# Reference Overview

The following tool domains are available:

## Recommended reading order

1. Start with `browser / network / workflow` to understand the day-to-day path.
2. Continue with `debugger / hooks / streaming` for runtime analysis.
3. Finish with `core / sourcemap / transform / wasm / process / platform` for deeper reverse-engineering coverage.

## Domain matrix

| Domain | Title | Profiles | Typical use |
| --- | --- | --- | --- |
| `adb-bridge` | ADB Bridge | full | Android Debug Bridge integration domain for device management, application analysis, and remote debugging. |
| `antidebug` | AntiDebug | full | Anti-anti-debug domain focused on detecting and bypassing browser-side anti-debugging protections. |
| `binary-instrument` | Binary Instrument | full | Binary instrumentation domain providing binary analysis and runtime instrumentation capabilities. |
| `boringssl-inspector` | BoringSSL Inspector | workflow, full | BoringSSL/TLS inspection domain supporting TLS traffic analysis and certificate inspection. |
| `browser` | Browser | workflow, full | Primary browser control and DOM interaction domain; the usual entry point for most workflows. |
| `canvas` | Canvas | full | Canvas game engine reverse analysis domain supporting Laya, Pixi, Phaser, Cocos, and Unity engines for fingerprinting, scene tree dumping, and object picking. |
| `coordination` | Coordination | full | Coordination domain for session insights and MCP Task Handoff, bridging the planning and execution boundaries of LLMs. |
| `core` | Core | workflow, full | Core static and semi-static analysis domain for script collection, deobfuscation, semantic inspection, webpack analysis, source map recovery, and crypto detection. |
| `cross-domain` | Cross-Domain | full | Cross-domain correlation domain that bridges analysis results across multiple domains, supporting workflow orchestration and evidence graph integration. |
| `debugger` | Debugger | workflow, full | CDP-based debugging domain covering breakpoints, stepping, call stacks, watches, and debugger sessions. |
| `encoding` | Encoding | workflow, full | Binary format detection, encoding conversion, entropy analysis, and raw protobuf decoding. |
| `evidence` | Evidence | full | Evidence-graph domain that models provenance between URLs, scripts, functions, hooks, and captured artifacts. |
| `extension-registry` | Extension Registry | full | Extension registry domain for managing and discovering community extensions. |
| `graphql` | GraphQL | workflow, full | GraphQL discovery, extraction, replay, and introspection tooling. |
| `hooks` | Hooks | full | AI hook generation, injection, export, and built-in/custom preset management. |
| `instrumentation` | Instrumentation | full | Unified instrumentation-session domain that groups hooks, intercepts, traces, and artifacts into a queryable session. |
| `macro` | Macro | full | Sub-agent macro orchestration domain that chains multiple tool calls into reusable macro workflows. |
| `maintenance` | Maintenance | workflow, full | Operations and maintenance domain covering cache hygiene, token budget, environment diagnostics, artifact cleanup, and extension management. |
| `memory` | Memory | full | Memory analysis domain for native scans, pointer-chain discovery, structure inference, and breakpoint-based observation. |
| `mojo-ipc` | Mojo IPC | full | Mojo IPC monitoring domain for Chromium inter-process communication analysis. |
| `network` | Network | workflow, full | Request capture, response extraction, HAR export, safe replay, and performance tracing. |
| `platform` | Platform | full | Platform and package analysis domain covering miniapps, ASAR archives, and Electron apps. |
| `process` | Process | full | Process, module, memory diagnostics, and controlled injection domain for host-level inspection, troubleshooting, and Windows process experimentation workflows. |
| `protocol-analysis` | Protocol Analysis | full | Custom protocol analysis domain supporting protocol pattern definition, automatic field detection from hex payloads, state machine inference from captured messages, and Mermaid diagram visualization. |
| `proxy` | Proxy | full | Full-stack HTTP/HTTPS MITM proxy domain for system-level traffic interception, modification, and application configuration. |
| `sandbox` | Sandbox | full | WASM-isolated QuickJS sandbox domain for secure custom script execution with MCP tool access. |
| `shared-state-board` | Shared State Board | workflow, full | Cross-agent state synchronization domain providing a global shared state board for multi-agent collaboration. |
| `skia-capture` | Skia Capture | workflow, full | Skia rendering engine capture domain for UI rendering analysis and visualization. |
| `sourcemap` | SourceMap | full | Source map discovery, fetching, parsing, and source tree reconstruction. |
| `streaming` | Streaming | workflow, full | WebSocket and SSE monitoring domain. |
| `syscall-hook` | Syscall Hook | full | System call hooking domain providing system call monitoring and mapping capabilities. |
| `trace` | Trace | full | Time-travel debugging domain that records CDP events into SQLite for SQL-based querying and heap snapshot comparison. |
| `transform` | Transform | full | AST/string transform domain plus crypto extraction, harnessing, and comparison tooling. |
| `v8-inspector` | V8 Inspector | workflow, full | V8 inspector domain providing heap snapshot analysis, CPU profiling, and memory inspection. |
| `wasm` | WASM | full | WebAssembly dump, disassembly, decompilation, optimization, and offline execution domain. |
| `workflow` | Workflow | workflow, full | Composite workflow and script-library domain; the main built-in orchestration layer. |

## Key high-level entry points

- `api_probe_batch` — batch-probe OpenAPI / Swagger / API paths
- `js_bundle_search` — fetch a bundle remotely and search it with multiple patterns
- `page_script_register` / `page_script_run` — register reusable page-side snippets and execute them on demand
- `doctor_environment` — diagnose dependencies and local bridge health
- `cleanup_artifacts` — clean retained artifacts by age or size
- `list_extension_workflows` / `run_extension_workflow` — discover and execute external extension workflows
