whitenightshadow/wx-mp-mcp

wx-mp-mcp is a tool that plugs into AI coding assistants like Claude Code or Cursor through the Model Context Protocol, and automates the process of reverse engineering WeChat mini-programs. A mini-program is a small app that runs inside the WeChat messaging app. The README states clearly that this is meant only for security analysis of a person's own or explicitly authorized mini-programs, not for unauthorized access or bypassing someone else's security. The tool works in three stages. First it reads the encrypted mini-program package files already stored on a computer's disk and decrypts them into readable source code, without needing WeChat to be running or touching its process in memory. Second, it can capture the mini-program's real network requests using a proxy tool called mitmproxy, saving each request along with its signature parameters. Third, an AI reads the decrypted source code to locate the signing or encryption algorithm, works out the exact formula through analysis or by running the code in an isolated sandbox, and produces a small standalone script that can reproduce that signature outside of WeChat entirely. The project ships as twelve tools grouped into unpacking and analysis, traffic capture, signature cracking, and an offline code sandbox for running extracted modules safely. Most mini-programs without extra obfuscation can be handled by a single one-step analysis command, more heavily protected ones need the additional capture and cracking steps. The README stresses that the tool avoids attaching to or modifying the live WeChat application, since injecting into a running WeChat process carries a risk of the user's account being flagged or banned, which is the exact approach this project avoids. It works on both macOS and Windows and requires Node.js.