Firefox-Reverse: a Firefox build with an AI reversing agent and SpiderMonkey-level tracing

The problem Firefox-Reverse targets: signing parameters you cannot reproduce outside the browser

A site sends a request carrying a computed string, a sign, a token, or a risk-control fingerprint. To replay that request from your own Node or Python script you have to know how the string is produced. The README frames this as the hard part of JS reversing: the logic is obfuscated, wrapped in a JSVMP bytecode interpreter, compiled to WASM, and dependent on a pile of browser environment values. The traditional route is manual breakpoints in DevTools, guessing at missing globals, and retrying values until something matches.

Firefox-Reverse is for the person who does that work repeatedly. It is not a scraping framework and not a headless automation library. The stated goal is narrower and more specific: reduce a black-box parameter to an algorithm you can run standalone, with the browser used as the observation instrument rather than as part of the final runtime. The README explicitly says it is site-agnostic, aimed at general JS, JSVMP, WASM and signature reversing, with the bundled cases acting as test samples rather than as supported targets.

The second audience is people who need isolated browser identities. The same build manages fingerprint environments, where each environment gets its own profile, its own Firefox process and its own Marionette port. That is a separate use case bolted onto the same binary, and it is worth judging separately from the reversing agent.

How the agent and the engine hooks actually fit together

The agent lives in the browser sidebar. It registers 68 tools covering page operation, network capture, code search, cookies, WebAPI trace, JSVMP, WASM, file read and write, Skills, extension and environment management, and Node or Python validation. Sessions persist locally, and the README notes that switching tabs or collapsing the sidebar does not interrupt a running parent-process agent.

The architectural claim that matters is where the observation happens. The README states that the key tools, signer argument tracing, per-instruction JSVMP trace, WASM import boundaries and engine-level branch diffing, sit inside the SpiderMonkey and Gecko C++ engine rather than in page-level monkey patches. The practical consequence the README draws is that page JavaScript has a hard time interfering with those observation points through ordinary reflection tricks. That is a real design difference from injecting a hook into the page context, and it is the reason the project ships a patched browser instead of an extension.

Two working modes are offered. Full auto lets the worker push through on its own. AI-assisted has the agent propose a plan, stop at the end of each stage, and offer direction choices for a human or an external MCP director to pick. The MCP side is exposed as frx-director-mcp, with frx_env_* tools for querying, creating, importing and starting environments.

Environment isolation is at the environment level, not the tab level. The README is direct about this, and about a second constraint: fingerprint configuration is read at process start, so editing a running environment requires closing and reopening it, and editing the main process fingerprint requires a full restart.

Installing Firefox-Reverse and running a first reversing task

There is no package manager route. The README points to the repository Releases page, where you pick the artifact for your system: a Windows installer or ZIP, a macOS arm64 or x86_64 disk image, or a Linux x86_64 or arm64 tarball. On Linux the README says to extract and run the binary directly.

macOS users hit a specific wall. The application is self-signed and not notarized, so the first launch reports that the app is damaged. The README gives the fix as a quarantine attribute removal:

xattr -dr com.apple.quarantine "/Applications/Firefox Reverse.app"

After launching, the agent panel opens from the star icon in the top right of the browser. If the icon is not visible, expand the sidebar from the button at the left of the address bar first. Model accounts are configured once in the panel settings, where you pick a provider and supply an API key and model. The README lists DeepSeek, Zhipu GLM, Kimi, MiniMax, Qwen, Claude and OpenAI, plus any endpoint speaking the OpenAI or Anthropic protocol with a base URL, token and model name. Multiple accounts per provider can be saved as named configurations.

A new conversation then asks for a mode, full auto or AI-assisted. The task itself is given in a structured form the README recommends, listing the site URL, the API URL you want to reproduce, the target parameter such as X-Sign in the request header along with any other dynamic parameters, and the output you want, either a Node.js version that reproduces the parameter and calls the API or an optional pure-JS rewrite with no dependency on the original obfuscated code.

Outputs, scripts, restored code and notes land in the working directory you assign to the session. The README suggests cheap models for small targets and a flagship model through a custom endpoint for long chains, on the grounds that weaker models take wrong turns across many stages.

Where Firefox-Reverse is the wrong tool

The licence is undeclared in the repository metadata, while the README carries an MPL 2.0 badge. That mismatch is the first thing to resolve before this goes anywhere near a commercial workflow, because the answer determines whether you can redistribute a build at all. Nothing available states that a licence file exists.

The fingerprint feature is environment-level, and the README says so plainly. If you need many identities switching inside one window, or per-tab profiles, this is not that. The configuration surface is also finite: Navigator, Screen, DPR, language and timezone, UA and Accept-Language, and WebGL unmasked vendor and renderer. A target that reads canvas hashes, audio fingerprints, font lists or client hints outside those fields is not covered by the documented set. The README also notes that new environments no longer produce Chrome-like fingerprints and that historical environments are not migrated or rewritten, so imported data can diverge from what the engine actually reports.

Cost is the other boundary. The agent runs against a hosted model API with your key, and long reversing chains on a flagship model are not cheap. The README's own advice to use a strong model on complex targets is an admission that the cheap path degrades. And because the build is self-signed, macOS deployment inside a managed fleet will fight Gatekeeper and MDM policy. The README does not document rollback for a session that goes wrong, and it does not document running the agent headless without the browser UI.

How it differs from a fingerprint browser plus a separate reversing setup

The obvious comparison is a commercial antidetect browser, such as one of the paid fingerprint browsers, paired with your own DevTools work or a scripted automation stack. Those products concentrate on identity management: hundreds of profiles, team sync, proxy binding, per-profile cookies. Reversing, if you do it at all, happens in the same DevTools everyone else uses, with breakpoints in page JavaScript.

Firefox-Reverse inverts the emphasis. Environment management exists, but the documented field coverage is narrower than a dedicated antidetect product, and there is no team or sync feature in the README. What you get instead is the observation layer inside SpiderMonkey, plus an agent that drives it. If your bottleneck is understanding a JSVMP interpreter or a WASM signing module, the engine hooks are the differentiator. If your bottleneck is running two hundred isolated storefront identities, the fingerprint side here is the weaker half and a dedicated antidetect browser will serve you better.

A second comparison is a general coding agent with browser automation. That setup can read network traffic and write scripts, but its observation points are page-level. The README's claim is that engine-level tracing is harder for a page to detect or defeat than an injected hook. Whether that holds for a given target is exactly what you would test before committing.

Building from source and what upgrades cost

The repository is a patch set over upstream Firefox, not a fork with its own tree. The top-level Makefile exposes the pipeline: bootstrap pulls mozilla-firefox/firefox, patch applies everything under patches/, build compiles, package produces multi-platform artifacts, clean removes build output, and reset hard-resets upstream. The Makefile comments point to scripts/ and docs/architecture.md for detail.

make bootstrap
make patch
make build
make package

The practical cost is a full Gecko build. The README badge shows Firefox 153.0a1 as the base, and the release cadence is fast: v0.25.0 on 2026-09-17, v0.24.1 on 2026-09-07, and v0.24.0-beta.2 on 2026-09-02. Rebuilding against each upstream bump means re-resolving patches, which is the recurring maintenance burden for anyone tracking this themselves. Downloading from Releases avoids that, at the cost of trusting a self-signed binary.

Session and configuration migration is handled at the file level. A single session exports and imports as .frx-chat.json, and the README states that an imported session is inert: it does not auto-run historical tasks and does not carry API keys, working directory or environment bindings. Model accounts are stored as named configurations. Environment data lives under ~/.firefox-reverse/environments, with a manifest.json index and per-environment directories holding env.json, fingerprint.json, proxy.json, profile/, traces/, control/, captures/ and logs/. Deleting an environment deletes its profile with it, so login state and site data go too. Skills are discovered as SKILL.md from ~/.firefox-reverse/skills, a workspace .agents/skills directory and .firefox-reverse/skills.

Editorial conclusion

Adopt it if you reverse obfuscated signing parameters for a living and want tracing hooks that sit below page JavaScript, and if you can accept an undeclared licence and a build you compile or download from Releases. Do not adopt it if you need managed browser fingerprints at scale, if you want a supported commercial fingerprint browser, or if you cannot run an unsigned macOS application. Verify three things first: the licence file, whether your target site's protections survive the engine-level tools, and whether the fingerprint configuration covers the fields your target reads, since the README lists Navigator, Screen, DPR, language and timezone, UA, Accept-Language and WebGL unmasked vendor and renderer only.

Frequently asked questions

Official sources

1. Issues
2. README
3. Releases
4. WhiteNightShadow/firefox-reverse on GitHub