Spec Driven Development
by formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Runs on your computer★ 440MITUpdated 14 months ago
Install
hexvero
Overview
Description from the maker (original English)
Electron release diff for security review: what changed in IPC, contextBridge, windows and hosts.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs on your computer
- Transport: stdio
- Category: Other
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- The registry lists no key to fill in.
You need
- npmNode.js installed (for the npx command)
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"hexvero": {
"command": "npx",
"args": [
"-y",
"hexvero",
"mcp"
]
}
}
}Run this in your terminal
claude mcp add hexvero -- npx -y hexvero mcpOr copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"hexvero": {
"command": "npx",
"args": [
"-y",
"hexvero",
"mcp"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"hexvero": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"hexvero",
"mcp"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account maximilianfeix, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Otheri
- More stars than 0% of the other 32684 servers in this category
- Published to the registry more recently than 73% of the other 32684 servers in this category
- Basic checks equal to or better than 100% of the other 32684 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is hexvero safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (0.12.0) reached the registry 13 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
What can I use instead?
In the same category: Spec Driven Development, Remote Desktop Commander, Master CSS
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Remote Desktop Commander
by desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Runs in the cloud★ 211Updated 2 days ago
Install
Master CSS
by master-co
Inspect Master CSS classes, generated CSS, and project stylesheets from your AI client.
Runs on your computerUpdated today
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
hexvero
Know what changed inside your Electron release.
Diff two builds of an Electron app and see the IPC channels, preload bridge, window settings and network hosts that changed, with file and line on both sides.
Website · Try it · CI · AI agents · Comparison · Limits · Docs
English · Deutsch · Español · Français · Português (Brasil) · Русский · 中文 · 日本語 · 한국어
30 seconds of real output: a terminal recording and a browser recording, joined with a fade · mp4 · terminal: release-review-terminal.tape, UI: record-release-review.mjs
Try it in 10 seconds
npx hexvero demoNeeds Node.js 22.12 or newer. It copies two builds of a small example app (NotesDesk 1.4.0 and 1.5.0) into ./hexvero-demo and shows what changed. Excerpt, … marks cuts:
What changed between notesdesk-1.4.0.asar and notesdesk-1.5.0.asarTwo builds of a small example Electron app, read statically. Nothing was executed.
interfaces (2)
- preload.js::notesdesk::checkUpdate @ b: preload.js:9, handler main.js:30 · link direct
- preload.js::notesdesk::openInShell @ a: preload.js:9, handler main.js:30 · link direct … ipcChannels (2)
- update:check @ b: receiver main.js:30, sender preload.js:9 ? shell:open @ a: receiver main.js:30, sender preload.js:9 the other side has values there that could not be resolved windows (1) ~ main.js::win @ b: main.js:8 nodeIntegration: true → false, nodeIntegrationInEffect: "on" → "off", sandbox: false → true … endpoints (1)
- main.js::fetch::https://updates.notesdesk.example/latest.json @ b: main.js:30 · literal
? means hexvero could not tell, so shell:open is reported as unknown, not as removed. Then turn it into a gate:
$ npx hexvero check hexvero-demo/notesdesk-1.4.0.asar hexvero-demo/notesdesk-1.5.0.asar --policy hexvero-demo/policy.jsonhexvero check fail: the policy is violated ✗ new-interface-member notesdesk.checkUpdate new · fail ✗ new-external-host updates.notesdesk.example new · fail … $ echo $? 3
npx hexvero ui --demo --open shows the same comparison in a local web UI with the source lines of both builds side by side. The full tour: walkthrough.
Why
- A release review asks what the update changed: which channels a page can now reach, which preload members appeared, which window got more permissive, which servers the code now calls.
- A diff of the shipped bundle does not answer that. It is minified JavaScript inside an
app.asar; running the app to find out is not always allowed, and a checklist scanner looks at one build, not the change. - hexvero answers it from the files: each change with the file and line it was read from in both builds, what it could not establish, and a policy that fails CI on a new member, host or more permissive window. Nothing is executed.
What it reads
| IPC and bridge map | window → contextBridge member → IPC channel → ipcMain handler, with how each link was read |
| Window settings | webPreferences per window, and whether nodeIntegration and sandbox are in effect |
| Runtime and fuses | Electron, Chromium and Node versions, fuses and the ASAR integrity record, read from packaged binaries |
| Hosts and storage | network endpoints and localStorage/sessionStorage keys, literal or inferred |
| CI gate and SARIF | hexvero check: exit 0 pass, 3 violated, 4 not decidable; baseline, suppressions, SARIF 2.1.0 |
| MCP for agents | 16 tools with small paged answers, so a coding agent can run the same review |
| Local web UI | the comparison with both builds' source lines side by side, plus an offline HTML report |
Inputs: an app.asar, a macOS .app, a Windows or Linux install directory, or the release .zip you publish. Installers (.dmg, setup .exe, AppImage) need unpacking first. Per-platform paths: docs/cli.md.
On your own app
npx hexvero compare old/YourApp.app new/YourApp.app --report report.html # one offline HTML pagenpx hexvero init old/YourApp.app # starting policy, current hosts allowed npx hexvero check old/YourApp.app new/YourApp.app --policy .hexvero/policy.json
To accept what is there today, add --baseline .hexvero/baseline.json --update-baseline once; later runs fail only on new findings.
One build instead of two, with the single-build checks known from Electronegativity (CSP, shell.openExternal, permission handlers, window settings, certificate and command-line switches; from 0.13 also , custom protocols, executeJavaScript with code that is not a literal, resources over plain http and an Electron runtime past its end of support):
npx hexvero audit YourApp.app --format sarif > audit.sarif # exit 3 when a rule is violatedUse it in CI
Pinned to a version so a release cannot change your results unannounced:
jobs:hexvero: runs-on: ubuntu-latest permissions: contents: read steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7 with: node-version: 24
Build your app and fetch the previous release here, e.g. into previous/ and dist/.
- run: npx --yes hexvero@0.12.0 check previous/app.asar dist/app.asar --policy .hexvero/policy.json
Baseline, Markdown job summary and a least-privilege SARIF upload for code scanning: docs/ci.md.
For AI agents
In Claude Code, server and skill come as one plugin:
/plugin marketplace add maximilianfeix/hexvero/plugin install hexvero@hexvero
Elsewhere, npx hexvero setup --apply registers the MCP server with the coding agents it finds (dry run without --apply), or run npx -y hexvero@0.12.0 mcp over stdio. Text inside the target is treated as data, never as instructions. Clients, tools and what an agent receives: docs/mcp.md.
How it compares
| hexvero | Electronegativity | REA | diff of two bundles | |
|---|---|---|---|---|
| Built for | what changed between two builds | known risky patterns in one build | broad reverse engineering, static and dynamic | any text change |
| Compares two builds of one app | yes, list by list | no (one build; checks between Electron versions) | yes (compare_application_versions) | yes, minified bytes |
Bridge member → IPC channel, blind holdout2 | 65 of 78 | not measured | 6 of 66 | no |
| Release policy with CI exit codes | yes (0/3/4, SARIF) | SARIF output | not compared | no |
CSP, shell.openExternal, permission handlers | yes, hexvero audit (0.12) | yes | not compared | no |
, protocols, executeJavaScript | yes, hexvero audit (0.13) | yes | not compared | no |
| Status | active, MIT | archived 2026-10-24, last release 2023 | active | n/a |
Electronegativity was archived on 2026-10-24. From 0.13, hexvero audit runs its security checks with the same exit codes and SARIF as check, except two for options Electron has removed (affinity, auxclick) and its 27 API-upgrade checks; the check-by-check list is in the migration page. REA does much that hexvero does not (dynamic analysis, devices, decompilers); use it for that. Sources, dates and every caveat: docs/comparison.md.
Accuracy and limits
On the newest blind set, written by someone without access to hexvero, it found 52 of 64 IPC channels with none false, and it misses and misreports rows in other lists (all numbers). On real releases it is checked against the source (GitHub Desktop 3.6.7 → 3.6.10, Electron Fiddle 0.38 → 0.39), misses included. It reads files and never runs them, so a finding is what the code contains, not what it does at run time or whether it is exploitable; a passing check is not a security verdict. Parsing a hostile file still processes attacker-controlled bytes, within size, depth and time limits. The full list: docs/accuracy.md.
Docs
Walkthrough · CLI · CI · MCP · Policy schema · Electron rules and sources · Accuracy · Benchmarks · Other formats (native binaries, APK, WebAssembly and more) · Changelog
FAQ: does it run or upload my files?
No. Targets are parsed as bytes; nothing is executed. The UI binds to 127.0.0.1 with a per-session token. There is no telemetry and no network call in the code base. Throu
Only the beginning is shown; read the rest in the repo