Skip to content

Back to the catalog

44er (@44errrr) on X
x.comthread

44er (@44errrr) on X

Announcement of hexvero, an MCP server that gives coding agents a static first look at binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). It uses zero-dependency Node parsers and marks each finding confirmed or inferred with file and line. Its tool catalog is 3,043 tokens, against a claimed 509,696 for the established reverse-engineering MCP server. Paged output with a byte budget shrinks a 541 MB Electron app to a 15 KB result, 1.3 MB of JSON to 7.9 KB, and a 450 KB build diff to 1.2 KB. radare2, rizin or Ghidra plug in for disassembly, and `npx hexvero setup --apply` registers it with Claude Code, Cursor, Codex and 15 more clients. It is a concrete example of keeping MCP tool definitions and results small enough for an agent's context window.

TL;DR hexvero is a Node-only MCP server for static binary triage by coding agents, with a 3,043-token tool catalog (vs 509,696) and byte-budgeted paged outputs.
Also seen from another angle🛡️ Security →
Document

What it claims

hexvero is an MCP server for static triage of binaries and app bundles. It inspects files without executing anything, and it is positioned as the step before a full reverse-engineering toolchain, not a replacement for one. The author's headline comparison is tool-catalog size: 3,043 tokens for hexvero against 509,696 for "the established reverse-engineering MCP server". The thread does not name that server. A catalog that size is loaded into the agent's context before any file is opened.

Evidence

All figures are the author's own. The thread says the method, numbers and scripts are in the repo, so check them there.

  • Same Electron question, both servers side by side: the established server returned 1.3 MB of JSON and hexvero returned 7.9 KB. So the 1.3 MB is the competitor's output, not a reduction of hexvero's own data.
  • 541 MB Electron app: hexvero's paged, byte-budgeted result is 15 KB.
  • Diff of two builds: 450 KB down to 1.2 KB. The baseline for this pair is not stated explicitly.

How to use it

npx hexvero setup --apply

This registers the server with Claude Code, Cursor, Codex and 15 other clients. It needs only Node. If you need disassembly, radare2, rizin or Ghidra can be attached. hexvero is free and released under the MIT licence.

Limits

  • Static only, by the author's own account. The larger tool "does far more": dynamic analysis, device work and firmware. hexvero covers none of these.
  • Findings marked "inferred" are heuristic and need verification. Only those marked "confirmed" should be taken as established.
  • Benchmarks are self-reported by the author on a small set of tasks: one Electron question and one build diff.
  • Missing details: the thread does not name the baseline server, the exact tasks, or the repository URL ("Link below" points to a reply that was not captured).

Organisations named here

  • Claude Code
  • Cursor
  • Ghidra
  • Model Context Protocol

Technologies named here

  • hexvero
  • radare2
  • rizin
  • Ghidra
  • Claude Code
  • Cursor
  • Codex
  • Established reverse-engineering MCP server
  • Model Context Protocol
  • Node.js
  • npm
  • Electron
  • SQLite
  • WebAssembly
  • Android
  • Go
  • .NET

Techniques named here

  • Byte-budgeted paging
  • Static triage for agents