Unfragile

The request asks what to use for reverse engineering a browser extension. None of the candidates' sources describe a dedicated browser-extension reverse-engineering tool, so the closest fits are generic inspection and interception tools: mitmproxy can intercept and inspect the HTTPS traffic an extension makes 10, Selenium and Browserbase can drive a browser to exercise an extension's behaviour 84, and Extension.dev covers building and publishing extensions rather than reversing them 9. G

A question back: Which browser (Chrome, Firefox, or Edge) and what do you want from the extension: its network calls, its source code, or its page behaviour?

1
mitmproxymitmproxy.orgwebsite read, tools not yet checked
An interactive HTTPS proxy that lets you inspect and modify the network traffic a browser extension sends and receives 10.
Website Docs
+9 community tools built for it
2
Seleniumselenium.devverified and signed
Drives Chrome, Firefox, Edge and Safari from scripts so you can exercise an extension's behaviour in a real browser 8.
Website Docs
+32 community tools built for it
for agents: browser · browser · webdriver
3
Browserbasebrowserbase.comverified and signed
Runs browser sessions for agents and captures browser traces, which can help observe how an extension behaves in a page 4.
Website Docs Pricing Get started
official:MCP server · @browserbasehq/mcp repository · stagehand skill · browser skill · agent-experience skill · autobrowse+9 community tools built for it
for agents: browser-trace · browser-to-api · browser

Sources

4Browserbasebrowserbase.com · read 2026-10-29
8Seleniumselenium.dev · read 2026-10-29
9Ship Chrome, Firefox, and Edge extensions from one push – Extension.devextension.dev · read 2026-10-29
10mitmproxy - an interactive HTTPS proxymitmproxy.org · read 2026-10-29

For agents: the 10 actions behind this answer

accounts-browser-extension-inventories-get · Cloudflare API verified and signed
Get a single browser extension inventory
data-profilers · pydeequ verified and signed
ghidra · ghidra verified and signed
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.
browser-trace · browser-trace verified and signed
Capture a full DevTools-protocol trace of any browser automation — CDP firehose, screenshots, and DOM dumps — then bisect the stream into per-page searchable buckets. Use when the user wants to debug a failed run, audit network/console/DOM activity, attach a trace to an in-progress session, or feed
inspect_module · tanstack.com found in code, not yet checked
Inspect the exact installed or built-in npm module export map, detected runtime and declaration exports, declarations, and runtime source. Use this whenever a package API is uncertain or implicated in a failure.
get_dead_code · larkx verified and signed
Find files and functions that nothing else calls or imports
browsercat_evaluate · BrowserCat MCP Server (Browser Automation) found in code, not yet checked
Execute JavaScript in the browser console
browser · WebDriver Support verified and signed
· Extension.dev website read, tools not yet checked
Build, preview, and publish browser extensions. Reproducible builds, shareable previews, and release-ready submissions for Chrome, Firefox, and Edge.
· mitmproxy website read, tools not yet checked

Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.