Hex.pm MCP

What Hex.pm MCP does

Hex.pm MCP gives MCP-compatible AI clients access to package registry, documentation, and discovery data for the Elixir and Erlang ecosystem. It queries hex.pm for package metadata, releases, versions, owners, README content, dependencies, download statistics, and optional release features. It also reads module listings and documentation from hexdocs.pm.

Analysis tools help agents compare two to five packages, locate alternatives, build recursive dependency trees, and assess package health. Dependency audits check for signals such as retired versions, stale packages, known vulnerabilities, and single-maintainer risk. Separate tools inspect mix.exs dependency lists for risks or available upgrades, including possible breaking changes.

Elixir Toolbox tools add curated discovery features, including taxonomy browsing, category results, trending packages, and searches with popularity and health signals. The server also provides package resources, guided analysis prompts, and instructions that suggest which tools to use for common tasks.

How it works

The server communicates over MCP using stdio or Streamable HTTP. A public instance is available at https://hexpm-mcp.fly.dev/mcp, while local installations can be connected through an MCP client configuration. Tool arguments are validated against JSON Schemas, and list responses include cache hints. Responses are cached with ETS and a configurable time-to-live.

MCP revisions 2026-07-28, 2025-11-25, and 2025-06-18 are supported over both transports. Older revisions 2025-03-26 and 2024-11-05 are not supported. With the two older supported revisions, HTTP is stateless and requests after initialization need an MCP-Protocol-Version header.

Setup and configuration

The recommended installation uses a self-contained binary for macOS, Linux, or Windows. It includes the Erlang runtime, so an Elixir toolchain is not required. The installer selects an operating-system and architecture-specific asset, verifies its SHA-256 checksum, and installs to ~/.local/bin by default. The installation directory and release version can be changed through installer flags. Windows has a PowerShell installer.

The project can also be added as an Elixir dependency for use from iex or application code, or built from source with mix deps.get. Run hexpm_mcp --version to verify a binary installation. hexpm_mcp init installs the server as a Claude Code and Codex plugin, including its skill and hook for dependency evaluation, upgrades, and audits.

Tools and capabilities

• Search packages by name or keywords with sorting and pagination.
• Inspect package metadata, releases, versions, owners, README files, dependencies, features, and download counts.
• Browse module indexes, search documentation, and retrieve documentation for specific modules or functions.
• Compare packages, find alternatives, assess health, and build dependency trees up to a maximum depth of five.
• Audit package dependencies and mix.exs dependencies for retirement, staleness, vulnerabilities, and maintainer risks.
• Check dependencies for newer releases and potential breaking changes.
• Search Elixir Toolbox data, browse its groups and categories, and view trending projects.

Limitations and notes

The server relies on data exposed by hex.pm, hexdocs.pm, Elixir Toolbox, and vulnerability checks through OSV.dev. HTTP behavior depends on the negotiated MCP revision: supported older revisions use stateless requests, do not receive client requests, and reject GET and DELETE on /mcp with status 405. Clients that require MCP revisions from before 2025-06-18 cannot connect.

The package comparison tool accepts two to five packages, and dependency-tree traversal has a maximum depth of five. A package review can request a focus of quality, security, or upgrade when the client supports elicitation; otherwise, the review covers all three areas.