crypto-reverse-mcp

The missing "last mile" of JS reverse engineering. A Model Context Protocol (MCP) server that detects cryptographic algorithms, identifies obfuscation, reconstructs standalone implementations, generates SDKs, and bypasses anti-debugging — designed to complement browser-debugging MCP servers like js-reverse-mcp.

English | 中文

Why this exists

Existing JS-reverse MCP servers focus on browser debugging (breakpoints, network capture, script analysis). They help you find the encryption function. But they don't answer:

• What algorithm is this? (AES? SM2? custom?)
• Where does the key come from? (static? derived? from server?)
• How do I reproduce it in Python?
• How do I generate a complete SDK?
• How do I bypass the anti-debugging that blocks my breakpoints?

crypto-reverse-mcp fills these gaps. It's a complement, not a replacement — pair it with js-reverse-mcp for the full workflow:

js-reverse-mcp:  open page → find script → set breakpoint → capture I/O
crypto-reverse-mcp: identify algorithm → extract key → reconstruct Python → generate SDK

Features

Tool	What it does
detect_crypto	Identify AES/DES/RSA/SM2/SM3/SM4/HMAC/MD5/SHA + key/IV source + cipher mode
identify_obfuscation	Detect webpack/JSFuck/AAEncode/obfuscator.io/packer/control-flow-flattening
extract_crypto_constants	Find S-boxes, initial hash values, round constants, curve parameters
reconstruct_algorithm	Generate standalone Python/Node implementation from JS source + samples
generate_sdk	Produce complete Python/Node/Go SDK with signing, login, error handling
bypass_anti_debug	Generate injection scripts to neutralize debugger loops, devtools detection, timing checks

Quick Start

Claude Desktop / Cursor / VS Code Copilot

{
  "mcpServers": {
    "crypto-reverse": {
      "command": "npx",
      "args": ["-y", "crypto-reverse-mcp@latest"]
    }
  }
}

Claude Code

claude mcp add crypto-reverse -- npx -y crypto-reverse-mcp@latest

Codex CLI

codex mcp add crypto-reverse -- npx -y crypto-reverse-mcp@latest

VS Code Copilot

code --add-mcp '{"name":"crypto-reverse","command":"npx","args":["-y","crypto-reverse-mcp@latest"]}'

Requirements

• Node.js 18+

Tool Details

detect_crypto

Input: JS source code (string)

Output: List of detected crypto usages with:

• Algorithm name (AES, RSA, SM2, SM3, SM4, MD5, SHA-1, SHA-256, HMAC, PBKDF2, etc.)
• Category (symmetric / asymmetric / hash / mac / kdf / encoding)
• Library (CryptoJS, JSEncrypt, sm-crypto, node-forge, jsrsasign, WebCrypto, Node crypto)
• Location (line:column) + code snippet
• Confidence score (0-100%)
• Key source (static string / variable / localStorage / cookie / app config)
• IV source (for symmetric ciphers)
• Cipher mode (CBC/ECB/GCM/CTR/CFB/OFB)
• Padding (Pkcs7/ZeroPadding/NoPadding)

Detection methods:

1. Library API patterns (50+ regex patterns)
2. Web Crypto API / Node crypto module calls
3. Crypto constants (AES S-box, SHA-256 initial hash, SM3 IV, SM4 S-box, DES S-box, etc.)
4. Function name heuristics

identify_obfuscation

Input: JS source code

Output: Obfuscation type + confidence + unpack strategy

Detects: webpack-bundle, obfuscator.io, JSFuck, AAEncode, JJEncode, dean-edwards-packer, eval-loader, control-flow-flattening, string-array, dead-code-injection, minified, terser-minified

Each detection includes:

• Confidence score
• Evidence (what pattern matched)
• Unpack hint (how to approach unpacking)
• Deobfuscation strategy (step-by-step)
• Recommended tools

extract_crypto_constants

Input: JS source code

Output: List of found crypto constants

Detects:

• AES S-box / Inverse S-box / Rcon
• SHA-256 initial hash values + round constants
• SHA-1 initial hash values
• MD5 initial values + T-constants
• SM3 IV + Tj constants
• SM4 S-box + FK + CK constants
• DES S-box + IP permutation
• SM2 / NIST P-256 curve parameters
• CRC32 polynomial
• Base64 alphabet

reconstruct_algorithm

Input: JS source code + optional input/output samples + target language

Output: Self-contained Python or Node implementation

How it works:

1. Detects algorithm type from source patterns
2. Extracts parameters (key, IV, mode, padding)
3. Generates implementation using standard libraries (pycryptodome, gmssl)
4. If samples provided, includes verification code

Supported algorithms: AES (CBC/ECB/GCM/CTR), DES, TripleDES, MD5, SHA-1, SHA-256, HMAC-SHA256, HMAC-MD5, RSA (PKCS1), SM2, SM3, SM4, Base64

generate_sdk

Input: API specification (URL, method, headers, sign spec, login spec) + target language

Output: Complete SDK file with:

• Request construction with auto-signing
• Crypto signature generation (HMAC/MD5/custom)
• Login flow (with password encryption hook)
• Error handling
• Usage example

Languages: Python (requests), Node.js (http/https), Go (net/http)

bypass_anti_debug

Input: JS source code (optional) + techniques to bypass + output format

Output: Bypass injection script

Techniques:

• debugger_loop — Neutralize debugger statements in loops
• setInterval_debugger — Block setInterval callbacks containing debugger
• devtools_window_size — Fix outerWidth - innerWidth detection
• devtools_console_access — Prevent console object inspection
• timing_check — Cap Date.now() / performance.now() deltas
• console_getter_trap — Undo Object.defineProperty(console, ...)
• function_toString_check — Make Function.toString() return native code

Output formats: inject_script (Tampermonkey/snippet), fiddler_rule (Fiddler OnBeforeResponse), chrome_devtools_snippet (DevTools Snippets)

Typical Workflow

1. [js-reverse-mcp]     new_page → navigate to target site
2. [js-reverse-mcp]     search_in_sources for "encrypt" / "sign"
3. [crypto-reverse-mcp] detect_crypto on found script → identify AES-CBC
4. [crypto-reverse-mcp] extract_crypto_constants → confirm S-box present
5. [js-reverse-mcp]     set_breakpoint_on_text → capture input/output
6. [crypto-reverse-mcp] reconstruct_algorithm with samples → get Python code
7. [crypto-reverse-mcp] generate_sdk → complete API SDK
8. [crypto-reverse-mcp] bypass_anti_debug → if blocked by debugger

Local Development

git clone https://github.com/crypto-reverse/crypto-reverse-mcp.git
cd crypto-reverse-mcp
npm install
npm run build
npm start

Debug with MCP Inspector

npx @modelcontextprotocol/inspector node build/src/index.js

Test stdio communication

echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"1.0.0"}}}' | node build/src/index.js

Configuration

No configuration required. All tools are stateless and work offline.

Comparison with other JS-reverse MCP servers

Feature	js-reverse-mcp	js-reverse-pro-mcp	mcp-reverse-server	crypto-reverse-mcp
Browser debugging	✅	✅	✅	❌
Breakpoints	✅	✅	✅	❌
Network capture	✅	✅	✅	❌
Hook framework	❌	✅	❌	❌
Deobfuscation	❌	✅ (Babel)	✅ (AST)	⚠️ (identify only)
JSVMP analysis	❌	❌	✅	❌
Crypto algorithm detection	❌	⚠️ (keyword scan)	⚠️	✅ (50+ patterns)
Crypto constants extraction	❌	❌	❌	✅ (S-box, IV, curves)
Algorithm reconstruction	❌	❌	❌	✅ (Python/Node)
SDK generation	❌	❌	❌	✅ (Python/Node/Go)
Anti-debug bypass	❌	❌	❌	✅ (7 techniques)
Obfuscation identification	❌	❌	❌	✅ (11 types)

Use together for maximum coverage. crypto-reverse-mcp is designed to be complementary.

Roadmap

• [ ] v0.2: trace_crypto_chain — trace encryption from ciphertext back to plaintext
• [ ] v0.2: Improved minified code analysis (variable flow tracking)
• [ ] v0.3: WASM crypto module detection
• [ ] v0.3: Custom algorithm identification via I/O analysis
• [ ] v0.4: Java SDK generation
• [ ] v0.4: RPC-style API SDK generation (gRPC, GraphQL)

License

MIT