Hacketix is an MCP server and Claude Code plugin. As your agent builds, it reviews each change for security issues, proves the ones it can by running the attack against your code on your machine, and checks that a fix blocks the attack without breaking what the code is for. It goes deepest on Next.js + Supabase + Stripe apps.
The final comparison is in progress: Hacketix is being run against Claude Code's /security-review and six other tools on 32 sealed cases. The numbers will be here when that run is scored, with their caveats.
incomplete, never "secure". Windows: use WSL2. Node.js 22.15 or newer.Signed in as .
Sign in to get a token.
Make one token per machine. It is shown once; make another if you lose it.
Put it where Hacketix reads it. macOS:
Linux and WSL2:
Without this file Hacketix works the same and sends nothing.
node --version) and git. On Linux, also sudo apt-get install bubblewrap socat ripgrep openssl; on Ubuntu 24.04 and later, sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0. On Windows, do all of this inside WSL2.hacketix-release. The clone uses SSH, so your GitHub account needs an SSH key. Running as root on Linux? Clone outside /root (for example /opt/hacketix-release) and use that path below. Then:
git clone git@github.com:Robertzu43/hacketix-release.git ~/hacketix-release
cd ~/hacketix-release/hacketix && npm ci --omit=dev --ignore-scriptscd /path/to/your-app
claude --plugin-dir ~/hacketix-release/hacketix/mcp: a hacketix server is listed as connected (Claude Code may show its name with a plugin prefix). In a repository with a package.json or a supabase/ folder, the session opens with Hacketix saying it has no baseline for this repository yet.node ~/hacketix-release/hacketix/dist/src/index.js may load it. The hooks and the skill belong to the Claude Code plugin, and adapters for Cursor, Codex and Gemini CLI are on the roadmap, not built. To try Codex anyway, register that same command (untested), then start Codex in your project:
codex mcp add hacketix -- node ~/hacketix-release/hacketix/dist/src/index.js
cd /path/to/your-app && codexgit -C ~/hacketix-release pull && (cd ~/hacketix-release/hacketix && npm ci --omit=dev --ignore-scripts).Claude Code (the plugin already tells the agent how to work; this makes the first run visible):
Use Hacketix on this repository: call diagnose_repository, show me its report exactly as it comes back, then tell me which items are must fix, which are only suspected, and what you would fix first. Do not change any code yet.Codex or another client (untested; the plugin's hooks and skill are not loaded there, so this repeats the core of the server's own instructions):
This project has the hacketix MCP server. Before anything else, call its diagnose_repository tool on this repository's root and show me the report exactly as it comes back. After each change you make, call review_change on the repository. From now on, when Hacketix reports a finding: prove it with prove_finding before calling it a vulnerability; never call an incomplete or not_reproduced proof secure; for a reproduced finding, or an incomplete medium-confidence one (said to be unproven), propose the smallest fix with propose_fix, check it with verify_fix, show me the patch and apply it only after I approve; report anything else and change nothing; record each outcome with record_decision. Do not change any code yet.What you should see: a report that ranks what it found (must fix, should fix, needs validation), then what was not ranked and what was checked, with no file changed. On macOS the eight classes whose proof runs route code cannot run it (Hacketix reports the OS sandbox unavailable there), so they come back incomplete, or not applicable when reading the code decides it; that is expected, not a bug.
Sign in to send feedback.
Hacketix is proprietary software. Corporate solutions: hacketix.com.