\n\n**Git-backed control plane for AI-agent skills, tools, context, permissions and\nidentity. Self-hosted and MCP-native.**\n\nOne place where your company's AI plugins, tools and knowledge live: centrally\nmanaged, reviewed and access-controlled, and usable from **any AI agent**. The\nopen-source core of the Bevel platform.\n\n## Why Hexis?\n\nUsed by companies such as [Unite](https://unite.eu) (formerly Mercateo), [osapiens](https://osapiens.com), [BEO](https://beo.energy), [Workpath](https://www.workpath.com) and others.\n\n### For teams\n\nOne place where engineers and non-technical people alike can browse and load\nplugins, propose suggestions, and manage access.\n\n### For enterprises\n\nEvery skill, tool manual and permission is a file in a git repository you own,\nso the audit trail is the storage layer: who changed what, when, who approved\nit, and how to undo it. An agent can only do what the person running it can do,\nresolved per file, and it never holds the credentials it uses. Runs on your\ninfrastructure, behind your own SSO.\n\n### Why it's different from MCP gateways:\n\nMCP gateways are uni-directional; users can consume plugins, skills or tools but there is no mechanism here for users to propose changes or share new skills and MCP servers. You can do this via GitHub in the back, but this is not accessible to non-technical users and there is no fine-grained access control for either viewing or the review process.\n\nHexis can do all of the above specified capabilities for distribution, and has this bidirectionality needed for management.\n\nIn Hexis, skills and tool manuals are reviewable files. Anyone can propose a\nchange; on protected branches it reaches the owners of the files it touches and\nships only once they approve. Agents propose too: one that hits a broken skill\nmid-task can suggest the fix, and a person decides whether it lands.\n\n## Contents\n\n- [See Hexis in action](#see-hexis-in-action)\n- [Connect Hexis to Cline](#connect-hexis-to-cline)\n- [Try the live demo](#try-it-first-the-live-demo)\n- [Managed hosting](#want-a-managed-instance)\n- [Deploy with Docker](#deploy-it-in-5-minutes-docker)\n- [Local development](#local-development-run-from-source)\n- [Configuration reference](docs/configuration.md)\n- [Skills in Cowork and claude.ai](docs/claude-cowork.md)\n- [Troubleshooting](docs/troubleshooting.md)\n- [Repository layout](#repository-layout)\n- [FAQ](#faq)\n\n[](https://youtu.be/RjOWRz4E0ZU?si=R7d8rT_P1YVxmQBO)\n\n*Watch the full walkthrough: connect an agent, use company context, review\nproposed changes, and manage team access.*\n\n## See Hexis in action\n\n### Propose and approve skill changes\n\nAnyone can propose a new skill or improve an existing one. On protected\nbranches, owners review the exact change and approve it before it becomes\navailable to the team's agents.\n\n\n\n### Use your team's skills in Claude\n\nConnect Claude to Hexis over MCP, then ask normally. Claude can discover and\nload the approved skill instructions and company context your role can access,\nwithout copying prompts between tools.\n\n\n\n### Connect Hexis to Cline\n\nCline can connect directly to Hexis as a remote Streamable HTTP MCP server.\nInstall the public demo connection from the Cline CLI:\n\n```sh\ncline mcp install hexis --transport http https://demo.bevel.software/api/mcp --yes\n```\n\nComplete the OAuth sign-in in your browser when prompted. Cline then discovers\nthe skills, tools and context your Hexis role can access. For your own Hexis\ndeployment, replace `demo.bevel.software` with your deployment's host.\n\n### Share skills with the right people\n\nAdd teammates to roles or grant access directly when needed. Everyone connects\nto the same workspace, while each person and their agent only sees what they\nare allowed to read.\n\n\n\n## Try it first: the live demo\n\n**[demo.bevel.software](https://demo.bevel.software/workspace/main/knowledge-base/KnowledgeBase/Start%20here.md)**\nis a public instance you can sign into with your Google account, populated\nwith a fictional company's knowledge, skills and tools. The *Start here* page\nwalks you through the whole loop: connect your own agent over MCP, have it\nbuild a sales deck from a skill, watch its proposed improvement arrive as a\nchange request. The demo is shared and read-mostly (visitors propose, owners\napprove); everything below gets you the same thing with none of the limits.\n\n## Want a managed instance?\n\nWe run it for you (hosting, upgrades, backups, SSO) and your team just signs\nin. Write to **[ali.raza@bevel.software](mailto:ali.raza@bevel.software)**.\n\n## Deploy it in 5 minutes (Docker)\n\nYou need: [Docker](https://docs.docker.com/get-docker/) with Compose on a\nserver (or your laptop; one extra line below), and an\n**empty git repository** on any host (GitHub, GitLab, Bitbucket, Azure DevOps,\nself-hosted) to hold your knowledge base. The app seeds it with a starter\ntemplate on first run.\n\nGrab the two deployment files — no clone needed:\n\n```sh\nmkdir hexis && cd hexis\n# v0.10.0 below = the release this page was written against; replace with the latest release tag\nwget https://raw.githubusercontent.com/Bevel-Software/Hexis/v0.10.0/docker-compose.yml\nwget -O .env https://raw.githubusercontent.com/Bevel-Software/Hexis/v0.10.0/.env.example\n```\n\n(Working from a git clone works identically — both files sit at the repo root;\n`cp .env.example .env`.)\n\nOpen `.env` and fill in the **four required values** (everything else can wait):\n\n```sh\nADMIN_EMAIL=you@example.com # the deployment owner, always an admin\nADMIN_PASSWORD=pick-something # sign-in password; only with password login (SSO-only deployments drop it)\nJWT_SECRET=… # generate with the command below\nSECRETS_ENC_KEY=… # generate with the command below\n```\n\nGenerate the two secrets (run twice, paste one result into each):\n\n```sh\nnode -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"\n# no Node installed? docker run --rm node:22-slim node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"\n```\n\nFor a public deployment served over HTTPS by the bundled proxy, also set the\ndomain — it derives everything else public (origins, proxy hop):\n\n```sh\nDOMAIN=bevel.your-domain.com\n```\n\nThen start everything. Deploying **pulls the image CI publishes on every\nrelease** — nothing compiles on your server, so a small instance suffices.\nPin the version in `.env` (`HEXIS_VERSION=0.10.0`) so a later `pull` can't\nbecome an unplanned upgrade — [UPGRADING.md](UPGRADING.md) covers upgrades\nand backups. Building from source instead (a staging server tracking a\nbranch, a fork) is\n[deployment/docker-compose.build.yml](deployment/docker-compose.build.yml)\n(explained in [deployment/](deployment/README.md)).\n\n**Public HTTPS, no proxy of your own** (a bare EC2 instance, a plain VPS):\nthe `https` profile starts Caddy in front of the app, with automatic Let's\nEncrypt certificates for `DOMAIN` and the HTTP→HTTPS redirect. First: a DNS\nA (or AAAA) record for the domain pointing at the server, and ports 80 + 443\nopen to the internet (port 80 is not optional — the certificate challenge and\nthe redirect both use it).\n\n```sh\ndocker compose -f docker-compose.yml --profile https up -d\n```\n\n**Behind your own reverse proxy** (Coolify, Traefik, nginx): skip the profile\n— two things terminating TLS for one app is one too many. Instead of `DOMAIN`,\nset the origin values and the proxy hop count in `.env`, so OAuth redirects\nare built right and rate limits see real client IPs instead of the proxy's:\n\n```sh\nPUBLIC_BACKEND_URL=https://bevel.your-domain.com # public origin; OAuth redirects are built from it\nPUBLIC_FRONTEND_URL=https://bevel.your-domain.com # same origin: the backend serves the SPA\nTRUST_PROXY=1 # your proxy hop count\n```\n\n```sh\ndocker compose -f docker-compose.yml up -d\n```\n\nThe explicit `-f` matters in a clone: it skips `docker-compose.override.yml`,\nso the app publishes **no host port** — your proxy reaches it on port `3001`\nover the compose network. This is deliberate: a fixed published port makes\nevery redeploy fail with `port is already allocated`, because the replacement\ncontainer starts while the outgoing one still holds it.\n\nOpen your domain and sign in with `ADMIN_EMAIL` / `ADMIN_PASSWORD`.\n\n**Just trying it on your laptop?** Same steps, minus `DOMAIN` and the origin\nvalues — plus one extra file: `docker-compose.yml` alone publishes no host\nport (see above), and `docker-compose.override.yml` is the piece that puts\nthe app on localhost. A clone already has it; next to the wget'd files, fetch\nit too:\n\n```sh\nwget https://raw.githubusercontent.com/Bevel-Software/Hexis/v0.10.0/docker-compose.override.yml\ndocker compose up -d\n```\n\nThen open **http://localhost:3001** (a different port:\n`APP_PORT=8080 docker compose up -d`). Leave `TRUST_PROXY` unset here — with\nno proxy in front, trusting forwarded headers would let clients spoof their\nown address.\n\n### First sign-in: the setup screen\n\nThe app asks for the things it could not guess, and **tests them against the\nreal host before saving**:\n\n1. **Knowledge-base repo**: the https clone URL of that empty repository.\n2. **Git credential**: a token with read/write access to it (for GitHub: a\n fine-grained personal access token with *Contents: read & write* on that one\n repo is enough).\n3. **Branch model**: which branch is the default and which are protected\n (changes to protected branches only land through approved change requests).\n The repository's real branches are offered as suggestions; for an empty repo\n the default (`main`) is fine.\n\nSince the repo is empty, the app initialises it from the bundled template and\nwrites a `roles.yaml` whose first Admin is you. That's it: you're in the\nworkspace. Head to **Skills & Tools** to make your first plugin and skill, and to\n**Connect** (in the app menu) to hook up an agent over MCP.\n\nGoing to production? [Configuration reference](docs/configuration.md) covers\nsingle sign-on, the state you need to back up, health checks, and configuring\nby environment instead of the setup screen.\n\n## Local development (run from source)\n\nYou need: **Node 22.13 or newer** (`.nvmrc`; the engine range is `>=22.13 <23`),\n**pnpm 10**, **git ≥ 2.41**, and a Postgres 17 (the bundled one is fine):\n\n```sh\ndocker compose up -d db # just the database\npnpm install\npnpm build # builds the packages the apps import\ncp .env.example .env # fill the same four required values;\n # the default DATABASE_URL already points at the bundled db\npnpm dev # backend on :3001, Vite dev server on :5173\n```\n\nOpen **http://localhost:5173** (the dev server proxies to the backend). Useful\ncommands: `pnpm test`, `pnpm typecheck`, `pnpm lint`.\n\nMigrations run automatically on boot; there is no separate migrate step, in\ndev or in production.\n\n## Reference\n\n- **[Configuration](docs/configuration.md)**: every environment variable, SSO\n setup, secret generation, backups and health.\n- **[Troubleshooting](docs/troubleshooting.md)**: the failures you are most\n likely to hit, and what causes them.\n\n## Repository layout\n\n| Path | What it is |\n| --- | --- |\n| `packages/shared` | `@bevel-software/platform-shared`: shared types + pure domain utilities |\n| `packages/core-backend` | `@bevel-software/platform-core-backend`: the core backend (ships `migrations/` + `kb-template/`) |\n| `packages/core-frontend` | `@bevel-software/platform-core-frontend`: the core UI, published as raw TS/TSX source |\n| `apps/server` | standalone core backend shell |\n| `apps/web` | standalone core SPA shell (Vite) |\n\n## FAQ\n\nQuestions that come up when teams evaluate Hexis as a central, versioned\ncatalogue for agent skills and tools.\n\n\nHow do agents find skills without flooding the context window?\n\nThey look them up rather than loading them all: `list_skills` and `search`\nnarrow the field, `get_skill` returns one skill at call time.\n\n\n\nWhich agents can connect?\n\nAny MCP-capable client, including Claude Code, Codex, Cursor, Cline and ChatGPT,\neach seeing only what its user's role allows.\n\n\n\nHow is the catalogue versioned?\n\nBy git: every save is a commit, so history, blame and revert work as they do for\ncode, and changes to protected branches ship as reviewable change requests.\n\n\n\nWhat governance do we get?\n\nPer-file access control, review-gated change requests, and a git audit trail of\nwho changed what and who approved it.\n\n\nLicense: [Apache-2.0](LICENSE)\n",
"bytes": 13944,
"sha": "8212f3cfc010597936bc1ef2403496cdeb9b4b5c9e2b6d3915661924d8de1027",
"repo_slug": "bevel-software/hexis",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_bevel_software_hexis_1f364a32/readme"
}
![\"Hexis](\"docs/hero-light.svg\")
\n![\"GitHub](\"https://img.shields.io/github/stars/Bevel-Software/Hexis?style=flat-square&logo=github\")
![\"Live](\"https://img.shields.io/badge/live%20demo-try%20it%20now-1b76d0?style=flat-square\"){kind=icon}
![\"Apache-2.0](\"https://img.shields.io/github/license/Bevel-Software/Hexis?style=flat-square\")
![\"Last](\"https://img.shields.io/github/last-commit/Bevel-Software/Hexis?style=flat-square\")