Skip to content

Back to the catalog

44er (@44errrr) on X
x.comtool

44er (@44errrr) on X

hexvero is a Node-only, zero-dependency MCP server that gives coding agents a static first-look triage of binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). Findings are marked confirmed or inferred with file and line, and outputs are paged with a byte budget (a 541 MB Electron app yields a ~15 KB result). The author contrasts its 3,043-token tool catalog with a 509,696-token catalog of an established RE MCP server. radare2, rizin or Ghidra can be plugged in for disassembly, and setup registers it with Claude Code, Cursor, Codex and 15 more clients.

TL;DR Token-lean static binary triage MCP server (hexvero) for agents: 18 formats, paged outputs, optional radare2/rizin/Ghidra backends, MIT.
Also seen from another angle🧠 AI →
Document

What it is

hexvero is an MIT-licensed, Node-only MCP server that gives a coding agent a static first look at binaries and app bundles without executing them. The author (@44errrr) built it as a low-context alternative to an established reverse-engineering MCP server, which they say has a 509,696-token tool catalog. hexvero's is 3,043 tokens.

How it works

The page gives only a high-level description:

  • Parsers have zero dependencies.
  • Every finding is marked confirmed or inferred, with file and line.
  • Lists are paged against a byte budget, which keeps results small.
  • radare2, rizin or Ghidra can be plugged in when disassembly is needed.

What to do

Measured comparisons the author reports, beyond the headline catalog size:

TaskBeforehexvero
Same Electron question, side by side1.3 MB JSON7.9 KB
Diff of two builds450 KB1.2 KB

The page does not say which tool produced the "before" figures. It says the method, numbers and scripts are in the repo, so you can reproduce them against your own targets.

To install and register with your agent clients:

npx hexvero setup --apply

The page says this registers hexvero with Claude Code, Cursor, Codex and 15 more clients. It runs a setup that modifies client configs, so read the repo first if that matters in your environment.

Caveats

  • The author states the larger tool does much more: dynamic analysis, devices and firmware. hexvero is positioned as triage before that, not a replacement.
  • The numbers are the author's own, from a single post. The page carries no independent verification, and it does not name the competing server.
  • The page only describes static analysis. Anything needing execution or deep disassembly depends on the optional radare2, rizin or Ghidra backends.

Organisations named here

  • hexvero

Technologies named here

  • Established reverse-engineering MCP server
  • radare2
  • Rizin
  • Model Context Protocol
  • Ghidra
  • Node.js
  • Claude Code
  • Cursor
  • Codex

Techniques named here

  • Binary diffing of two builds