reverse-engineer websites. In practical terms, if you've ever needed to figure out how a website generates its API signatures, encrypts parameters, or blocks bots, this tool lets your AI assistant do the heavy lifting, browsing the target site, intercepting network requests, hooking into JavaScript functions, and tracing what the site's code actually does behind the scenes. The way it works is through MCP (Model Context Protocol), a standard that lets AI tools call external utilities. This project exposes 35 such utilities. The AI can launch the Camoufox browser (a modified Firefox that spoofs its fingerprint at the C++ engine level, making it very hard for sites to detect), navigate to pages, inject hooks into specific JavaScript functions, capture and inspect all network traffic, search through the site's script files, and even analyze JSVMP bytecode, the obfuscated virtual-machine code that many Chinese anti-bot systems use. A notable feature is the C++ engine-layer property tracer, which records exactly which browser properties a site's anti-bot script reads, without the site being able to detect that it's being watched. The primary audience is people doing JavaScript reverse engineering, security researchers, scraping engineers, or developers trying to understand how a third-party API signs its requests so they can interoperate with it. The README gives concrete workflows: for example, logging into a site, capturing the POST request, tracing back through the JavaScript call stack to find the signing function, then hooking that function to see its inputs and outputs. Another scenario is analyzing a JSVMP-protected site by instrumenting the obfuscated script at the source level and logging what environment properties it probes. A clear design tradeoff: the project went from 80 tools down to 32 in v1.0.0, stripping out session management and assertion systems to stay a "pure stateless toolset." The philosophy is that the MCP layer just provides tools, memory and workflow management belong in the AI's skill layer or the user's workspace. Some advanced features require a custom fork of the Camoufox browser, but 32 of the 35 tools work without it.
This tool connects AI coding assistants like Cursor or Claude to an anti-detection browser, letting the AI browse websites, intercept network traffic, and trace JavaScript code to help you reverse-engineer how a site works.
Mainly Python. The stack also includes Python, Camoufox, MCP.
Active — commit in last 30 days (last push 2026-07-29).
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly developer.
This repo across BitVibe Labs
Don't trust strangers blindly. Verify against the repo.