gitwtfhub

wtf is camoufox-reverse-mcp?

whitenightshadow/camoufox-reverse-mcp — explained in plain English

Analysis updated 2026-08-10 · repo last pushed 2026-07-29

413PythonAudience · developerComplexity · 4/5ActiveSetup · hard

TL;DR

This tool connects AI coding assistants like Cursor or Claude to an anti-detection browser, letting the AI browse websites, intercept network traffic, and trace JavaScript code to help you reverse-engineer how a site works.

Mindmap

mindmap
  root((repo))
    What it does
      Anti-detection browser
      Network interception
      JavaScript hooking
    Tech stack
      Python
      Camoufox browser
      MCP protocol
    Use cases
      API signature analysis
      Bot detection research
      Encrypted parameter tracing
    Audience
      Security researchers
      Scraping engineers
      API developers
    Design
      Stateless toolset
      35 MCP utilities
      Optional custom fork

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Why would anyone build with this?

REASON 1

Trace a website's API signing function by capturing network requests and following the JavaScript call stack.

REASON 2

Analyze JSVMP-protected anti-bot code by instrumenting the obfuscated script and logging what it checks.

REASON 3

Log into a target site and intercept the POST request to see how parameters are encrypted.

REASON 4

Record which browser properties an anti-bot script reads without the site detecting it.

What's in the stack?

PythonCamoufoxMCPFirefox

How it stacks up

whitenightshadow/camoufox-reverse-mcpposeljacob/agentic-video-editorflashml-org/flashlib
Stars413417408
LanguagePythonPythonPython
Last pushed2026-07-29
MaintenanceActive
Setup difficultyhardmoderatemoderate
Complexity4/53/54/5
Audiencedeveloperdeveloperresearcher

Figures from each repo's GitHub metadata at analysis time.

How do you spin it up?

Difficulty · hard Time to first run · 1h+

Requires the Camoufox anti-detection browser, 3 advanced tools need a custom C++ fork of it.

Wtf does this do

camoufox-reverse-mcp connects AI coding assistants like Cursor or Claude Code to a special anti-detection browser, so the AI can help you reverse-engineer websites. In practical terms, if you've ever needed to figure out how a website generates its API signatures, encrypts parameters, or blocks bots, this tool lets your AI assistant do the heavy lifting, browsing the target site, intercepting network requests, hooking into JavaScript functions, and tracing what the site's code actually does behind the scenes. The way it works is through MCP (Model Context Protocol), a standard that lets AI tools call external utilities. This project exposes 35 such utilities. The AI can launch the Camoufox browser (a modified Firefox that spoofs its fingerprint at the C++ engine level, making it very hard for sites to detect), navigate to pages, inject hooks into specific JavaScript functions, capture and inspect all network traffic, search through the site's script files, and even analyze JSVMP bytecode, the obfuscated virtual-machine code that many Chinese anti-bot systems use. A notable feature is the C++ engine-layer property tracer, which records exactly which browser properties a site's anti-bot script reads, without the site being able to detect that it's being watched. The primary audience is people doing JavaScript reverse engineering, security researchers, scraping engineers, or developers trying to understand how a third-party API signs its requests so they can interoperate with it. The README gives concrete workflows: for example, logging into a site, capturing the POST request, tracing back through the JavaScript call stack to find the signing function, then hooking that function to see its inputs and outputs. Another scenario is analyzing a JSVMP-protected site by instrumenting the obfuscated script at the source level and logging what environment properties it probes. A clear design tradeoff: the project went from 80 tools down to 32 in v1.0.0, stripping out session management and assertion systems to stay a "pure stateless toolset." The philosophy is that the MCP layer just provides tools, memory and workflow management belong in the AI's skill layer or the user's workspace. Some advanced features require a custom fork of the Camoufox browser, but 32 of the 35 tools work without it.

Yoink these prompts

Prompt 1
Using the camoufox-reverse-mcp tools, navigate to a target website, capture all network traffic on login, and trace the JavaScript call stack to find the function that generates the API signature.
Prompt 2
Using the JSVMP bytecode analysis tool, instrument an obfuscated anti-bot script on a target page and log which browser environment properties it probes.
Prompt 3
Launch the Camoufox browser via MCP, hook into a specific JavaScript function on the page, and log its inputs and outputs so I can understand how it encrypts parameters.
Prompt 4
Use the C++ engine-layer property tracer to record exactly which browser properties a site's anti-bot script reads without triggering detection.
Prompt 5
Using the script search tool, find where the target site defines its request signing logic, then hook that function to capture the signing inputs and outputs.

Frequently asked questions

wtf is camoufox-reverse-mcp?

This tool connects AI coding assistants like Cursor or Claude to an anti-detection browser, letting the AI browse websites, intercept network traffic, and trace JavaScript code to help you reverse-engineer how a site works.

What language is camoufox-reverse-mcp written in?

Mainly Python. The stack also includes Python, Camoufox, MCP.

Is camoufox-reverse-mcp actively maintained?

Active — commit in last 30 days (last push 2026-07-29).

How hard is camoufox-reverse-mcp to set up?

Setup difficulty is rated hard, with roughly 1h+ to a first successful run.

Who is camoufox-reverse-mcp for?

Mainly developer.

View the repo → Decode another repo

This repo across BitVibe Labs

Don't trust strangers blindly. Verify against the repo.