44er (@44errrr) on X
hexvero is a Node-only, zero-dependency MCP server that gives coding agents a static first-look triage of binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). Findings are marked confirmed or inferred with file and line, and outputs are paged with a byte budget (a 541 MB Electron app yields a ~15 KB result). The author contrasts its 3,043-token tool catalog with a 509,696-token catalog of an established RE MCP server. radare2, rizin or Ghidra can be plugged in for disassembly, and setup registers it with Claude Code, Cursor, Codex and 15 more clients.
What it is
hexvero is an MIT-licensed, Node-only MCP server that gives a coding agent a static first look at binaries and app bundles without executing them. The author (@44errrr) built it as a low-context alternative to an established reverse-engineering MCP server, which they say has a 509,696-token tool catalog. hexvero's is 3,043 tokens.
How it works
The page gives only a high-level description:
- Parsers have zero dependencies.
- Every finding is marked confirmed or inferred, with file and line.
- Lists are paged against a byte budget, which keeps results small.
- radare2, rizin or Ghidra can be plugged in when disassembly is needed.
What to do
Measured comparisons the author reports, beyond the headline catalog size:
| Task | Before | hexvero |
|---|---|---|
| Same Electron question, side by side | 1.3 MB JSON | 7.9 KB |
| Diff of two builds | 450 KB | 1.2 KB |
The page does not say which tool produced the "before" figures. It says the method, numbers and scripts are in the repo, so you can reproduce them against your own targets.
To install and register with your agent clients:
npx hexvero setup --applyThe page says this registers hexvero with Claude Code, Cursor, Codex and 15 more clients. It runs a setup that modifies client configs, so read the repo first if that matters in your environment.
Caveats
- The author states the larger tool does much more: dynamic analysis, devices and firmware. hexvero is positioned as triage before that, not a replacement.
- The numbers are the author's own, from a single post. The page carries no independent verification, and it does not name the competing server.
- The page only describes static analysis. Anything needing execution or deep disassembly depends on the optional radare2, rizin or Ghidra backends.
Organisations named here
- hexvero
Technologies named here
- Established reverse-engineering MCP server
- radare2
- Rizin
- Model Context Protocol
- Ghidra
- Node.js
- Claude Code
- Cursor
- Codex
Techniques named here
- Binary diffing of two builds
Related in Malware & RE
Reverse Engineering the Six Stages of MacSync Stealer and RAT
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
ClickFix Removes Your Background but Leaves the Malware
