Borrowing it
Nothing to install: this file belongs to joshrotenberg/hexpm-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/joshrotenberg/hexpm-mcp/main/CLAUDE.mdgit clone --depth 1 https://github.com/joshrotenberg/hexpm-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/joshrotenberg/hexpm-mcp/claude-md)<a href="https://agentmods.dev/instructions/joshrotenberg/hexpm-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/joshrotenberg/hexpm-mcp/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/joshrotenberg/hexpm-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/joshrotenberg/hexpm-mcp/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.05509 | $0.05509 |
| Opus 5.5 | $0.02204 | $0.02204 |
| Sonnet 5.5 | $0.01102 | $0.01102 |
| Haiku 4.5 | $0.00551 | $0.00551 |
Grade C, and why
hexpm-mcp CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
`rm -rf "$(./burrito_out/hexpm_mcp_<target> maintenance directory)"`. The Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`com.apple.quarantine` and macOS refuses it; `curl` does not set the attribute, How it starts
The opening of the file, as written. The whole thing — 390 lines — stays where its author put it; the contents beside it link to each section on GitHub.
hexpm-mcp
MCP server for querying hex.pm and hexdocs.pm. Deployed on Fly.io and published
to Hex. The current version is in .release-please-manifest.json (0.3.8 at the
time of writing).
Built with snodo in Elixir. The Rust/tower-mcp version is archived on the
master branch; main is the default branch.
snodo is published on Hex (snodo and snodo_jsv) and resolved through the
snodo_dep/3 helper in mix.exs. Setting SNODO_PATH points both packages at
one local checkout. The MCP layer moved from anubis_mcp to snodo in #81.
Architecture
lib/
hexpm_mcp.ex -- Public API (25 functions returning structured maps)
hexpm_mcp/
application.ex -- OTP app: resolves CLI config, starts cache + transport,
or runs init and halts
client.ex -- HTTP client for hex.pm API (Req)
hexdocs.ex -- HexDocs client: sidebar_items parsing, HTML-to-markdown
osv.ex -- OSV.dev client for vulnerability auditing
toolbox.ex -- Elixir Toolbox client: curated discovery (groups, trending, search)
cache.ex -- ETS-based response cache with TTL + sweeper
types.ex -- Response structs (Package, Release, Owner)
formatter.ex -- Markdown formatting (one function per API call)
cli.ex -- Cheer command tree; argv -> server config or init
cli/init.ex -- the init subcommand's options
init.ex -- hexpm_mcp init: writes the local marketplace and
registers it through the claude and codex CLIs
mcp/
server.ex -- Snodo.Server definition (24 tools, 5 resources, 6 prompts)
stdio_lifecycle.ex -- stdio task: runs Snodo.Transport.Stdio.serve/2,
halts 0 at EOF and 1 on transport failure
package_completion.ex -- package-name completion for resource and prompt
arguments (one cached hex.pm search page)
mcp/tools/ -- Thin wrappers: call HexpmMcp API -> Formatter -> Snodo.Result
search.ex, info.ex, versions.ex, release.ex, features.ex,
dependencies.ex, downloads.ex, owners.ex, readme.ex,
compare.ex, health.ex, audit.ex, alternatives.ex, dep_tree.ex,
docs.ex, doc_item.ex, search_docs.ex,
audit_mix_deps.ex, upgrade_check.ex,
toolbox_groups.ex, toolbox_group.ex, toolbox_category.ex,
toolbox_trending.ex, toolbox_search.ex
mcp/resources/ -- URI resources: hex://{name}/info, /readme, /docs;
toolbox://groups, toolbox://{group}/{category}
mcp/prompts/ -- Guided analysis prompts (6): analyze_package,
compare_packages, evaluate_dependencies,
recommend_packages, migration_guide, package_review
priv/plugin/hexpm/ -- Claude Code and Codex plugin, embedded by init.ex
.claude-plugin/plugin.json, .codex-plugin/plugin.json -- no version; init adds it
skills/hexpm/SKILL.md -- dependency workflow skill
hooks/hooks.json, hooks/mix-deps.sh -- PostToolUse hook on mix.exs / mix.lock edits
test/
test_helper.exs
hexpm_mcp_test.exs -- API-level tests (Bypass mocks)
hexpm_mcp/
client_test.exs -- Client HTTP tests (Bypass)
cache_test.exs -- Cache TTL/fetch tests
cli_test.exs -- argv parsing and config/1
formatter_test.exs -- Markdown formatter tests
hexdocs_test.exs -- HTML-to-markdown tests
init_test.exs -- init planning, written files, host steps (fake runner)
plugin_test.exs -- manifests, skill names only served tools, hook script
toolbox_test.exs -- Elixir Toolbox client tests (Bypass)
mcp/
server_test.exs -- discovery, catalogs, argument validation,
HTTP listener per protocol version
application_acceptance_test.exs -- tools and resources over direct, stdio, and HTTP
discovery_workflow_test.exs -- completions, list caching and cursors,
package_review elicitation
stdio_lifecycle_test.exs -- the real app over stdio: EOF, drain,
initialize-era negotiation, failure exits
fixtures/
mcp_tool_catalog.json -- expected tools/list catalog (server_test.exs)
support/
fixtures.ex -- Shared test data builders
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 390 lines · 5,509 tokens per session scan C 17d1394a6b30
hexpm-mcp CLAUDE.md is an instructions file published in the GitHub repository joshrotenberg/hexpm-mcp (2 stars, last pushed 6d ago), licensed MIT. It adds 5,509 tokens to every session, about $0.0220 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-29.
hexpm-mcp CLAUDE.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| hexpm-mcp CLAUDE.mdjoshrotenberg/hexpm-mcp | Instructions file | 2 | 6d ago | MIT | C | 5,509 | Claude Code |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | yesterday | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |