{"repo":"branover/hexgraph","free":true,"listed":false,"github":"https://github.com/branover/hexgraph","clone":"git clone https://github.com/branover/hexgraph.git","description":"Self-hosted, agentic vulnerability research for binaries & firmware: an AI agent decompiles, fuzzes, and verifies exploits inside a sandbox, recording every finding to a typed graph. BYOK, fully local.","language":"Python","stars":19,"topics":["agentic-ai","ai-agents","binary-analysis","claude-code","fuzzing","llm","mcp","reverse-engineering","security","security-tools"],"license":"AGPL-3.0","category":"security-tools","readme_excerpt":"⬡ HexGraph HexGraph is a self-hosted workbench for AI-assisted vulnerability research that runs entirely on your own machine. You point it at a binary or a firmware image, and it does the unglamorous parts for you: it ingests the target, pulls firmware apart into its component binaries, runs analysis tasks driven by whatever model access you already have, and writes every result down as a structured finding in a typed graph backed by SQLite. The graph ties everything together: targets, functions, sockets, hypotheses, and findings, joined by typed and attributed edges. Alongside the graph there's a shared working memory that keeps the reasoning, not just the results: a freeform research journal of timestamped markdown notes, written by you or the agent, where an @ -mention links straight to any object in the graph, plus a hypothesis worklist you sort, filter, and check off as leads get confirmed or ruled out. You browse all of it, launch new tasks, and triage findings from a web UI that only ever listens on localhost, and the same operations are available to a coding agent over MCP. Three principles are non-negotiable, and they shape everything else: - It stays local. The API and UI bind to 127.0.0.1 and nothing else. HexGraph never phones a server we operate; there is no telemetry and no auto-update ping. - You bring the key, or you bring nothing. Model access comes from your own Anthropic API key, a local Claude Code session, or the built-in mock backend. The mock is the def","default_branch":null,"files":null,"tree":[],"storefront":"/r/branover","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/branover/hexgraph/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}