maximilianfeix/hexvero

Try it · Use cases · Install · What it reads · CLI · Web UI · For AI agents · Engines · Limits · Compared with REA · How it works · Contributing · FAQ
---
**Evidence-first software intelligence: inspect artifacts, trace interfaces, compare builds. Locally, without running them.**
hexvero reads executables, Electron apps, APKs, archives, databases and network captures **without running them**. It tells you what the software contains, what it exposes, where each fact was read, how sure it is, and what it could not establish. One CLI, one MCP server for coding agents, one local web UI. Nothing leaves your machine.
25 seconds of real output on the example app in examples/ · step by step
Try it
Node.js 22.12 or newer is all it needs. From an empty npm cache the first result took one command and about nine seconds on a laptop, download included. A real run on the small Electron app in examples/:
A filled dot is a fact read from the file, a hollow dot an inference from a pattern; @ main.js:14 is where it was read. Settings are reported as written, never as assumed Electron defaults. ${…} marks the part of an address that is computed at run time. The windows collection puts each window's nodeIntegration, contextIsolation and sandbox side by side as true, false, computed or not written and says what follows from them together; a value that rests on Electron's default for the version in package.json is marked default on / default off. The rules and their sources are in docs/electron-findings.md. The IPC finding is a filled dot only when every IPC-shaped call could be traced; otherwise the limitations name the calls that could not, with file and line.
What people use it for
**1. Understand an unfamiliar application.** You downloaded a binary, an Electron app or an APK. hexvero says what it is, what it exposes and where the evidence is, and suggests what to look at next. On a native program it names the hardening and the imports worth a look:
**2. Compare two versions.** What changed between two builds, list by list, with the item as evidence. Code that only moved is not reported as changed. Without a list name, compare counts the differences in every list both builds have, so you know where to look:
The interfaces list joins each preload member to the windows that load it and to the main-process handler on its channel, with file and line, and says how the link was made (direct, resolved, or unresolved/unknown with the reason). Walkthroughs: Electron interface map, release interface diff.
Nothing is ignored by default; code that only moved in a native binary is counted as relocated. Windows are matched by the variable they are assigned to (win), so adding a window does not mis-pair the others. An item found on one side only is added or removed only if the other side read the file it sits in and compared its whole list; otherwise it is unknown (?), with the reason.
**3. Let an AI agent investigate.** npx hexvero setup --apply registers the MCP server with the coding agents it finds (Claude Code, Codex, Cursor, VS Code, and 14 more), and npx hexvero setup --skill --apply installs a skill that teaches the investigation loop. The agent then opens a target, reads a small first answer with suggested next calls, pages only the lists it needs, and cites file:line for each claim. Text inside the target is treated as data, never as instructions; a test plants such text in a target to check it. See For AI agents.
Why hexvero
- **It never runs what it reads.** Every format is parsed by code in this repository. Engines are optional and only ever read files.
- **Evidence and honesty.** Findings are confirmed or inferred and carry the file and line where a parser records one. limitations say what was skipped, cut or unreadable. A partial result says it is partial, down to each page of a list.
- **Measured, not claimed.** A corpus with written-down correct answers measures per kind of finding what is found, missed and wrongly reported, including on a set written by someone without access to hexvero. CI fails when a result gets worse. On that unseen set hexvero found more IPC channels, settings, endpoints and storage keys than REA 6.4.0 with far fewer false reports, and still misses a lot; both are shown below.
- **Small answers for agents.** The MCP catalog is 14 KB (3,300 tokens). A full Electron investigation of the corpus's hold-out app costs about 3,000 tokens; every list is a page with a hard byte budget and the complete result goes to a file on request (numbers).