by WhiteNightShadow · MCP Server · ★ 232
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
git clone https://github.com/WhiteNightShadow/wx-mp-mcp.git
claude mcp add wx-mp-mcp -- node /绝对路径/wx-mp-mcp/dist/index.jsTaken from the project's README on GitHub. Check the security audit before running it.
None of the 42 rules matched — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against 42 published rules built on the SlowMist agent-security taxonomy, refreshed every 8 hours. Full audit →
The quality score combines nine heuristic checks of the repo and its README: completeness, clarity, specificity, examples, structure, agent readiness, step-by-step content, instruction quality and security notes. It rates how well the project explains itself to an agent, not the code.
| Stars | 232 |
| Forks | 39 |
| Language | JavaScript |
| Category | MCP Server |
| Quality Score | 61/100 |
| Open Issues | 1 |
| Last Updated | 2026-07-29 |
| Created | 2026-06-29 |
| Platforms | mcp, node |
| Est. Tokens | ~10k |
wx-mp-mcp 微信小程序逆向 MCP 把小程序接口的签名 / 加密参数，还原成一个本地 Node.js 就能直接跑的脚本 一个 MCP（Model Context Protocol）Server，装进你的 AI 编码工具（Claude Code / Cursor / Codex），让 AI 自动完成微信小程序的解包 → 抓包 → 签名分析 → 本地复现。 三个核心能力 实时解包 直接读磁盘上的加密包（）离线解密成可读 js 源码，主包 / 分包 / 插件全解。微信开不开都行。 数据抓包 HTTPS 代理拦下小程序真实请求，自动存成结构化样本——每条带 url、参数、 签名字段。 AI 离线分析 AI 读 js 定位签名算法 → 穷举反推 / 沙箱实跑复现 → 导出脱离微信的独立签名脚本。 🛡️ 不碰微信进程：全程只做「读磁盘加密包 · 走代理被动抓流量 · Node...
These tools work well together with wx-mp-mcp for enhanced workflows:
Explore other popular mcp server tools:
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy: 42 published rules, covering credential harvesting, data exfiltration, curl | sh installers and more. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: