hexvero runs on your own machine — the client starts it, so there is no endpoint to ping. 3 164 installs a week from npm. Last commit 25 Oct 2026.
Electron release diff for security review: what changed in IPC, contextBridge, windows and hosts.
What the code does
We read the source, 1 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
этот файл ставится пользователю, но в репозитории его нет
spawn(cmd, args, { detached: true, stdio: "ignore" }).unref();
…length,` of `,n.data.total,` imports loaded; relationships beyond that are not drawn`]}),(0,j.jsx)(`span`,{children:`· select a module (click or Tab + Enter) to trace its imports`})]}),(0,j.jsx)(`div`,{className:`graph`,children:(0,j.jsxs)(`svg`,{width:a.width,height:a.height,ro…
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add hexvero -- npx -y hexvero{
"mcpServers": {
"hexvero": {
"command": "npx",
"args": [
"-y",
"hexvero"
]
}
}
}[mcp_servers.hexvero]
command = "npx"
args = ["-y", "hexvero"]{
"mcpServers": {
"hexvero": {
"command": "npx",
"args": [
"-y",
"hexvero"
]
}
}
}{
"servers": {
"hexvero": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"hexvero"
]
}
}
}Alternatives to hexvero
same job, measured the same waySecurity reviews for coding agents: diffs checked against your org policy and live infrastructure.
Enterprise code intelligence for M&A, security audits, and tech debt. Hosted server with 200k free.
Track domain expiry, DNS, SSL and email security across registrars, and explain what changed.
Secure local-first MCP server for licensed ArcGIS Pro and ArcPy on Windows.
PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths
What changed in your stack since the model's cutoff, error fixes, and security-scanned skills/MCPs
MCP server for PR code review, commit messages, changelogs, and secret detection.
Diagnose AI workflows for failure, security, and handoff risks — RED/AMBER/GREEN per node.
hexvero — questions
Answers built from our own checks of this server.