@jshookmcp/jshook 0.1.7 → 0.1.8

package/README.md

@@ -8,16 +8,11 @@
 
 English | [中文](./README.zh.md)
 
-An MCP (Model Context Protocol) server providing **245 built-in tools** — **237 domain tools across 16 domains** plus **8 built-in meta-tools** — with runtime extension loading from `plugins/` and `workflows/` for AI-assisted JavaScript analysis and security analysis. Combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process/memory inspection, WASM toolchain, binary encoding, anti-anti-debug, GraphQL discovery, source map reconstruction, AST transforms, crypto reconstruction, platform package analysis, Burp Suite / native analysis tool bridges, human behavior simulation, CAPTCHA solving, batch account workflows, and high-level composite workflow orchestration in a single server.
+An MCP (Model Context Protocol) server providing **245 built-in tools** — **238 domain tools across 16 domains** plus **8 built-in meta-tools** — with runtime extension loading from `plugins/` and `workflows/` for AI-assisted JavaScript analysis and security analysis. Combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process/memory inspection, WASM toolchain, binary encoding, anti-anti-debug, GraphQL discovery, source map reconstruction, AST transforms, crypto reconstruction, platform package analysis, Burp Suite / native analysis tool bridges, human behavior simulation, CAPTCHA solving, batch account workflows, and high-level composite workflow orchestration in a single server.
 
 ## Start Here
 
-- Docs home: `docs/index.md:1`
-- Getting started: `docs/guide/getting-started.md:1`
-- Tool selection: `docs/guide/tool-selection.md:1`
-- Extension templates: `docs/extensions/templates.md:1`
-- Operations: `docs/operations/doctor-and-artifacts.md:1`
-- Contribution guide: `CONTRIBUTING.md:1`
+- **Documentation**: <https://vmoranv.github.io/jshookmcp/>
 
 ## Features
 
@@ -50,7 +45,7 @@ An MCP (Model Context Protocol) server providing **245 built-in tools** — **23
 - **Crypto Reconstruction** — Extract standalone crypto functions, worker-thread sandbox testing, implementation comparison
 - **Platform Tools** — Miniapp package scanning/unpacking/analysis, Electron ASAR extraction, Electron app inspection
 - **External Tool Bridges** — Frida script generation and Jadx decompilation integration (link-only, user installs externally)
-- **CAPTCHA Handling** — AI vision detection, manual solve flow, configurable polling, 2captcha provider integration, Cloudflare Turnstile solving (hook / manual / API), per-provider API key isolation
+- **CAPTCHA Handling** — AI vision detection, manual solve flow, configurable polling, external solver integration, widget challenge solving (hook / manual / API), per-service API key isolation
 - **Human Behavior Simulation** — Bezier-curve mouse movement, natural scrolling with deceleration, realistic typing with typo simulation; all parameters runtime-clamped for safety
 - **Burp Suite Bridge** — Proxy status, intercept-and-replay, HAR import/diff, send-to-repeater; SSRF-protected loopback-only endpoints
 - **Native Analysis Tool Bridge** — Ghidra and IDA Pro bridge: decompile functions, list symbols, run scripts, cross-reference analysis; loopback-only SSRF protection
@@ -95,11 +90,42 @@ Built on `@modelcontextprotocol/sdk` v1.27+ using the **McpServer high-level API
 ### Recommended: Run with npx
 
 ```bash
-npx @jshookmcp/jshook
+npx -y @jshookmcp/jshook
 ```
 
 This is the recommended way to use the package if you just want to run the MCP server without managing a global install.
 
+Notes:
+
+- This is a **stdio MCP server**, not a GUI application. It is normal that running it directly in a terminal does not open a window.
+- The process stays attached to the current terminal and waits for an MCP client to complete the stdin/stdout handshake.
+- Use `-y` explicitly when launching through `npx`, otherwise first-install confirmation can block MCP clients and look like a handshake failure.
+
+Release note:
+
+- `0.1.7` had a broken startup path in some `npx` / MCP-client flows.
+- That packaging issue is fixed in `0.1.8`.
+- If you still see repeated install prompts or `initialize response` failures, force-refresh to the fixed version once:
+
+```bash
+npx -y @jshookmcp/jshook@0.1.8
+```
+
+MCP client examples:
+
+Codex / Claude Code `stdio` config:
+
+```json
+{
+  "mcpServers": {
+    "jshook": {
+      "command": "npx",
+      "args": ["-y", "@jshookmcp/jshook"]
+    }
+  }
+}
+```
+
 ### Optional: Global install
 
 ```bash
@@ -166,7 +192,7 @@ Key variables from `.env.example`:
 | `PUPPETEER_TIMEOUT`             | Default Puppeteer timeout in milliseconds                                             | `30000`                                                                        |
 | `PUPPETEER_EXECUTABLE_PATH`     | Optional explicit browser executable path                                             | commented example                                                              |
 | `MCP_SERVER_NAME`               | Server name advertised by the process                                                 | `jshookmcp`                                                                    |
-| `MCP_SERVER_VERSION`            | Server version advertised by the process                                              | `0.1.0` in `.env.example`                                                      |
+| `MCP_SERVER_VERSION`            | Server version advertised by the process                                              | `0.1.8` in `.env.example`                                                      |
 | `MCP_TOOL_PROFILE`              | Tool profile: `search`, `minimal`, `workflow`, or `full`                              | commented example: `minimal`                                                   |
 | `MCP_TOOL_DOMAINS`              | Comma-separated domain override; takes precedence over `MCP_TOOL_PROFILE`             | commented example                                                              |
 | `LOG_LEVEL`                     | Logging verbosity (`debug`, `info`, `warn`, `error`)                                  | `info`                                                                         |
@@ -197,7 +223,7 @@ Additional runtime options exist in code but are not enabled by default in `.env
 | `search`   | maintenance                                                                           | 20 (12 domain + 8 meta)   | ~3,440      | 8%      |
 | `minimal`  | browser, maintenance                                                                  | 80 (72 domain + 8 meta)   | ~13,760     | 33%     |
 | `workflow` | browser, network, workflow, maintenance, core, debugger, streaming, encoding, graphql | 181 (173 domain + 8 meta) | ~31,132     | 74%     |
-| `full`     | all 16 domains                                                                        | 245 (237 domain + 8 meta) | ~42,140     | 100%    |
+| `full`     | all 16 domains                                                                        | 245 (238 domain + 8 meta) | ~42,140     | 100%    |
 
 > Token counts are rough estimates derived from the previous `claude /doctor` average of ~172 tokens/tool. All profiles include 8 meta-tools: `search_tools`, `activate_tools`, `deactivate_tools`, `activate_domain`, `boost_profile`, `unboost_profile`, `extensions_list`, `extensions_reload`.
 
@@ -241,6 +267,24 @@ MCP_TRANSPORT=http MCP_AUTH_TOKEN=mysecret jshook
 
 Set `OPENAI_MODEL` or `OPENAI_BASE_URL` only if you need to override the defaults. If you plan to use image-heavy tools (for example CAPTCHA vision workflows), choose a vision-capable model explicitly rather than treating it as the default for every installation.
 
+If you prefer to let the client launch the server via `npx` instead of a global binary, use:
+
+```json
+{
+  "mcpServers": {
+    "jshook": {
+      "command": "npx",
+      "args": ["-y", "@jshookmcp/jshook"],
+      "env": {
+        "OPENAI_API_KEY": "your-key"
+      }
+    }
+  }
+}
+```
+
+The `-y` flag matters: without it, `npx` may wait for an interactive install confirmation, and many MCP clients cannot answer that prompt. The result usually looks like a handshake failure or startup timeout.
+
 ### Streamable HTTP (remote / MCP current revision)
 
 ```bash
@@ -255,9 +299,9 @@ Connect your MCP client to `http://localhost:3000/mcp`. The server supports:
 
 Session IDs are issued via the `Mcp-Session-Id` response header.
 
-## Tool Domains (237 Domain Tools)
+## Tool Domains
 
-### Core / Analysis (13 tools)
+### Core / Analysis
 
 <details>
 <summary>LLM-powered code collection, deobfuscation, crypto detection, webpack/source-map analysis</summary>
@@ -267,90 +311,91 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 | 1   | `collect_code`          | Collect JavaScript code from a target website (summary / priority / incremental / full modes) |
 | 2   | `search_in_scripts`     | Search collected scripts by keyword or regex pattern                                          |
 | 3   | `extract_function_tree` | Extract a function and its full dependency tree from collected scripts                        |
-| 4   | `deobfuscate`           | LLM-assisted JavaScript deobfuscation                                                         |
+| 4   | `deobfuscate`           | Webcrack-powered JavaScript deobfuscation with bundle unpacking support                       |
 | 5   | `understand_code`       | Semantic code analysis for structure, behaviour, and risks                                    |
 | 6   | `detect_crypto`         | Detect cryptographic algorithms and usage patterns in source code                             |
 | 7   | `manage_hooks`          | Create, inspect, and clear JavaScript runtime hooks                                           |
 | 8   | `detect_obfuscation`    | Detect obfuscation techniques in JavaScript source                                            |
-| 9   | `advanced_deobfuscate`  | Advanced deobfuscation with VM-oriented strategies                                            |
-| 10  | `clear_collected_data`  | Clear collected script data, caches, and in-memory indexes                                    |
-| 11  | `get_collection_stats`  | Get collection, cache, and compression statistics                                             |
-| 12  | `webpack_enumerate`     | Enumerate all webpack modules in the current page; optionally search for keywords             |
-| 13  | `source_map_extract`    | Find and parse JavaScript source maps to recover original source code                         |
+| 9   | `advanced_deobfuscate`  | Advanced deobfuscation with webcrack backend (deprecated legacy flags ignored)                |
+| 10  | `webcrack_unpack`       | Direct webcrack bundle unpacking returning module graph details                               |
+| 11  | `clear_collected_data`  | Clear collected script data, caches, and in-memory indexes                                    |
+| 12  | `get_collection_stats`  | Get collection, cache, and compression statistics                                             |
+| 13  | `webpack_enumerate`     | Enumerate all webpack modules in the current page; optionally search for keywords             |
+| 14  | `source_map_extract`    | Find and parse JavaScript source maps to recover original source code                         |
 
 </details>
 
-### Browser (60 tools)
+### Browser
 
 <details>
 <summary>Browser control, DOM interaction, stealth, CAPTCHA solving, human behavior simulation, storage, framework tools, JS heap search, tab workflow</summary>
 
-| #   | Tool                      | Description                                                                                         |
-| --- | ------------------------- | --------------------------------------------------------------------------------------------------- |
-| 1   | `get_detailed_data`       | Retrieve large data by `detailId` token (returned when results exceed context limits)               |
-| 2   | `browser_launch`          | Launch browser instance (`chrome` via rebrowser-puppeteer-core, or `camoufox` anti-detect Firefox)  |
-| 3   | `camoufox_server_launch`  | Launch a Camoufox WebSocket server for multi-process / remote connections                           |
-| 4   | `camoufox_server_close`   | Close the Camoufox WebSocket server                                                                 |
-| 5   | `camoufox_server_status`  | Get Camoufox WebSocket server status                                                                |
-| 6   | `browser_attach`          | Attach to an existing browser via CDP WebSocket URL                                                 |
-| 7   | `browser_close`           | Close the browser instance                                                                          |
-| 8   | `browser_status`          | Get browser status (running, page count, version)                                                   |
-| 9   | `browser_list_tabs`       | List all open tabs/pages                                                                            |
-| 10  | `browser_select_tab`      | Switch active tab by index or URL/title pattern                                                     |
-| 11  | `page_navigate`           | Navigate to a URL with auto CAPTCHA detection and optional network monitoring                       |
-| 12  | `page_reload`             | Reload current page                                                                                 |
-| 13  | `page_back`               | Navigate back in history                                                                            |
-| 14  | `page_forward`            | Navigate forward in history                                                                         |
-| 15  | `dom_query_selector`      | Query a single DOM element                                                                          |
-| 16  | `dom_query_all`           | Query all matching DOM elements                                                                     |
-| 17  | `dom_get_structure`       | Get page DOM structure; large DOM auto-returns summary + `detailId`                                 |
-| 18  | `dom_find_clickable`      | Find all clickable elements (buttons, links)                                                        |
-| 19  | `dom_get_computed_style`  | Get computed CSS styles of an element                                                               |
-| 20  | `dom_find_by_text`        | Find elements by text content                                                                       |
-| 21  | `dom_get_xpath`           | Get XPath for an element                                                                            |
-| 22  | `dom_is_in_viewport`      | Check if an element is visible in the viewport                                                      |
-| 23  | `page_click`              | Click an element                                                                                    |
-| 24  | `page_type`               | Type text into an input element                                                                     |
-| 25  | `page_select`             | Select option(s) in a `<select>` element                                                            |
-| 26  | `page_hover`              | Hover over an element                                                                               |
-| 27  | `page_scroll`             | Scroll the page                                                                                     |
-| 28  | `page_press_key`          | Press a keyboard key                                                                                |
-| 29  | `page_wait_for_selector`  | Wait for an element to appear in the DOM                                                            |
-| 30  | `page_evaluate`           | Execute JavaScript in page context; large results return summary + `detailId`                       |
-| 31  | `page_screenshot`         | Take a screenshot of the current page                                                               |
-| 32  | `page_get_performance`    | Get page performance metrics                                                                        |
-| 33  | `page_inject_script`      | Inject JavaScript code into the page                                                                |
-| 34  | `page_set_cookies`        | Set cookies for the page                                                                            |
-| 35  | `page_get_cookies`        | Get all cookies for the page                                                                        |
-| 36  | `page_clear_cookies`      | Clear all cookies                                                                                   |
-| 37  | `page_set_viewport`       | Set viewport size                                                                                   |
-| 38  | `page_emulate_device`     | Emulate a mobile device (iPhone, iPad, Android)                                                     |
-| 39  | `page_get_local_storage`  | Get all `localStorage` items                                                                        |
-| 40  | `page_set_local_storage`  | Set a `localStorage` item                                                                           |
-| 41  | `page_get_all_links`      | Get all links on the page                                                                           |
-| 42  | `get_all_scripts`         | Get list of all loaded script URLs (with `maxScripts` cap)                                          |
-| 43  | `get_script_source`       | Get script source code; large scripts return summary + `detailId`                                   |
-| 44  | `console_enable`          | Enable console monitoring                                                                           |
-| 45  | `console_get_logs`        | Get captured console logs                                                                           |
-| 46  | `console_execute`         | Execute JavaScript in the console context                                                           |
-| 47  | `captcha_detect`          | Detect CAPTCHA on the current page using AI vision                                                  |
-| 48  | `captcha_wait`            | Wait for manual CAPTCHA solve                                                                       |
-| 49  | `captcha_config`          | Configure CAPTCHA detection behaviour                                                               |
-| 50  | `stealth_inject`          | Inject stealth scripts to bypass bot detection                                                      |
-| 51  | `stealth_set_user_agent`  | Set a realistic User-Agent and browser fingerprint                                                  |
-| 52  | `framework_state_extract` | Extract React/Vue component state from the live page                                                |
-| 53  | `indexeddb_dump`          | Dump all IndexedDB databases                                                                        |
-| 54  | `js_heap_search`          | Search the live V8 JS heap for strings matching a pattern (CE-equivalent for browser)               |
-| 55  | `tab_workflow`            | Multi-tab coordination with alias binding, cross-tab navigation, and KV context                     |
-| 56  | `human_mouse`             | Bezier-curve mouse movement with jitter, easing, and optional click — mimics real human motion      |
-| 57  | `human_scroll`            | Natural scrolling with segment deceleration, jitter, and direction control                          |
-| 58  | `human_typing`            | Realistic typing with per-character delay variance, typo simulation, and WPM-based pacing           |
-| 59  | `captcha_vision_solve`    | Solve image/reCAPTCHA/hCaptcha via external provider (2captcha) or manual mode with auto-detection  |
-| 60  | `turnstile_solve`         | Solve Cloudflare Turnstile via hook interception, 2captcha API, or manual mode with token injection |
+| #   | Tool                      | Description                                                                                                   |
+| --- | ------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| 1   | `get_detailed_data`       | Retrieve large data by `detailId` token (returned when results exceed context limits)                         |
+| 2   | `browser_launch`          | Launch browser instance (`chrome` via rebrowser-puppeteer-core, or `camoufox` anti-detect Firefox)            |
+| 3   | `camoufox_server_launch`  | Launch a Camoufox WebSocket server for multi-process / remote connections                                     |
+| 4   | `camoufox_server_close`   | Close the Camoufox WebSocket server                                                                           |
+| 5   | `camoufox_server_status`  | Get Camoufox WebSocket server status                                                                          |
+| 6   | `browser_attach`          | Attach to an existing browser via CDP WebSocket URL                                                           |
+| 7   | `browser_close`           | Close the browser instance                                                                                    |
+| 8   | `browser_status`          | Get browser status (running, page count, version)                                                             |
+| 9   | `browser_list_tabs`       | List all open tabs/pages                                                                                      |
+| 10  | `browser_select_tab`      | Switch active tab by index or URL/title pattern                                                               |
+| 11  | `page_navigate`           | Navigate to a URL with auto CAPTCHA detection and optional network monitoring                                 |
+| 12  | `page_reload`             | Reload current page                                                                                           |
+| 13  | `page_back`               | Navigate back in history                                                                                      |
+| 14  | `page_forward`            | Navigate forward in history                                                                                   |
+| 15  | `dom_query_selector`      | Query a single DOM element                                                                                    |
+| 16  | `dom_query_all`           | Query all matching DOM elements                                                                               |
+| 17  | `dom_get_structure`       | Get page DOM structure; large DOM auto-returns summary + `detailId`                                           |
+| 18  | `dom_find_clickable`      | Find all clickable elements (buttons, links)                                                                  |
+| 19  | `dom_get_computed_style`  | Get computed CSS styles of an element                                                                         |
+| 20  | `dom_find_by_text`        | Find elements by text content                                                                                 |
+| 21  | `dom_get_xpath`           | Get XPath for an element                                                                                      |
+| 22  | `dom_is_in_viewport`      | Check if an element is visible in the viewport                                                                |
+| 23  | `page_click`              | Click an element                                                                                              |
+| 24  | `page_type`               | Type text into an input element                                                                               |
+| 25  | `page_select`             | Select option(s) in a `<select>` element                                                                      |
+| 26  | `page_hover`              | Hover over an element                                                                                         |
+| 27  | `page_scroll`             | Scroll the page                                                                                               |
+| 28  | `page_press_key`          | Press a keyboard key                                                                                          |
+| 29  | `page_wait_for_selector`  | Wait for an element to appear in the DOM                                                                      |
+| 30  | `page_evaluate`           | Execute JavaScript in page context; large results return summary + `detailId`                                 |
+| 31  | `page_screenshot`         | Take a screenshot of the current page                                                                         |
+| 32  | `page_get_performance`    | Get page performance metrics                                                                                  |
+| 33  | `page_inject_script`      | Inject JavaScript code into the page                                                                          |
+| 34  | `page_set_cookies`        | Set cookies for the page                                                                                      |
+| 35  | `page_get_cookies`        | Get all cookies for the page                                                                                  |
+| 36  | `page_clear_cookies`      | Clear all cookies                                                                                             |
+| 37  | `page_set_viewport`       | Set viewport size                                                                                             |
+| 38  | `page_emulate_device`     | Emulate a mobile device (iPhone, iPad, Android)                                                               |
+| 39  | `page_get_local_storage`  | Get all `localStorage` items                                                                                  |
+| 40  | `page_set_local_storage`  | Set a `localStorage` item                                                                                     |
+| 41  | `page_get_all_links`      | Get all links on the page                                                                                     |
+| 42  | `get_all_scripts`         | Get list of all loaded script URLs (with `maxScripts` cap)                                                    |
+| 43  | `get_script_source`       | Get script source code; large scripts return summary + `detailId`                                             |
+| 44  | `console_enable`          | Enable console monitoring                                                                                     |
+| 45  | `console_get_logs`        | Get captured console logs                                                                                     |
+| 46  | `console_execute`         | Execute JavaScript in the console context                                                                     |
+| 47  | `captcha_detect`          | Detect CAPTCHA on the current page using AI vision                                                            |
+| 48  | `captcha_wait`            | Wait for manual CAPTCHA solve                                                                                 |
+| 49  | `captcha_config`          | Configure CAPTCHA detection behaviour                                                                         |
+| 50  | `stealth_inject`          | Inject stealth scripts to bypass bot detection                                                                |
+| 51  | `stealth_set_user_agent`  | Set a realistic User-Agent and browser fingerprint                                                            |
+| 52  | `framework_state_extract` | Extract React/Vue component state from the live page                                                          |
+| 53  | `indexeddb_dump`          | Dump all IndexedDB databases                                                                                  |
+| 54  | `js_heap_search`          | Search the live V8 JS heap for strings matching a pattern (CE-equivalent for browser)                         |
+| 55  | `tab_workflow`            | Multi-tab coordination with alias binding, cross-tab navigation, and KV context                               |
+| 56  | `human_mouse`             | Bezier-curve mouse movement with jitter, easing, and optional click — mimics real human motion                |
+| 57  | `human_scroll`            | Natural scrolling with segment deceleration, jitter, and direction control                                    |
+| 58  | `human_typing`            | Realistic typing with per-character delay variance, typo simulation, and WPM-based pacing                     |
+| 59  | `captcha_vision_solve`    | Solve image or widget challenges via external service or manual mode with auto-detection                      |
+| 60  | `widget_challenge_solve`  | Solve embedded widget challenges via hook interception, external service, or manual mode with token injection |
 
 </details>
 
-### Debugger (37 tools)
+### Debugger
 
 <details>
 <summary>CDP debugger control, breakpoints, watches, XHR/event breakpoints, session persistence, blackboxing</summary>
@@ -397,7 +442,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Network (26 tools)
+### Network
 
 <details>
 <summary>CDP network monitoring, performance tracing, CPU/heap profiling, auth extraction, HAR export, request replay, console injection</summary>
@@ -433,7 +478,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Hooks (8 tools)
+### Hooks
 
 <details>
 <summary>AI-generated JavaScript hooks and 20+ built-in presets</summary>
@@ -453,7 +498,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Maintenance (6 tools)
+### Maintenance
 
 <details>
 <summary>Token budget tracking and cache management</summary>
@@ -469,7 +514,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Process / Memory / Electron (26 tools)
+### Process / Memory / Electron
 
 <details>
 <summary>Process enumeration, memory diagnostics and audit export, controlled DLL/shellcode injection, Electron attachment</summary>
@@ -507,7 +552,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Workflow / Composite (7 tools)
+### Workflow / Composite
 
 <details>
 <summary>High-level orchestration for full-chain JavaScript analysis and security analysis tasks, plus batch operations</summary>
@@ -527,7 +572,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### WASM (8 tools)
+### WASM
 
 <details>
 <summary>WebAssembly dump, disassembly, decompilation, inspection, optimization, offline execution, VMP tracing</summary>
@@ -547,7 +592,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Streaming (6 tools)
+### Streaming
 
 <details>
 <summary>WebSocket frame capture and SSE event interception</summary>
@@ -563,7 +608,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Encoding (5 tools)
+### Encoding
 
 <details>
 <summary>Binary format detection, entropy analysis, Protobuf/MessagePack decoding, encode/decode</summary>
@@ -578,7 +623,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Anti-Debug (6 tools)
+### Anti-Debug
 
 <details>
 <summary>Bypass anti-debugging protections and detect protection techniques</summary>
@@ -594,7 +639,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### GraphQL / Call Graph (5 tools)
+### GraphQL / Call Graph
 
 <details>
 <summary>GraphQL introspection, query extraction, replay, runtime call graph analysis, script replacement</summary>
@@ -609,7 +654,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Platform (7 tools)
+### Platform
 
 <details>
 <summary>Miniapp package tools, Electron ASAR extraction/inspection, Frida/Jadx bridge</summary>
@@ -628,7 +673,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Burp Suite Bridge (5 tools)
+### Burp Suite Bridge
 
 <details>
 <summary>Burp Suite REST API integration: proxy status, request replay, HAR import/diff, repeater</summary>
@@ -645,7 +690,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Native Analysis Tool Bridge (4 tools)
+### Native Analysis Tool Bridge
 
 <details>
 <summary>Ghidra and IDA Pro bridge: decompilation, symbol lookup, script execution, cross-reference analysis</summary>
@@ -661,7 +706,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Source Map / Extension (5 tools)
+### Source Map / Extension
 
 <details>
 <summary>Source map discovery, VLQ decoding, project tree reconstruction, Chrome extension interaction</summary>
@@ -676,7 +721,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Transform / Crypto (6 tools)
+### Transform / Crypto
 
 <details>
 <summary>AST-like transforms (pure regex), crypto function extraction, sandbox testing, implementation comparison</summary>
@@ -692,7 +737,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Meta-Tools (8 tools)
+### Meta-Tools
 
 <details>
 <summary>Open the meta-tool list</summary>
@@ -814,7 +859,7 @@ pnpm run doctor
 - **Path Traversal**: HAR export and debugger sessions validate paths with `fs.realpath` and symlink detection
 - **Injection Prevention**: All PowerShell-based operations use `execFile` with input sanitization; `BranchNode.predicateId` whitelist replaces arbitrary JS eval in workflow graphs
 - **External Tool Safety**: `ExternalToolRunner` uses allowlist-only tool registry with `shell: false` execution
-- **CAPTCHA Provider Isolation**: Unimplemented providers (`anticaptcha`, `capsolver`) explicitly rejected to prevent API key misrouting
+- **CAPTCHA Solver Isolation**: Unsupported legacy service overrides are explicitly rejected to prevent credential misrouting
 - **PII Protection**: Batch registration logs mask identifying data (first 2 + last 2 chars only)
 - **Parameter Clamping**: All user-facing numeric parameters in behavior/captcha handlers have runtime hard caps independent of JSON Schema
 - **Plugin Security**: In production, plugin signature enforcement defaults to enabled unless explicitly overridden; digest allowlists remain the pre-import trust boundary