# hexvero

Diffs two Electron application builds to catch changes across IPC channels, preload bridges, window options, and remote endpoints. Runs without executing code.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: maximilianfeix
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/maximilianfeix/hexvero
- Updated: 2026-10-19
- HTML: https://affpapa.org/en/nevibecode/mcp/hexvero

## What it does

Hexvero inspects packaged Electron applications statically without running untrusted code. It maps connections between windows, `contextBridge` entries, IPC channels, and `ipcMain` handlers. Every change includes exact file names and line numbers from both releases.

The utility tracks `webPreferences` toggles such as `sandbox` or `nodeIntegration`, compares runtime versions, and uncovers outbound network hosts. For coding agents, it exposes 16 tools that return paged data. In automated pipelines, `hexvero check` emits exit code `3` on policy violations and exports SARIF 2.1.0 reports.

Direct inputs must be an `app.asar` archive, macOS `.app` bundle, release `.zip`, or unpacked install directory. Installers like `.dmg` files, setup `.exe` binaries, or AppImages must be unpacked beforehand. The runtime requires Node.js 22.12 or newer.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add hexvero -- npx -y hexvero
```

### Codex

**Platform CLI**
```bash
codex mcp add hexvero -- npx -y hexvero
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "hexvero": {
            "command": "npx",
            "args": [
                "-y",
                "hexvero"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "hexvero": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "hexvero"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add hexvero npx -y hexvero
```

## When to use it
- track added or removed IPC channels between builds
- spot weakened window security flags in webPreferences
- detect newly introduced network endpoints across releases
- fail automated builds when changes violate security baselines

## Example prompts
- Compare previous/app.asar and dist/app.asar to inspect modified IPC channels.
- Check old/App.app against new/App.app using .hexvero/policy.json.
- List any new external endpoints detected between the two release builds.

## Similar
- [electron-pro](https://affpapa.org/en/nevibecode/agents/electron-pro.md) — subagent · 376 installs
- [electron-development](https://affpapa.org/en/nevibecode/skills/electron-development.md) — skill · 98 installs
- [security-diff-scan](https://affpapa.org/en/nevibecode/skills/security-diff-scan.md) — skill · 30 installs
- [electron](https://affpapa.org/en/nevibecode/rules/electron.md) — rule · ★ 3579
- [electron-best-practices](https://affpapa.org/en/nevibecode/skills/electron-best-practices.md) — skill · 820 installs
- [electron-dev](https://affpapa.org/en/nevibecode/skills/electron-dev.md) — skill · 305 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md