JsOwl
Extract API endpoints, discover hidden assets, and detect sensitive credentials across JavaScript files and modern web applications.
JsOwl is a high-performance web security reconnaissance tool and Go library designed to inspect client-side JavaScript assets, Webpack chunks, and single-page applications. By pairing Tree-sitter Abstract Syntax Tree (AST) parsing with regular expression engines and HaE-compatible rulesets, it uncovers exposed API endpoints, tokens, keys, and sensitive parameters. The tool features versatile direct HTTP and headless browser scanning modes, runtime form interaction, authenticated session capture, and AI-assisted analysis. Furthermore, its native Model Context Protocol (MCP) server interface allows LLM clients to programmatically run scans and review structured JSON and interactive HTML reports.