hexvero
Know what changed inside your Electron release.
Diff two builds of an Electron app and see the IPC channels, preload bridge, window settings and network hosts that changed, with file and line on both sides.
Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y [email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add hexvero -- npx -y hexvero@0.12.0รันในเทอร์มินัล
{ "mcpServers": { "hexvero": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
Know what changed inside your Electron release.
Diff two builds of an Electron app and see the IPC channels, preload bridge, window settings and network hosts that changed, with file and line on both sides.
Know what changed inside your Electron release. Electron release diff for security review: compare two builds (app.asar, .app, install directory, release ZIP) and see what changed in IPC, contextBridge, window settings, network hosts and storage, with fil
25 seconds, real output · mp4 · recorded with release-gate.tape
npx hexvero demo
Needs Node.js 22.12 or newer. It copies two builds of a small example app (NotesDesk 1.4.0 and 1.5.0) into ./hexvero-demo and shows what changed. Excerpt, … marks cuts:
What changed between notesdesk-1.4.0.asar and notesdesk-1.5.0.asar
Two builds of a small example Electron app, read statically. Nothing was executed.
interfaces (2)
+ preload.js::notesdesk::checkUpdate @ b: preload.js:9, handler main.js:30 · link direct
- preload.js::notesdesk::openInShell @ a: preload.js:9, handler main.js:30 · link direct
…
ipcChannels (2)
+ update:check @ b: receiver main.js:30, sender preload.js:9
? shell:open @ a: receiver main.js:30, sender preload.js:9
the other side has values there that could not be resolved
windows (1)
~ main.js::win @ b: main.js:8
nodeIntegration: true → false, nodeIntegrationInEffect: "on" → "off", sandbox: false → true
…
endpoints (1)
+ main.js::fetch::https://updates.notesdesk.example/latest.json @ b: main.js:30 · literal
? means hexvero could not tell, so shell:open is reported as unknown, not as removed. Then turn it into a gate:
$ npx hexvero check hexvero-demo/notesdesk-1.4.0.asar hexvero-demo/notesdesk-1.5.0.asar --policy hexvero-demo/policy.json
hexvero check fail: the policy is violated
✗ new-interface-member notesdesk.checkUpdate new · fail
✗ new-external-host updates.notesdesk.example new · fail
…
$ echo $?
3
npx hexvero ui --demo --open shows the same comparison in a local web UI with the source lines of both builds side by side. The full tour: walkthrough.
app.asar; running the app to find out is not always allowed, and a checklist scanner looks at one build, not the change.Inputs: an app.asar, a macOS .app, a Windows or Linux install directory, or the release .zip you publish. Installers (.dmg, setup .exe, AppImage) need unpacking first. Per-platform paths: docs/cli.md.
npx hexvero compare old/YourApp.app new/YourApp.app --report report.html # one offline HTML page
npx hexvero init old/YourApp.app # starting policy, current hosts allowed
npx hexvero check old/YourApp.app new/YourApp.app --policy .hexvero/policy.json
To accept what is there today, add --baseline .hexvero/baseline.json --update-baseline once; later runs fail only on new findings.
Pinned to a version so a release cannot change your results unannounced:
jobs:
hexvero:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
with:
node-version: 24
# Build your app and fetch the previous release here, e.g. into previous/ and dist/.
- run: npx --yes [email protected] check previous/app.asar dist/app.asar --policy .hexvero/policy.json
Baseline, Markdown job summary and a least-privilege SARIF upload for code scanning: docs/ci.md.
In Claude Code, server and skill come as one plugin:
/plugin marketplace add maximilianfeix/hexvero
/plugin install hexvero@hexvero
Elsewhere, npx hexvero setup --apply registers the MCP server with the coding agents it finds (dry run without --apply), or run npx -y [email protected] mcp over stdio. Text inside the target is treated as data, never as instructions. Clients, tools and what an agent receives: docs/mcp.md.
Electronegativity's README says it is no longer maintained. hexvero covers its use case for release review; parity with its full list of checks is in progress, not shipped. REA does much that hexvero does not (dynamic analysis, devices, decompilers); use it for that. Sources, dates and every caveat: docs/comparison.md.
On the newest blind set, written by someone without access to hexvero, it found 52 of 64 IPC channels with none false, and it misses and misreports rows in other lists (all numbers). It reads files and never runs them, so a finding is what the code contains, not what it does at run time or whether it is exploitable; a passing check is not a security verdict. Parsing a hostile file still processes attacker-controlled bytes, within size, depth and time limits. The full list: docs/accuracy.md.
Walkthrough · CLI · CI · MCP · Policy schema · Electron rules and sources · Accuracy · Benchmarks · Other formats (native binaries, APK, WebAssembly and more) · Changelog
No. Targets are parsed as bytes; nothing is executed. The UI binds to 127.0.0.1 with a per-session token. There is no telemetry and no network call in the code base. Through a cloud-hosted agent, the results that agent requests go to its model provider like any other tool output. Use hexvero only on software you may examine (DISCLAIMER.md).
npm install && npm run check # typecheck, lint, format, unit tests, shape rules
npm run e2e # the user flows on real inputs
Rules in CONTRIBUTING.md; good first issue is sized for an afternoon. Found a wrong or missing fact? Open a bug report with hexvero doctor output and, if you can, the file.
If hexvero showed you something you would have missed in a release, a ⭐ helps the next Electron team find it.
MIT
Know what changed inside your Electron release. Electron release diff for security review: compare two builds (app.asar, .app, install directory, release ZIP) and see what changed in IPC, contextBridg
{ "mcpServers": { "hexvero": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}ภาพรวม
Know what changed inside your Electron release. Electron release diff for security review: compare two builds (app.asar, .app, install directory, release ZIP) and see what changed in IPC, contextBridge, window settings, network hosts and storage, with fil
เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Hexvero ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-11-14 Know what changed inside your Electron release. Electron release diff for security review: compare two builds (app.asar, .app, install directory, release ZIP) and see what changed in IPC, contextBridge, window settings, network hosts and storage, with fil