Intel HEX & S-record Image Audit
Runs the same checker as the npm package
@readystack/hex-image-auditon a Node.js runtime that pip installs for you (nodejs-wheel-binaries) - no system Node.js needed. Your files are checked locally.
Recomputes every checksum in a .hex or .srec image and maps every address it writes, before the image reaches the programmer.
Install
hex-image-audit file
Node 18+. The same 17 rules as the VS Code extension, from a terminal or CI.
Free
- Audit one firmware image against all 17 checks — every Intel HEX and Motorola S-record checksum recomputed byte by byte, every byte-count field, every overlap, gap, page-straddling block and entry point — reported at the exact line, in the editor or in the browser, with no key and nothing truncated.
--ruleslists every rule
With a licence ($29 once)
- Sweep every image in the build folder in one pass and keep the dated Markdown audit report as a file you own — the per-image release evidence a technical documentation file is made of. A different axis: scope (one file to the whole folder) and ownership (a report you keep), never a limit on the checks themselves.
@readystack/hex-image-audit --dir ./templates --report html --out report.html
Freelance embedded software engineers average $104 an hour and firmware consultants $105 (contractrates.fyi, crowdsourced rates, June 2026). One hour of one of them re-reading one image costs more than this licence.
Use from an AI agent (MCP)
Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
{ "mcpServers": { "hex-image-audit": { "command": "npx", "args": ["-y", "@readystack/hex-image-audit", "--mcp"] } } }
Tools: check_text and check_file (free) · check_dir (licence). The agent gets every finding with the line number.
Use in CI
- name: Intel HEX & S-record Image Audit
run: npx -y @readystack/hex-image-audit --dir . --ci
(container: docker run --rm -v "$PWD:/work" getreadystack/hex-image-audit --dir /work --ci)
The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set READYSTACK_LICENSE=<key> or run --license <key> once.
Install (PyPI)
pip install readystack-hex-image-audit
hex-image-audit --help
Metadata
Release files for readystack-hex-image-audit 1.0.10.post1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| readystack_hex_image_audit-1.0.10.post1.tar.gz | 19.2 kB | Without provenance | Details for readystack_hex_image_audit-1.0.10.post1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| readystack_hex_image_audit-1.0.10.post1-py3-none-any.whl | Python 3 | none | any | Details for readystack_hex_image_audit-1.0.10.post1-py3-none-any.whl |
Total release size: 40.6 kB
Release files / readystack_hex_image_audit-1.0.10.post1.tar.gz
| Download URL | readystack_hex_image_audit-1.0.10.post1.tar.gz |
|---|---|
| Size | 19.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
72c05e1ba8aa802e5f93e094a1c8c741a3c7cb736518758106240e7155acf5aa
|
|
BLAKE2b-256 checksum How to use checksums |
8f43e3e17ebab0723de11daf187502386552de898eb3a5d73a813bddfa9326ec
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.3
|
Release files / readystack_hex_image_audit-1.0.10.post1-py3-none-any.whl
| Download URL | readystack_hex_image_audit-1.0.10.post1-py3-none-any.whl |
|---|---|
| Size | 21.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ee81cc86a703afc33ae6893472fbcd11f8d4da3a7bae67a8cdcbe2ea0f34022b
|
|
BLAKE2b-256 checksum How to use checksums |
86223ea883ce762efe68e0329d3731946d2435073e21788554829a73f3610e8b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.3
|
Security for readystack-hex-image-audit 1.0.10.post1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.