An MCP server to help LLMs de-obfuscate and navigate minified JavaScript bundles.
Server has 10 tools with mostly complete schemas and descriptions. Naming follows verb_noun convention (deobfuscate, list_modules, get_module, search_modules, etc.). Descriptions are present and reasonably detailed (avg ~150 chars), exceeding the 10-char minimum. All parameters have type definitions and descriptions. However, output schemas are not explicitly documented in the visible code, responses are inferred from implementation. Error handling is minimal; no recovery guidance or actionable error messages visible. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite all tools being read-only. Parameter constraints are well-described (e.g., 'Max 50MB', enums for parser), but no explicit validation or error classification patterns. Composition is sound, tools chain logically (deobfuscate → list_modules → get_module). Missing: output schema documentation, error recovery patterns, and tool annotations.
Returns structural summary (AST) of code.
Unpacks/deobfuscates minified code & caches result.
Formats code with Prettier.
Generates a call graph for a specific function.
Get detailed usage info and examples for a specific tool.
Gets code for specific module ID from cache.
Extracts specific function/class source code.
Output schemas not documented. Tool descriptions state what is returned (e.g., 'Returns formatted, readable code', 'Returns a JSON list'), but formal output schema definitions are absent from visible code. LLMs cannot plan downstream tool calls without knowing response structure.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All 10 tools are read-only and idempotent, but this is not declared in the tool definitions. Clients cannot infer safety properties without explicit annotations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
Scans cached modules to list defined functions and classes.
Lists modules from cached bundle.
Searches text/regex in cached modules.
Error handling lacks recovery guidance. No visible error classification (retryable vs user-fixable vs fatal) or actionable error messages. E.g., 'No bundle cached. Run deobfuscate first.' is good, but most error paths are not documented.
Parameter descriptions lack explicit format/constraint details for some fields. E.g., 'query' in search_modules says 'text or regex pattern' but does not specify regex syntax, flags, or error handling for invalid patterns.
get_help tool is meta-utility with limited value. It duplicates documentation already in tool descriptions. Consider removing or integrating help into the client UI instead of consuming a tool slot.