MXB App

mxbsecure.com/app · Download for Windows · Everything from mxbsecure

MXB App is a desktop mod manager for MX Bikes. It replaces the tedious manual install dance — open mxb-mods.com, follow the link, download from MediaFire, unzip, and move files into the right folder — with a single flow:

Search a mod → open its page → click Add to Library → done.

MXB App downloads the mod, extracts it, and drops the files into the matching MX Bikes mods folder automatically.

Tracks, bikes, rider gear, paints, sounds, model swaps and riding-style animations are all recognised — and anything can be installed by dropping it on the window, sorted by what the archive holds rather than by what its title says.

GP Bikes is a second title in the same app, switched from the sidebar. Installing, the library and presets all work there. What doesn't is per-title and gated on a capability rather than hidden: the 3D previews need part bindings GP Bikes hasn't got yet, and the stores and Race mode sell and manage MX Bikes content, so those rows don't appear. The UI speaks six languages (Settings → Appearance).

Download

Get it from mxbsecure.com/app, or straight from the Releases page:

• Windows: .exe installer (recommended; MX Bikes runs on Windows).
• macOS (Apple Silicon): .dmg. Play launches the game through a CrossOver, Whisky or Wine bottle.
• Linux: .AppImage, .deb and .rpm, for playing under Proton (SteamOS included).

More from mxbsecure

• MXB Coach: reviews your laps, sets up your bike and calls cues while you ride.
• Frost's Studio: paints, tracks and the Designer.
• FrostMod: the in-game companion.
• MXB Replay: cameras and cuts for replays, recorded for you — its panels open in Frost's Studio.

Builds are unsigned, so Windows SmartScreen / macOS Gatekeeper will warn on first launch — choose Run anyway / right-click Open.

You only install once: the app checks for new releases on launch (and every 6 hours), then downloads and installs them on restart.

Screenshots

Setup

What's in it

Each of these is a tab in the app.

• Browse — the catalog, from mxb-mods.com via its public WordPress REST API (search, listings, images), behind a swappable ModSource trait in the Rust backend. GP Bikes browses its own site.
• Shop and MXB Hub — the two paid storefronts, mxbikes-shop.com and shop.mxb-hub.com. Both sign in with the user's own account and install what it already owns, free items included; buying still happens on the store's own site. See below for the one half of Shop that needs a build-time credential.
• Library, with Downloads under it — what's installed, and what arrived (or failed to) recently.
• Locker — swap each bike's model and engine sound between the sets you have installed, with the 3D preview beside it.
• Presets — save a full rider look and load it onto a bike on command.
• Servers — every MX Bikes server, live, with the track's picture even when you don't have it. On a server running a free track you're missing, Install & join installs it and joins, or puts you in line when the server is full. When the list won't load it says whether that is MX Bikes' own master server or something at your end, rather than showing a bare error — see "Is MX Bikes down, or is it you?" below.
• Studio — opens Frost's Studio, or gets it for you. The Designer, the Paint, Track and Rider studios, Replay and content locking are all there now, in their own app. Both apps read the same folders, so nothing moves.
• Race mode — MX Bikes loads every mod in the folder at startup, so a preset names the track it races on and everything else steps aside into a holding folder until you bring it back.
• Settings — the game path, appearance and language, FrostMod (including its replay-camera key bindings and camera paths), paint sync, plugins, and Supporters.

Running through all of it:

• Paint sync. MX Bikes transmits no custom content, so a grid of strangers is a grid of default liveries. The app publishes what your rider is wearing and pulls back what everyone else published, on any server — it reads the server's name out of the running game, so a public server syncs like a private one and the host installs nothing. Content-addressed by SHA-256, so twenty riders sharing a paint is one stored object. Off by default; Settings → General turns it on, and Settings → Paint sync shows what it published and pulled.
• Is MX Bikes down, or is it you? The game answers a dead master server with connection timeout and nothing else — the identical string it prints for a firewall rule, a broken DNS server or a router that wants restarting. So the commonest failure in the game is the one failure it gives you no way to place, and it reaches the Discord as several people each debugging a machine that is working perfectly. A failed server list now asks how many other apps failed the same fetch in the last ten minutes and leads with that, because one machine failing proves nothing and twenty proves a great deal. Check my connection then walks outwards from the machine — internet, whether the master's address resolves, whether outbound UDP is being blocked, our own fetch — and finishes with what everyone else is seeing, the only check that can overturn the rest. Each app contributes one anonymous bit and one word for why, on the same setting the usage counters use; the same numbers are public at mxbsecure.com/status, which is a link a Discord bot can post instead of a troubleshooting list.
• A shared server book. The Servers tab has always rebuilt its whole list with GETINFO when the master won't answer — a server answers that to anyone, with no account and no ticket — but only from addresses this install had already been told about, so on a fresh install the fallback had nothing to fall back to. That is exactly who an outage hits hardest. The app now contributes the addresses it sees to a pooled book and seeds its own from it, so the fallback is in place before the outage rather than after. Addresses only, no names and no install id; the control plane holds one back until distinct networks have independently seen it in the game's own list, because a list that tells thousands of apps where to send a datagram cannot take anybody's word for it.
• The app asks, rarely. A small card in the corner: How's it going? Bad · Fine · Good, one tap. Answer badly and it asks what happened, with chips to pick from and a box you can type a line into if you feel like it; after the other answers it asks that only now and then. The same card can carry a question about something new — the questions are written on the control plane rather than built into the app, so one can be asked while it still matters rather than a release later. Nothing for the first three days after installing, nothing in the first five minutes of a run, at most one card a day, and closing it three times in a row stops it for half a year. Switched off in Settings, and off already for anyone who turned the anonymous counters off — an answer carries the same install id, so being asked is never a way round having said no to being counted.

Tech stack

• Tauri 2 (Rust backend)
• React 18 + TypeScript
  • Vite
• Tailwind CSS + shadcn/ui (Radix primitives) for UI, lucide icons, Sonner toasts, and Swiper for galleries
• three.js via React Three Fiber + drei for the 3D rider, bike and track previews

Repo layout

Path	What it is
apps/manager/	MXB App — browse, install, manage, launch. React frontend, Rust backend.
crates/core/	Shared Rust: the game's own file formats, and the model pipeline both apps draw with.
packages/shared/	Shared TypeScript: the 3D viewer, the UI primitives, the API client and the base dictionary.
site/	The old landing page; the live one is mxbsecure.com/app.

The repo is a bun + Cargo workspace holding the MXB App and the file-format and 3D code it is built on (crates/core, packages/shared). The other mxbsecure apps are not open source.

Development

Prerequisites: Node.js 20+ and the Rust toolchain, plus the Tauri system dependencies for your OS. On Linux that includes libasound2-dev.

bun install          # install frontend dependencies
bun run tauri dev    # run the desktop app (Vite + Rust)

Other scripts:

bun run dev          # Vite dev server only (frontend; Tauri commands unavailable)
bun run build        # typecheck + build the frontend
bun run typecheck    # tsc --noEmit
bun run lint         # eslint
bun run tauri build  # produce a production desktop bundle

Rust backend (from the repo root — it is the Cargo workspace root):

cargo check --workspace   # typecheck the Rust
cargo test --workspace    # unit tests — catalog parsing, download resolution, install
                     # routing, the game's file formats. Tests needing a real MX
                     # Bikes asset are #[ignore]d.

MX Bikes is a Windows game, so a real install is a Windows one — but the app launches it on macOS through a CrossOver, Whisky or Wine bottle, and on Linux under Proton. The cross-platform logic builds and tests on any OS.

Optional modules

Secure content (the Secure tab) comes from a local-only module that is not in the public tree; content locking lives in Frost's Studio now. Its absence is the normal case — build.rs sets a cfg when the file is present, and without it the app simply doesn't show that row. A fork builds and runs with everything else intact.

The shop catalog credential

The Shop tab has two halves. My purchases signs in to mxbikes-shop.com with the user's own account and installs what they have already bought — it needs no build-time credential. Catalog browses the store's public listing, and that half needs an API credential supplied by the store. Copy the example file and fill it in:

cp .env.local.example .env.local   # gitignored; never commit it

The store authenticates with a single custom header, so MXB_SHOP_API_HEADER is the header's name and MXB_SHOP_API_KEY is its value.

apps/manager/src-tauri/build.rs reads the file at compile time and bakes the values into the Rust binary — they are deliberately not Vite env vars, which get inlined into the JS bundle and would ship the key to anyone who unzips the app. Setting the same names in the environment overrides the file, which is how CI supplies them.

Building without it is fully supported: the Catalog tab simply doesn't appear, the Shop opens straight on My purchases, and nothing else changes. That's what forks build. Official releases get the values from the MXB_SHOP_API_HEADER and MXB_SHOP_API_KEY repository secrets — without those secrets, released builds ship with no catalog.

The catalog is browse-only: it shows what the store sells and links out to the product page. Buying happens on the store's own site. Installing something already bought goes through My purchases, which downloads the file and hands it to the same review sheet a drag-and-drop uses, so it lands by what the archive contains rather than by what its title suggests. MXB Hub works the same way and needs no credential at all — its catalog is a public WooCommerce Store API.

Releases

Releases are published here, on this repo's Releases page, by the mxbsecure release pipeline: signed Windows, macOS and Linux bundles plus the signed latest.json the in-app updater reads. A suffixed tag (v0.13.0-beta.3) is a pre-release and stays off releases/latest, so only the beta channel sees it. Each version's notes are its CHANGELOG.md section.

Roadmap

Features coming next:

• A 3D preview for GP Bikes. Locker's preview needs part bindings GP Bikes hasn't got yet, so it says so plainly rather than showing an empty stage. Frost's Studio has the same gap for its paint preview.
• Hosting a server from the app. Built once and taken back out — creating and running a dedicated server needs an account on the control plane, and opening that up is the remaining work.