HexWitness MCP server

Give your reverse-engineering agent a memory, a map, and receipts. HexWitness turns static analysis, runtime captures, and human conclusions into one durable evidence graph.

Quick start · Why it matters · Examples · Docs · How it compares

Yesterday, your agent found the parser, mapped its callers, and proved which runtime event reached it. Today, a new chat opens and asks the live disassembler to discover everything again.

HexWitness stops that loop.

flowchart LR
  V["Binary Ninja · IDA · Ghidra"] --> X["Reviewed evidence"]
  R["Frida · debugger · wire observer"] --> C["Sealed capture"]
  C --> X
  X --> E[("HexWitness memory")]
  E --> A["Your AI agent"]
  A --> Q["Answer with proof"]
  A -.->|one named gap| V

The live viewer remains the agent's eyes. HexWitness becomes its case file: tied to an exact build, searchable across tools, honest about conflicts, and ready for the next agent.

See it work in 60 seconds

Requirements: Git and Node.js 22.13 or newer.

npm install --global hexwitness
hexwitness setup
hexwitness demo

The setup wizard connects HexWitness to Codex, Claude Code, Cursor, VS Code/Copilot, Claude Desktop, or generic MCP clients. It also installs guidance written for that agent. The MCP entry starts the local read-only daemon when needed, so there is no service choreography.

Now ask:

Use HexWitness to explain 0x401120 in build toy-v1.
Show proof, contradictions, and missing evidence separately.

The demo uses synthetic, redistributable evidence. No third-party binary data ships with HexWitness.

Prefer a checkout?

git clone https://github.com/siaginw/HexWitness.git
cd HexWitness
npm install
npm run demo
npm run setup -- --client codex --viewer none --yes
npm run doctor

Replace codex with claude-code, cursor, copilot, or generic as needed. The setup command resolves the checkout's absolute local runtime path, installs guidance tailored to the selected agent, and writes the MCP connection without requiring a global install. Restart the selected AI client after setup, then ask it to call hexwitnesshealth and hexwitnesscontract. Both must succeed before using private evidence.

[!IMPORTANT]

The checked-in .mcp.json.example assumes npm install --global hexwitness. From a source checkout, run npm run setup instead of copying that example; setup records the correct local Node.js and bundled-runtime paths.

HexWitness installs as one command. The service, MCP transport, installer, capture pipeline, and adapter catalog live behind that command:

Shortened. The full README is on GitHub.