hexvero — Claude Code MCP server: what it does, how to install
Diffs two Electron application builds to catch changes across IPC channels, preload bridges, window options, and remote endpoints. Runs without executing code.
claude mcp add hexvero -- npx -y hexveroWhat hexvero does
Hexvero inspects packaged Electron applications statically without running untrusted code. It maps connections between windows, contextBridge entries, IPC channels, and ipcMain handlers. Every change includes exact file names and line numbers from both releases.
The utility tracks webPreferences toggles such as sandbox or nodeIntegration, compares runtime versions, and uncovers outbound network hosts. For coding agents, it exposes 16 tools that return paged data. In automated pipelines, hexvero check emits exit code 3 on policy violations and exports SARIF 2.1.0 reports.
Direct inputs must be an app.asar archive, macOS .app bundle, release .zip, or unpacked install directory. Installers like .dmg files, setup .exe binaries, or AppImages must be unpacked beforehand. The runtime requires Node.js 22.12 or newer.
What it helps with
- track added or removed IPC channels between builds
- spot weakened window security flags in webPreferences
- detect newly introduced network endpoints across releases
- fail automated builds when changes violate security baselines
Example prompts for the agent
- Compare previous/app.asar and dist/app.asar to inspect modified IPC channels.
- Check old/App.app against new/App.app using .hexvero/policy.json.
- List any new external endpoints detected between the two release builds.
How to install hexvero
Platform CLI
claude mcp add hexvero -- npx -y hexveroPlatform CLI
codex mcp add hexvero -- npx -y hexveroConfig file
{
"mcpServers": {
"hexvero": {
"command": "npx",
"args": [
"-y",
"hexvero"
]
}
}
}Config file
{
"servers": {
"hexvero": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"hexvero"
]
}
}
}Platform CLI
gemini mcp add hexvero npx -y hexveroStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about hexvero
How to install hexvero in Claude Code?
Run claude mcp add hexvero -- npx -y hexvero. Make sure Node.js 22.12 or newer is available in your environment.
What does hexvero do?
It analyzes two packaged Electron builds statically to reveal diffs in IPC channels, preload bridges, window flags, and external network hosts. It inspects files without launching the application.
Which application package formats does hexvero accept?
It works directly with app.asar files, macOS .app directories, unpacked Windows or Linux installation folders, and release .zip archives. Standalone installer packages such as .dmg, AppImage, or setup .exe need to be unpacked first.
