The public v1.0.0 code is a remote-control client
HexStellar v1.0.0 gives agents a typed route into a hosted optimization service. The client accepts structured problems for jobs such as routing, assignment, max-cut, and mixed-integer optimization, then returns an answer with cost and assurance metadata. It can present its contracts through a CLI, Python functions, MCP, or exported tool definitions. That is useful when a language model can describe a decision but should hand the combinatorial search to software built for it.
The boundary matters more than the catalog. The 119-file repository contains transport, validation, job polling, output shaping, and documentation. It does not contain the solver. Normal work leaves your machine over HTTPS and runs on HexStellar-managed infrastructure. The README says the engine is sealed, while customer-controlled execution belongs to a separately licensed Enterprise product. Calling this an open-source solver would give buyers the wrong picture.
The 36-package install does not install a solver
The public client supports Python 3.8 through 3.14 and declares zero third-party runtime dependencies. It can validate a request, obtain a free estimate, set a compute-unit ceiling, and reuse an idempotency key for retries. The anonymous sandbox needs no private credential, though its problems are small and rate limited. Real workloads require registration and an API key, and the README directs users to install from GitHub until PyPI reports a 1.x package rather than its old placeholder.
Version 1.0 has two very different offline stories. Documentation, schemas, and a demo can work without network access. The offline demo is openly labeled as a bundled result that was computed earlier and checked again with local arithmetic. A fresh solve does not run locally and should return an error without egress. That honesty is welcome, but it does not help a hospital, factory, or regulated team whose problem data cannot leave its network.
What happened when we ran it
Our sandbox installed HexStellar in 22 seconds, added 36 packages, and used 37 MB on disk. The checkout at commit aae0d6a was 1.8 MB, with 119 files and roughly 6,461 lines of source. The build completed in 1 second. Pip-audit reported 0 known vulnerabilities in the installed Python environment. Those numbers describe the public client, not the hosted Cortex engine or its performance.
There was no test script or target, so our run skipped tests. The repository also had no tests directory, although it included 2 CI workflow files. That leaves a gap between the README's claims about golden tests and what a buyer can execute from this public checkout. We did not measure solve speed, answer quality, service availability, or energy use, and the supplied lab record contains no basis for claiming any of them.
Five assurance states keep a heuristic result in its lane
Version 1.0 separates five result categories: certified, heuristic, operation, recorded, and abstention. The distinction is practical. An exhaustive result may carry a certification, while a heuristic candidate does not become proven merely because it looks good. The free verify path asks the service to recheck supported properties. The README also says that this service recheck is different from a local recomputation, a formal proof, or a domain expert's check.
The client gives an agent useful brakes before it spends money. A dry run validates and estimates without solving, --max-compute-units can refuse an expensive request, and read-only MCP mode exposes free analysis and verification tools. Exit codes separate retryable, authentication, and validation failures. Those controls make automation safer, yet all of them rely on the service's published contract. A team still needs its own test cases for feasibility and business rules.
The proprietary license removes normal open-source freedoms
The v1.0.0 repository is source visible under a proprietary license, despite being public on GitHub. The license allows internal business or research use of the client with a valid subscription or license key, plus access to the public sandbox and any offered free tier. It prohibits modifying or redistributing the client and restricts reverse engineering, service probing, limit evasion, and misleading or prohibited benchmarks. Those terms deserve legal review before an organization builds around it.
Enterprise deployment does not change the public package. Version 1.0 has no downloadable customer runtime or automatic activation path. The README says evaluation is arranged directly under a separate license and NDA. If your purchasing rule requires OSI-approved code, a self-hosted engine, or the right to fork a dependency, the decision ends there. Google OR-Tools, CVXPY, and CBC all give you local code instead, though they cover different modeling and solver needs.
One release and 0 issues provide little public history
GitHub showed 1,267 stars on 2026-09-24, but the repository was created, last pushed, and released as v1.0.0 around 2026-08-27. It had 0 combined open issues and pull requests. A clean queue can mean few reported problems or little public discussion, so it cannot prove stability. The last push is recent, yet one public release gives buyers almost no history for judging upgrade cadence or issue handling.
HexStellar is easiest to justify when the hosted boundary is intentional. Our 22-second install makes a trial cheap, and the certainty labels are better than an API that presents every candidate as settled fact. The missing public test target and proprietary service are larger concerns than setup. Send a sandbox-sized problem first, read the returned assurance, and stop if your data or licensing requirements call for a solver you can run and inspect yourself.