{"slug": "show-hn-rever-browser-ai-agent-browser-for-reverse-engineering", "title": "Show HN: Rever-browser – AI-agent browser for reverse-engineering", "summary": "Rever-browser, an Electron app that pairs a real Chromium tab with an ACP-based coding agent, enables users to reverse-engineer websites by capturing live network traffic and using AI agents to analyze and reproduce API requests. The app, available under Apache-2.0, supports Claude Code and Codex agents, and includes tools for JavaScript bundle analysis, deobfuscation, and API testing.", "body_md": "**Ask in plain English — the agent drives a real browser, finds API flaws, proves them live, and turns it into a one-click macro.**\n\n`rever-browser`\n\nis an Electron app that pairs a real Chromium tab with an ACP-based coding agent. You browse a target site in an embedded `<webview>`\n\n; the app captures every network request via the Chrome DevTools Protocol, and the agent can read that traffic, analyze the site's JavaScript bundles, and drive the tab itself through an in-process MCP tool server. The goal is to go from \"what requests does this site make?\" to \"here is how to reproduce its API\" without leaving the app.\n\n**Live traffic capture**— All`Network.*`\n\nevents from the browsed tab are recorded into a ring buffer. Response bodies are fetched lazily and image/video/font/CSS payloads are skipped to keep the buffer lean.**AI agent chat**— Talk to a coding agent that sees the captured traffic and can act on the page. Claude Code is the default; Codex is also supported.**Browser automation**— The agent can navigate, click, type, scroll, screenshot, and take accessibility snapshots of the live tab.** Bundle analysis**— Grep, extract, detect the bundler for, and deobfuscate the JavaScript already captured in the traffic store (no re-download), including a`webcrack`\n\n-backed deobfuscator.**Deep API tooling**— A broad MCP tool set covering request repeater, intruder, header/override editing, HAR export, source-map recovery, crypto/decode helpers, WebSocket and service-worker inspection, and more.\n\n[Bun](https://bun.sh)(used as the package manager — not npm/pnpm)- Node.js (for the ACP agent binaries below)\n**Agent binaries on your PATH:**`claude-agent-acp`\n\n— required for the default Claude Code agent\n\n```\nnpm i -g @agentclientprotocol/claude-agent-acp\n```\n\n`codex-acp`\n\n— required for the Codex agent\n\n```\nnpm i -g @agentclientprotocol/codex-acp\n```\n\n`webcrack`\n\non your PATH (optional) — enables the`deobfuscate_script`\n\ntool\n\n```\nbun install      # install dependencies\nbun run dev      # start electron-vite dev (main + preload + renderer with HMR)\n```\n\nOther commands:\n\n```\nbun run build      # production build to out/\nbun run typecheck  # type-check with tsconfig.node.json + tsconfig.web.json\n```\n\nIf HMR doesn't pick up a change to main- or preload-process code, kill the Electron process and re-run `bun run dev`\n\n:\n\n```\npgrep -f \"Electron|electron-vite\" | xargs -r kill -9\n```\n\n- Run\n`bun run dev`\n\nto launch the app. - Enter a URL in the embedded browser and navigate to your target site.\n- Interact with the site — requests appear live in the traffic list as they happen.\n- Open the chat panel, pick an agent (Claude Code or Codex), and ask it about the captured traffic — for example, to explain an endpoint, reconstruct an auth flow, or generate client code that reproduces a request.\n- The agent reads the traffic store and drives the tab through MCP tools to answer.\n\nThree Electron processes with strict separation; all cross-process work goes through preload IPC.\n\n**main**(`src/main/`\n\n) — Node + Electron APIs. Owns the`<webview>`\n\n's CDP debugger, spawns ACP agent processes, and hosts the in-process HTTP MCP server the agent calls back into.**preload**(`src/preload/index.ts`\n\n) — The single source of truth for the renderer-visible surface, exposed as`window.rev`\n\nvia`contextBridge`\n\n.**renderer**(`src/renderer/src/`\n\n) — React 19 + Vite. Hosts the`<webview>`\n\ntag and the chat UI.\n\n**Traffic capture:** `webview Network.* events → main/chrome-cdp.ts → main/traffic-store.ts → renderer (TrafficList)`\n\n**Agent loop:** `ChatPanel → ACPChatTransport → preload IPC → main/acp-session.ts → ACP agent child process → MCP tools → main/mcp/server.ts → tools read traffic-store / drive CDP`\n\nThe MCP server starts lazily on the first agent spawn and binds to a random localhost port. See `docs/`\n\nfor additional design notes.\n\n[Apache-2.0](/greekr4/rever-browser/blob/main/LICENSE) — see [NOTICE](/greekr4/rever-browser/blob/main/NOTICE) for attribution.\n\nAll dependencies are listed in [ package.json](/greekr4/rever-browser/blob/main/package.json); every package in the dependency tree uses a permissive license (MIT, Apache-2.0, ISC, or BSD) — no copyleft.\n\nExternal tools invoked as separate processes (not bundled or distributed with this project): [claude-agent-acp](https://www.npmjs.com/package/@agentclientprotocol/claude-agent-acp) (Apache-2.0), [codex-acp](https://www.npmjs.com/package/@agentclientprotocol/codex-acp) (Apache-2.0), [webcrack](https://www.npmjs.com/package/webcrack) (MIT).", "url": "https://wpnews.pro/news/show-hn-rever-browser-ai-agent-browser-for-reverse-engineering", "canonical_source": "https://github.com/greekr4/rever-browser", "published_at": "2026-08-05 05:51:59+00:00", "updated_at": "2026-08-05 06:23:13.831868+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-products"], "entities": ["Rever-browser", "Electron", "Chromium", "Claude Code", "Codex", "MCP", "Bun", "webcrack"], "alternates": {"html": "https://wpnews.pro/news/show-hn-rever-browser-ai-agent-browser-for-reverse-engineering", "markdown": "https://wpnews.pro/news/show-hn-rever-browser-ai-agent-browser-for-reverse-engineering.md", "text": "https://wpnews.pro/news/show-hn-rever-browser-ai-agent-browser-for-reverse-engineering.txt", "jsonld": "https://wpnews.pro/news/show-hn-rever-browser-ai-agent-browser-for-reverse-engineering.jsonld"}}