Flyntor finds hidden frontend modules and reconstructs their source

Flyntor collects the JavaScript files that make up a web application. It reads the bundler runtime to discover lazy-loaded modules that the current page never requests. When source maps include the original content, Flyntor rebuilds the source files and directory structure locally.

Capabilities: • discovers regular and lazy-loaded modules from the bundler runtime; • extracts source files from inline and external source maps; • finds routes, GraphQL operations, DOM sinks, and postMessage listeners; • compares frontend code across application versions; • provides the collected code to external agents through MCP.

This can reveal administrative UI code, client-side role checks, and API calls that a normal crawl may miss. Without source maps, Flyntor still analyzes the minified bundles but cannot reconstruct the original files. Network requests require an explicit scope, and every result still needs manual verification.

Tool: https://github.com/flyntor/flyntor