Hex.pm MCP

hexpm-mcp

MCP server for querying hex.pm and hexdocs.pm -- the Elixir/Erlang package registry and documentation hosting.

Built with snodo. It speaks MCP 2026-07-28, 2025-11-25, and 2025-06-18 over stdio and Streamable HTTP. See Protocol compatibility for what the older revisions lack.

It provides 24 tools, six prompts, and package resources. Tool arguments are validated against their JSON Schemas, each list fits on one page with cache hints, and prompt and resource arguments complete package names. The package_review prompt asks for its focus (quality, security, or upgrade) when the argument is omitted and the client supports elicitation. Otherwise the review covers all three.

The server sends instructions that name the tools to start with for each task. hexpm_mcp init installs it as a Claude Code and Codex plugin, together with a skill for evaluating, upgrading and auditing dependencies.

Quick Start

A public instance is running at https://hexpm-mcp.fly.dev/mcp. Add it to your MCP client config (Claude Desktop, Claude Code, or any MCP client):

{

"mcpServers": { "hexpm": { "type": "http", "url": "https://hexpm-mcp.fly.dev/mcp" } } }

Protocol compatibility

A client that proposes a revision not in this table is offered 2025-11-25.

On 2025-11-25 and 2025-06-18:

• The server sends no requests to the client, so package_review without a focus returns a review across all three focuses instead of asking.
• HTTP is stateless. initialize issues no Mcp-Session-Id, every later request needs an MCP-Protocol-Version header, and GET and DELETE on /mcp return 405.

Upgrading from 0.3.7. 0.3.7 and earlier were built on anubis_mcp. They

also served 2025-03-26 and 2024-11-05, and kept HTTP sessions with a GET

event stream. Clients that depend on those can no longer connect.

Checked over stdio on 2026-09-26: Codex 0.157.1 negotiates 2025-06-18, and Claude Code 2.1.283 uses 2026-07-28.

Installation

Three ways to get it, depending on how you want to use it.

Standalone binary (recommended)

A self-contained binary for macOS, Linux, and Windows. It bundles the Erlang runtime, so no Elixir toolchain is required.

curl -fsSL https://raw.githubusercontent.com/joshrotenberg/hexpm-mcp/main/scripts/install.sh | sh

The installer resolves the latest release, picks the asset for your OS and architecture, verifies its sha256, and installs to ~/.local/bin. It will tell you if that directory is not on your PATH.

To choose a different directory or pin a version, pass the flags through sh:

curl -fsSL https://raw.githubusercontent.com/joshrotenberg/hexpm-mcp/main/scripts/install.sh | sh -s -- --install-dir /usr/local/bin

curl -fsSL https://raw.githubusercontent.com/joshrotenberg/hexpm-mcp/main/scripts/install.sh | sh -s -- --version v0.3.6

Windows uses the PowerShell equivalent:

iex (irm https://raw.githubusercontent.com/joshrotenberg/hexpm-mcp/main/scripts/install.ps1)

Every release also attaches the archives and a combined checksums-sha256.txt if you would rather install by hand.

Verify it works:

hexpm_mcp --version

See Usage for the MCP client config, and macOS: "Apple could not verify hexpm_mcp" if Gatekeeper blocks a browser-downloaded copy. For Claude Code and Codex, hexpm_mcp init sets it up in one step.

As an Elixir library

For the public API from iex or your own code, without running an MCP server:

def deps do

[{:hexpm_mcp, "~> 0.3"}] end

From source

git clone https://github.com/joshrotenberg/hexpm-mcp.git

cd hexpm-mcp mix deps.get

Features

• 24 tools for searching, inspecting, comparing, auditing, and discovering hex.pm packages
• 5 resources for structured package and discovery data access
• 6 guided analysis prompts
• Server instructions naming the entry tools for each task
• A Claude Code and Codex plugin (MCP server, skill, and hook) installed by hexpm_mcp init
• HexDocs browsing (module listing, doc search, full module docs)
• Curated package discovery via Elixir Toolbox (groups, trending, enriched search)
• OSV.dev vulnerability checking
• Mix.exs dependency auditing and upgrade checking
• ETS-based response caching with configurable TTL
• Dual transport: stdio (Claude Code/Desktop) and StreamableHTTP (remote)
• Public Elixir API usable directly from iex

Tools

Package information

Documentation browsing

Analysis

Mix.exs analysis

Discovery (Elixir Toolbox)

Curated discovery via the Elixir Toolbox API. Project results carry GitHub/GitLab stats, a popularity score, and health signals not exposed by the raw hex.pm API.

Example Output

Health check

# Health Check: req

Maintenance

• Age: 4 years ago
• Total versions: 52
• Status: Active
• Days since last release: 57

Popularity

• All-time downloads: 11.5M
• Recent (90 days): 1.6M
• Weekly: 141.5K

Quality

• Documentation: available
• Licenses: Apache-2.0
• Dependencies: 3 required, 4 optional
• Elixir requirement: ~> 1.14

Risk

• Maintainers: 1 (single maintainer!)
• Retired versions: 0

Package comparison

# Package Comparison

Dependency audit

# Dependency Audit: phoenix v1.8.5

Checked 10 dependencies. 8 warning(s) across 7 package(s).

• bandit: 1 retired version(s)
• jason: single maintainer
• plug: 2 retired version(s); 3 known vulnerability(ies)
• telemetry: no issues

Usage

Claude Code and Codex (hexpm_mcp init)

From 0.3.9, the binary installs itself as a plugin for Claude Code and Codex. The plugin bundles the MCP server with a skill that tells the agent when to use these tools: before adding a dependency, when upgrading, when auditing a project, and when writing code against a package's API. In Claude Code it also adds a hook that suggests audit_mix_deps and upgrade_check after an edit to mix.exs or mix.lock.

hexpm_mcp init --dry-run

hexpm_mcp init

--dry-run shows the files and host commands without changing anything. init writes a local plugin marketplace, including a copy of the binary, to ~/.local/share/hexpm_mcp (or $XDG_DATA_HOME/hexpm_mcp). It then registers the marketplace with claude plugin and codex plugin. It configures whichever of the two is installed, and --host claude or --host codex picks one. It does not edit either host's configuration files directly. Reload plugins or start a new session afterwards.

Run hexpm_mcp init again after upgrading the binary to update the plugin.

If you already added hexpm-mcp as an MCP server by hand, init lists that entry when it finishes. The agent would otherwise see every tool twice, so remove one of them, for example with claude mcp remove hexpm.

To remove the plugin:

claude plugin uninstall hexpm@hexpm-local --scope user

claude plugin marketplace remove hexpm-local codex plugin remove hexpm@hexpm-local codex plugin marketplace remove hexpm-local

init is not supported on Windows yet.

Standalone binary (stdio)

Once installed:

{

"mcpServers": { "hexpm": { "command": "hexpm_mcp", "args": ["--transport", "stdio"] } } }

The binary defaults to stdio, so args can be omitted. Run hexpm_mcp --help for the full option list.

To serve over HTTP instead, pass --transport http. MCP is served at /mcp:

hexpm_mcp --transport http --port 1234

MCP endpoint: http://localhost:1234/mcp

macOS: "Apple could not verify hexpm_mcp"

The binaries are not code-signed or notarized. macOS attaches a quarantine attribute to anything downloaded by a browser, and refuses to run an unsigned executable carrying it:

"hexpm_mcp" Not Opened. Apple could not verify "hexpm_mcp" is free of

malware that may harm your Mac or compromise your privacy.

Choose Done, not Move to Trash, then clear the attribute:

xattr -d com.apple.quarantine /path/to/hexpm_mcp

The System Settings route works too: Privacy & Security, then Open Anyway next to the blocked-binary notice.

The installer above is unaffected, because curl does not set the quarantine attribute. Only browser downloads do, so installing with curl or wget avoids this entirely. If you do download the tarball in a browser, extract it with tar -xzf from a terminal rather than double-clicking, since Archive Utility propagates the attribute to the extracted files.

From source (stdio)

To run from a checkout, e.g. for development:

{

"mcpServers": { "hexpm": { "command": "mix", "args"