---

English · Português · Website

Infrastructure for distribution, licensing, and updates for plugins.

Integrated checkout, node-locked licensing, native installation, and updates on macOS and Windows.

Nexus is infrastructure for licensing, distributing, and updating native desktop plugins and software: activation certificates signed per tenant and bound to machine hardware, an offline validity window that survives days without a network, protected release delivery, and rollback to a previous version. MCNexus is the macOS and Windows application that performs activation, installation, updates, and rollback on the workstation.

Recommended for Windows

The Microsoft Store is the official and recommended installation channel for Windows, providing code integrity and automatic background updates. The .exe installer remains available through GitHub as an alternative for manual installation.

Installation notice: the direct Windows installer distributed through GitHub is not currently code-signed and may display a Microsoft Defender SmartScreen warning. The macOS build is not currently signed with an Apple Developer ID certificate or notarized by Apple, so Gatekeeper may also display a warning. Official downloads are available through the Microsoft Store and this repository.

Discover Plugins

Explore the OFX plugins already integrated with Nexus.

View integrated plugins · Suggest a plugin

For Users

MCNexus manages the lifecycle of plugins installed on a workstation, from initial activation to installing a previous version.

• Automatic installation: downloads and installs OFX files in the native directory defined by the operating system.
• Updates and rollback: identifies published versions and allows an available update or previous version to be installed.
• Independent actions: activating a license, deactivating it, removing the local key, and removing plugin files are separate operations.
• Moving between computers: when the previous computer is accessible, deactivate the license there before activating it on another machine. Remote releases and activation-limit adjustments still require support.

Start with the User Guide

For Developers

Backend, native SDK, and client app for native software, commercial or open source. Integrations operate in two modes: end-to-end (from integrated checkout to workstation installation) or coupled to an existing external store or key issuer. Configured project by project; public self-service onboarding is on the roadmap. Every integration in production today is an OFX plugin.

• Node-locked activation. Each activation is an Ed25519 certificate, signed by a key scoped to a single tenant and bound to the machine fingerprint, with a seat limit per license and self-service deactivation, so the user releases the seat without going through support. Two backends issue that license: OpenKey, native to Nexus, and Cryptlex, for developers already using it as their platform. Both are node-locked; what differs is who owns the platform, not the mechanism. → Distribution models

• Offline and air-gap. A licensed product does not ask a server for permission to run: the SDK verifies the certificate against a public keyring compiled into the binary, on the machine, with no network. The certificate carries two independent deadlines: syncAfter, when the background thread starts trying to renew (default 24 h), and offlineValidUntil, the hard limit the SDK itself enforces (default 30 days, configurable per license up to 365). The issuer enforces a lock across the two: the offline window always covers at least two full renewal attempts, so a failed sync is never what denies a license. A machine with no network at all activates and deactivates through exported files, over the same path. → Why an interruption is not a denial · Offline activation in the SDK

• NexKeyRuntime, the native SDK. C/C++14 with a stable C ABI, for macOS universal (arm64 and x86_64), Windows x64 and ARM. On the render thread the license decision is a single atomic read: no lock, no allocation, no syscall, no network, no file I/O and no JSON parsing. Two integration profiles: under Profile A MCNexus activates the license and the product verifies it locally; under Profile B the product activates, synchronizes and deactivates on its own, with no client app in the loop. The repository publishes the full contract under Apache-2.0, including the C header, JSON Schemas, integration documentation, and examples; compiled binaries ship as releases with checksums, under the binary license. The API is stable as of 1.0: an existing function, struct layout or result code never changes in a way that breaks an already-compiled binary. Only additive changes ship in a 1.x release, and a breaking change would require 2.0. → NexKeyRuntime · Integration · ABI policy · JSON Schemas · Client SDK

• MCNexus client. For OFX plugins, the macOS and Windows desktop app activates the license and manages installation, updates, and rollback on the workstation. A Profile A product does not have to write, sign, or distribute its own client. Activating in the desktop app outside the host keeps the plugin Inspector clean, prevents host project files and timelines (such as DaVinci Resolve .drp) from saving or leaking user emails or license tokens, and completely eliminates network calls from the host UI or render threads. Activating, deactivating, removing the local key, and removing plugin files are independent operations. → User Guide

• Key ownership and continuity. What the SDK trusts is the product's keyring, not the server: whoever holds the private half of a key in that keyring can issue certificates that already-installed copies accept, with no Nexus infrastructure involved. The keyring holds up to four keys, and a retired key stays in it and merely stops signing, which is why key rotation does not invalidate what is already installed. The recovery key is generated by the developer: only the public half is uploaded, an upload containing the private half is refused, and it signs nothing in normal operation. → If the operator is no longer available

• Distribution and rollback. Releases come from the source configured for the project and are served through a download proxy with a short-lived signed token, so the app never receives the real release URL. Platform-specific packages, version discovery, and reinstalling a previously published version when a release breaks a project. Cryptographic integrity verification of packages is on the roadmap. → Security and distribution

• Editions and entitlements. Beta, Demo, Trial, and Full, the same four tiers in a free or paid project (Trial is time-limited, Demo is not). When a buyer acquires a Full license after using a Demo or Trial with the same verified email, the license automatically upgrades in place via upgradeEdition on the same key without reinstallation, preserving installed files and existing project timelines. When a product ships in several variants within the same release, per-asset entitlements define what each license unlocks, and the activation scope is unique per tenant, fingerprint, and entitlement: the same machine cannot occupy two seats for the same right. For Cryptlex products, editions and activation limits come from the developer's own account. → Channels and editions

• Commerce and fulfillment. Sales run through the developer's own payment account. Configured once, an offer catalog ties price, product, payment account, and the terms, privacy, and refund URLs shown at checkout. On each sale Nexus records the order, the payment event, and which version of the terms the customer accepted, creates or updates the license, and delivers the key by one-time reveal with a transactional email. Fulfillment attempts are recorded per order, so a retried payment event does not issue a second license. For coupled external stores, licenses are issued via API or developer channels. → Current Nexus Commerce flow · Integrated providers

• In-product notices. Severities critical, recommended and info, with localized content and targeting by host, plugin version range, platform and architecture. The user dismisses or postpones a notice, and the product sets its own check policy and how many notices it shows at once. The content is text: HTML, arbitrary Markdown and script were left out by scope decision. It arrives over the same channel as updates. → Updates and notices in the SDK

Understand developer integration

Application Compatibility

• macOS: macOS 15 or later, including Apple Silicon and supported Intel Macs.
• Windows: Windows 10/11 x64, with Windows 11 ARM support through x64 emulation.
• Linux: under consideration when compatible plugins and user demand justify the additional platform lifecycle.

Project

Nexus combines software engineering with practical experience in audiovisual post-production. Developed independently by Magno Ciqueira (Instagram), the project aims to reduce technical friction and provide distribution infrastructure for commercial and open-source tools.

Documentation

• Discovery
• User Guide
• Developer Documentation
• Frequently Asked Questions
• Roadmap
• Continuity and Recovery
• License
• Source Notice
• Trademark Notice
• Security Policy
• Terms of Use
• Privacy Policy
• Tenant Legal Documentation Guide

Source Availability

This repository is public for transparency and review. It is source-available, not open source software. Redistribution, unofficial builds, derivative products, and use of MCNexus branding require prior written permission. See LICENSE.md, NOTICE.md, and TRADEMARKS.md.

Support

Use the GitHub support forms for technical problems, activation questions, bug reports, and suggestions. Include the operating-system version, MCNexus version, affected plugin, and available diagnostics.

GitHub Issues are public and indexed by search engines. Do not publish a complete license key or personal data. Privacy requests must be sent to hello@mcnexus.app.