JsOwl is a high-performance web security reconnaissance tool and Go library designed to inspect client-side JavaScript assets, Webpack chunks, and single-page applications. By pairing Tree-sitter Abstract Syntax Tree (AST) parsing with regular expression engines and HaE-compatible rulesets, it uncovers exposed API endpoints, tokens, keys, and sensitive parameters. The tool features versatile direct HTTP and headless browser scanning modes, runtime form interaction, authenticated session capture, and AI-assisted analysis. Furthermore, its native Model Context Protocol (MCP) server interface allows LLM clients to programmatically run scans and review structured JSON and interactive HTML reports.
主要功能
01Dual-engine analysis using Tree-sitter JavaScript AST parsing and HaE-compatible regular expressions
02Three scanning modes: high-speed direct HTTP, Rod-based browser rendering, and automatic SPA upgrade
03Authenticated session scanning and automated runtime interactions like form submission and route crawling
04Native Model Context Protocol (MCP) server support for integration into AI agents and security workflows
05Comprehensive report generation in JSON, plaintext, and interactive self-contained HTML formats
0644 GitHub stars
使用案例
01Mapping client-side attack surfaces and hidden endpoints during penetration tests or bug bounty recon
02Auditing Single Page Applications (SPAs) and JavaScript bundles for leaked secrets, API keys, and internal IPs
03Empowering AI assistants to programmatically trigger web asset scans and review vulnerabilities via MCP