rever-browser

What is rever-browser

rever-browser is a web reversing tool that puts the main jobs of browser-based analysis into a single desktop app. Instead of switching between devtools, proxy software, replay tools, and scripts, you work from one window that can capture traffic, inspect bundles, replay requests, and drive the page itself.

The app is aimed at hands-on investigation of websites and web apps. It can read the browser’s network activity, keep a session logged in, and expose the same capabilities through MCP so external agents and scripts can control it. That makes rever-browser useful both as an interactive web reversing tool and as a target for automation.

Because it is Apache-2.0 open source, it can also be audited or extended by teams that want a transparent reversing workflow.

Key features

rever-browser combines several browser-reversing capabilities in one interface:

• Live traffic capture: every Network.* event from the tab is stored in a ring buffer, with response bodies fetched lazily after loadingFinished.
• Proxy support: tabs can be pointed at an upstream proxy over http, https, or socks5, including auth.
• Logged-in sessions: ordinary tabs share a persistent partition, so a login can carry across tabs opened from the same session.
• Per-tab cookie isolation for proxy tabs: proxy tabs get their own cookie jar, which is useful when you need two identities on the same site.
• Element picker: inspect mode lets you pick an element and copy its selector, then use that target in chat without leaving the app.
• Browser control tools: the app can navigate, click, type, scroll, drag, press keys, and upload files with targets derived from snapshots.
• Shadow DOM and OOPIF support: it can reach content hidden from the accessibility tree and drive nested out-of-process iframes.
• Bundle analysis: it can grep scripts, detect the bundler, deobfuscate JavaScript already captured, and restore source maps when they are available.
• Replay and testing tools: repeater and intruder workflows are built in for resending requests and checking parameter changes.
• MCP exposure: the tools are exposed over MCP, so Claude Code, Codex, or other agents can drive the same surface.

How to use it

1. Download the desktop app for your platform; the project indicates support for macOS, Windows, and Linux.
2. Open the site or app you want to analyze in the built-in browser.
3. Watch the network capture buffer fill with requests, then inspect the relevant entries and response bodies.
4. Use the element picker to select a target on the page and copy its selector or send it to chat.
5. If the site is obfuscated, run bundle analysis to detect the bundler, search scripts, or deobfuscate the JavaScript already in capture.
6. Set an upstream proxy when you need routing control or separate identities.
7. Ask the agent in plain English to repeat requests, probe parameters, or walk a scenario from start to finish.

The tool is designed so the browser, capture buffer, proxy, and agent stay synchronized. That means you can inspect an action, reproduce it, and automate the next step without stitching together multiple programs.

Who it is for

rever-browser is a good fit for people who need a practical web reversing tool rather than a general-purpose browser.

• Security researchers who inspect requests, replay flows, and test for issues such as IDOR or parameter tampering.
• Reverse engineers who need bundle deobfuscation, script extraction, and source-map recovery.
• Bug bounty hunters who want repeater and intruder-style workflows alongside browser control.
• Automation builders who want MCP-accessible browser tools for agents and scripts.
• Developers debugging complex front ends where shadow DOM, nested iframes, or hidden network behavior make normal inspection awkward.

Because the app keeps the session logged in and can isolate proxy tabs, it also suits workflows where you need multiple identities or repeated tests without constant re-authentication.

What to know before you use it

rever-browser is powerful, but it is not a magic scanner and it does not replace judgment. The agent can help with tedious steps, yet it still depends on the page, the requests, and the scenario you give it. Results from capture and deobfuscation are only as good as what the browser actually sees.

A few caveats matter:

• It captures browser traffic, not every possible network path outside the app.
• Response bodies are fetched lazily, and some large asset types like images, video, fonts, and CSS are skipped to keep the buffer readable.
• Source-map restoration depends on the site shipping maps.
• webcrack deobfuscation works only when it is installed and available on your PATH.
• Proxy tabs use isolated cookie jars, while ordinary tabs share a persistent partition; that behavior is useful, but it also means session handling is not identical across tab types.
• It is not an official source for account, billing, or backend truth. When you need authoritative data, use the site’s own API, admin panel, or documentation instead of relying only on captured traffic.

If your work is centered on browser analysis, replay, and automation, rever-browser brings the main reversing workflow into one place and keeps the web reversing tool close to the page you are studying.