Hexis

Hexis is a control plane for centrally managing AI agent skills, tools, context, permissions, and identity for enterprises. It is self-hosted, Git-backed, and natively supports MCP (Model Context Protocol), centralizing all of a company's AI plugins, tools, and knowledge in one place, where they are uniformly managed, reviewed, and access-controlled, and can be used from any AI agent. This repository is the open-source core of the Bevel platform, and teams are said to be using it.

Purpose and Positioning

The purpose of Hexis is to provide a unified storage and management entry point for AI agents' skills, tool manuals, context, and identity permissions. Every skill, tool manual, and permission is a file in a Git repository that you own, so the audit trail is the storage layer itself: who changed what, when, who approved it, and how it was revoked are all traceable. Agents can only perform the operations that the person running them can perform; permissions are resolved per file, and agents never hold the credentials they use. The system runs on your own infrastructure, behind your own SSO.

Main Capabilities

Git-backed changes and review: skills and tool manuals are reviewable files. Anyone can propose changes; on protected branches, changes are delivered to the owners of the files involved, and only take effect after the owners approve. Agents can propose too: if an agent encounters a broken skill during a task, it can suggest a fix, and a human decides whether to adopt it.
Bidirectional management: unlike MCP gateways that only consume in one direction, Hexis lets users propose changes or share new skills and MCP servers, with fine-grained view and review permission controls.
Roles and access control: teammates can be added to roles or granted direct access on demand. Everyone connects to the same workspace, but each person and their agents can only see what they are allowed to read.
MCP-native integration: works with any MCP-capable client, including Claude Code, Codex, Cursor, Cline, and ChatGPT, each seeing only what its user's role allows.
Local MCP server: agents running on your own machine can start npx -y @bevel-software/hexis-mcp as a local MCP server, thereby adding plugin-specific local tools on top of the capabilities provided by the hosted endpoint. This command requires Node 22.13+ or 24, and clients launched from the Dock or a desktop icon may not see npx in PATH, so use which npx(on Windows, use where npx) to get the full path and fill it into "command".
Knowledge pages support relative links and images; access permissions follow the folder, and links remain valid when exported; pasting base64 images is not supported.
Every save is a commit, and history, blame, and rollback are consistent with code management; changes on protected branches are published as reviewable change requests.

How to Use

Experience and Connection

Claude can be connected to Hexis via MCP, and then you can ask questions normally. Claude can discover and load approved skill descriptions and company context that your role has access to, without copying prompts between tools.
Cline can connect to Hexis directly as a remote Streamable HTTP MCP server. Use the Cline CLI to install the public demo connection, and after completing OAuth login in the browser, Cline can discover the skills, tools, and context accessible to your Hexis role; for self-hosted deployments, replace the demo.bevel.software Replace with your deployment host.
Public instance demo.bevel.software You can sign in with a Google account; it contains the knowledge, skills, and tools of a fictional company, and the Start here page guides you through the complete flow. The demo is shared and mostly read-only (visitors propose, owners approve).

Hosting and deployment

Hosted instance: the official team can run it for you (hosting, upgrades, backups, SSO); your team only needs to sign in. Contact email: ali.raza@bevel.software.
Docker deployment: requires Docker with Compose (on a server or a laptop) and an empty Git repository (any host) to store the knowledge base; the first run initializes the repository with a starter template.
Download the two deployment files; no clone is needed. Edit .env to fill in the four required values. Generate two secrets (run twice and paste each one); a public HTTPS deployment also requires setting DOMAIN. The startup command pulls the CI release image; nothing is compiled on the server, so a small instance is enough. You can pin the version in .env (HEXIS_VERSION=0.15.1); for upgrades and backups, see UPGRADING.md. To build from source, use deployment/docker-compose.build.yml.
Public HTTPS with your own proxy absent: thehttps profile starts Caddy before the app, automatically obtains a Let's Encrypt certificate for DOMAIN, and performs HTTP→HTTPS redirects. DNS A/AAAA records pointing to the server are required, and ports 80 and 443 must be open (port 80 must be open for certificate challenges and redirects).
Behind your own reverse proxy (Coolify, Traefik, nginx): skip that profile, and instead set the origin value and the proxy hop count to ensure OAuth redirects are correct and rate limiting sees the real client IP. Explicitly using -f skips docker-compose.override.yml; the app does not publish a host port, and the proxy accesses it on port 3001 via the compose network. This is intentional: pinning a published port causes the replacement container to start on every redeployment while the old container still occupies the port, resulting in a port already in use error.
Laptop trial: the steps are the same; omit DOMAIN and the origin value, and additionally obtain docker-compose.override.yml to put the app on localhost; open http://localhost:3001(to change the port, use APP_PORT=8080 docker compose up -d). Do not set TRUST_PROXY here, because with no front proxy, trusting forwarded headers lets clients forge their own address.

First login setup

The app asks for information that cannot be guessed and tests the real host before saving: the https clone URL of the knowledge base repository; Git credentials with read/write access (on GitHub, a fine-grained personal access token with Contents read/write access to that repository can be used); the branch model (default branch and protected branch; changes to the protected branch take effect only through approved change requests). If the repository is empty, the app initializes it with the built-in template and writes roles.yaml; the first Admin is you. After that, create your first plugin and skill in Skills & Tools, and connect agents via MCP in the Connect menu.

Knowledge pages

Pages are markdown. Links to other pages use relative paths, and Hexis opens them within the app; the same applies to images—place them in the assets/ folder next to the page that uses them and link relatively. Access permissions follow the folder, so anyone who can read a page can also see its screenshots; moving a folder keeps all links valid. Sharing a single Uploads/ folder loses both of these advantages.

Local development

Requires Node 22.13 or newer (.nvmrc; engine range >=22.13 <23), pnpm 10, git ≥ 2.41, and Postgres 17. Open http://localhost:5173(the development server proxies to the backend). Common commands:pnpm test、pnpm typecheck、pnpm lint. Migrations run automatically on startup; there is no separate migration step for development or production.

Use cases

Enterprises centrally manage AI agent skills, tools, and context, and need audit and approval processes.
Need file-granular control over who can view, who can propose, and who can approve.
Want agents to be able to perform only the operations the runner can perform and not hold credentials.
Need to work with multiple MCP clients (Claude Code, Codex, Cursor, Cline, ChatGPT, etc.).
Need to deploy on your own infrastructure, behind your own SSO.

Limitations

Permissions are resolved per file, and access follows folders; sharing the Uploads folder loses per-folder access and link stability.
Pasting base64 images is not supported.
Local MCP commands require Node 22.13+ or 24, and some clients may not find npx.
Explicitly using -f , the app does not publish host ports and must be accessed via the compose network.
TRUST_PROXY should not be set without a front proxy.
Information is not provided regarding charges, pricing, specific performance metrics, the full list of supported clients, or scale limits beyond the demo.

License

Apache-2.0.