hexvero

See what a file is before you trust it, run it or rebuild it.

hexvero reads executables, app bundles, databases and captures on your machine without executing them, and tells you what it found, how sure it is, and what it could not establish.

Install Connect your agent npm

$ npx hexvero ui --open
$ npx hexvero analyze ./app.asar
$ npx hexvero setup --apply

/opt/homebrew/bin/gh · macho · 51 MB · 90 ms

Mach-O arm64 executable, 4 dylibs, 144 symbols · Go 1.25.1 (github.com/cli/cli/v2/cmd/gh)

Imports ptrace/sysctl (possible anti-debugging) inferred

cgo enabled (links C code) confirmed

00000000 cf fa ed fe 0c 00 00 01 00 00 00 00 02 00 00 00 .... 00000010 15 00 00 00 b8 10 00 00 85 00 20 00 00 00 00 00 ....

collections: segments 5 · sections 15 · symbols 144 · libraries 4 · goDependencies 212

Built for the questions people actually ask

Which IPC channels can this Electron renderer reach? Is this binary stripped and PIE? Which Go modules shipped? What permissions does this APK take? hexvero answers from the bytes, with evidence, and never runs the target.

Zero-dependency parsers

Every built-in parser is code in the repository. No JDK, no Python, no disassembler before the first useful answer.

Bounded by design

Every list is a page with offset, limit, a filter and a byte budget. The full result goes to a file, never into your context window.

Honest output

Findings are confirmed or inferred. Whatever was skipped, truncated or unreadable is listed as a limitation with a code.

Engines when you want them

radare2, rizin and Ghidra plug in behind one interface for disassembly and decompilation. hexvero never installs them for you.

What it reads

Target	What comes back
ELF · PE · Mach-O	Sections, segments, symbols, imports and exports, libraries, build ids, hardening flags (NX, PIE, RELRO, canary, ASLR, CFG, code signature).
Go · .NET	Compiler version, main module and dependencies, build settings; assembly, types, methods, P/Invoke, user strings.
WebAssembly · EVM	Imports, exports, producers; selector dispatch, solc metadata, DELEGATECALL and SELFDESTRUCT.
Android APK · DEX · JAR	Manifest, permissions, components, deep links, native libraries, classes and packages, frameworks.
Electron · JavaScript · source maps	Module graph, IPC channel matching, preload and sandbox flags, original positions.
macOS and iOS apps	Bundle facts, entitlements, privacy keys, helpers, frameworks and the main binary.
SQLite · plist · HAR	Schema with samples, decoded property lists, hosts and API-like endpoints.

ELF
PE
Mach-O
Go
.NET
WASM
EVM
APK
DEX
JAR
ASAR
JavaScript
source maps
.app bundles
SQLite
plist
HAR

15 MCP tools, a 13.7 KB catalog

The catalog stays under 32 KiB so small-context models keep working. Open, analyze, page, read bytes, export: it reads like a workflow.

Register hexvero with the agent clients found on your machine (Claude Code, Codex, Cursor, Windsurf, Gemini CLI, VS Code and more).
```
npx hexvero setup --apply
```

Ask a question about a file on your machine.

Open ~/Downloads/app.asar with hexvero, list the IPC channels the renderer can reach
and tell me whether nodeIntegration is on.

The agent pages through symbols, strings or modules and exports the full analysis when it needs everything.
```
hexvero_collection { targetId, collection: "ipcChannels" }
hexvero_export { targetId, path: "./app.hexvero.json" }
```

A workbench, not a dashboard

hexvero ui starts a loopback server with a per-session token. Drop a file anywhere: verdict, fact sheet, hardening marks, findings with confidence, one tab per collection that exists, a hex viewer that decodes the selected byte in both byte orders, and a module graph for Electron apps. Dark and light, keyboard first, phone layout.

See the UI