hexpm-mcp: Instructions file for Claude Code

CLAUDE.md

hexpm-mcp CLAUDE.md is an instructions file for Claude Code from joshrotenberg/hexpm-mcp. It costs 5,509 tokens per session, scanned C, original, MIT.

A Claude Code instruction document describing the hexpm-mcp project, its structure, and its design. MCP is a standard way for an AI assistant to call connected tools and services.

In plain words
What is it for?
Use it as development context when working on the hexpm-mcp codebase, especially its Elixir application, clients, cache, and MCP transport.
Why use it?
It gives the assistant project-specific guidance instead of requiring it to infer the architecture from scratch. The supplied information does not describe a separate user-facing capability.

Instructions file for Claude Code

Written for Claude Code: PostToolUse hook event. Also seen: reads .claude/ paths; mentions .claude-plugin; mentions Claude Code.

This is joshrotenberg/hexpm-mcp's own configuration. It tells Claude Code how to work on hexpm-mcp itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything hexpm-mcp configures →

Reuse

Borrowing it

Nothing to install: this file belongs to joshrotenberg/hexpm-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/joshrotenberg/hexpm-mcp/main/CLAUDE.md
Clone the repo
git clone --depth 1 https://github.com/joshrotenberg/hexpm-mcp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for hexpm-mcp CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/joshrotenberg/hexpm-mcp/claude-md/github.svg)](https://agentmods.dev/instructions/joshrotenberg/hexpm-mcp/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/joshrotenberg/hexpm-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/joshrotenberg/hexpm-mcp/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for hexpm-mcp CLAUDE.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/joshrotenberg/hexpm-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/joshrotenberg/hexpm-mcp/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 5,509 This file is loaded in full into every session.
When invoked 5,509 The same file — it is already loaded in full.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.05509 $0.05509
Opus 5.5 $0.02204 $0.02204
Sonnet 5.5 $0.01102 $0.01102
Haiku 4.5 $0.00551 $0.00551

Measured 8d ago against content hash 17d1394a6b30, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

hexpm-mcp CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

`rm -rf "$(./burrito_out/hexpm_mcp_<target> maintenance directory)"`. The

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`com.apple.quarantine` and macOS refuses it; `curl` does not set the attribute,
CLAUDE.md · 390 lines

How it starts

The opening of the file, as written. The whole thing — 390 lines — stays where its author put it; the contents beside it link to each section on GitHub.

hexpm-mcp

MCP server for querying hex.pm and hexdocs.pm. Deployed on Fly.io and published to Hex. The current version is in .release-please-manifest.json (0.3.8 at the time of writing).

Built with snodo in Elixir. The Rust/tower-mcp version is archived on the master branch; main is the default branch.

snodo is published on Hex (snodo and snodo_jsv) and resolved through the snodo_dep/3 helper in mix.exs. Setting SNODO_PATH points both packages at one local checkout. The MCP layer moved from anubis_mcp to snodo in #81.

Architecture

lib/
  hexpm_mcp.ex             -- Public API (25 functions returning structured maps)
  hexpm_mcp/
    application.ex         -- OTP app: resolves CLI config, starts cache + transport,
                              or runs init and halts
    client.ex              -- HTTP client for hex.pm API (Req)
    hexdocs.ex             -- HexDocs client: sidebar_items parsing, HTML-to-markdown
    osv.ex                 -- OSV.dev client for vulnerability auditing
    toolbox.ex             -- Elixir Toolbox client: curated discovery (groups, trending, search)
    cache.ex               -- ETS-based response cache with TTL + sweeper
    types.ex               -- Response structs (Package, Release, Owner)
    formatter.ex           -- Markdown formatting (one function per API call)
    cli.ex                 -- Cheer command tree; argv -> server config or init
    cli/init.ex            -- the init subcommand's options
    init.ex                -- hexpm_mcp init: writes the local marketplace and
                              registers it through the claude and codex CLIs

    mcp/
      server.ex            -- Snodo.Server definition (24 tools, 5 resources, 6 prompts)
      stdio_lifecycle.ex   -- stdio task: runs Snodo.Transport.Stdio.serve/2,
                              halts 0 at EOF and 1 on transport failure
      package_completion.ex -- package-name completion for resource and prompt
                              arguments (one cached hex.pm search page)

    mcp/tools/             -- Thin wrappers: call HexpmMcp API -> Formatter -> Snodo.Result
      search.ex, info.ex, versions.ex, release.ex, features.ex,
      dependencies.ex, downloads.ex, owners.ex, readme.ex,
      compare.ex, health.ex, audit.ex, alternatives.ex, dep_tree.ex,
      docs.ex, doc_item.ex, search_docs.ex,
      audit_mix_deps.ex, upgrade_check.ex,
      toolbox_groups.ex, toolbox_group.ex, toolbox_category.ex,
      toolbox_trending.ex, toolbox_search.ex

    mcp/resources/         -- URI resources: hex://{name}/info, /readme, /docs;
                              toolbox://groups, toolbox://{group}/{category}
    mcp/prompts/           -- Guided analysis prompts (6): analyze_package,
                              compare_packages, evaluate_dependencies,
                              recommend_packages, migration_guide, package_review

priv/plugin/hexpm/         -- Claude Code and Codex plugin, embedded by init.ex
  .claude-plugin/plugin.json, .codex-plugin/plugin.json -- no version; init adds it
  skills/hexpm/SKILL.md    -- dependency workflow skill
  hooks/hooks.json, hooks/mix-deps.sh -- PostToolUse hook on mix.exs / mix.lock edits

test/
  test_helper.exs
  hexpm_mcp_test.exs       -- API-level tests (Bypass mocks)
  hexpm_mcp/
    client_test.exs        -- Client HTTP tests (Bypass)
    cache_test.exs         -- Cache TTL/fetch tests
    cli_test.exs           -- argv parsing and config/1
    formatter_test.exs     -- Markdown formatter tests
    hexdocs_test.exs       -- HTML-to-markdown tests
    init_test.exs          -- init planning, written files, host steps (fake runner)
    plugin_test.exs        -- manifests, skill names only served tools, hook script
    toolbox_test.exs       -- Elixir Toolbox client tests (Bypass)
    mcp/
      server_test.exs                 -- discovery, catalogs, argument validation,
                                         HTTP listener per protocol version
      application_acceptance_test.exs -- tools and resources over direct, stdio, and HTTP
      discovery_workflow_test.exs     -- completions, list caching and cursors,
                                         package_review elicitation
      stdio_lifecycle_test.exs        -- the real app over stdio: EOF, drain,
                                         initialize-era negotiation, failure exits
  fixtures/
    mcp_tool_catalog.json  -- expected tools/list catalog (server_test.exs)
  support/
    fixtures.ex            -- Shared test data builders

Read the full file on GitHub · 390 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 390 lines · 5,509 tokens per session scan C 17d1394a6b30

Subscribe to this mod's changes

hexpm-mcp CLAUDE.md is an instructions file published in the GitHub repository joshrotenberg/hexpm-mcp (2 stars, last pushed 6d ago), licensed MIT. It adds 5,509 tokens to every session, about $0.0220 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-29.

Related

hexpm-mcp CLAUDE.md compared with instructions from other repositories

hexpm-mcp CLAUDE.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
hexpm-mcp CLAUDE.mdjoshrotenberg/hexpm-mcpInstructions file26d agoMITC5,509Claude Code
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143kyesterdayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode