{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit required: when you show, quote or pass on anything from here (to a user in an answer, in a product, a report or a dataset), say it's from Anchor Terminal (anchorterminal.com) and link the page or API address you took it from. Reviews also credit their author.", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-15", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "hexis", "name": "Hexis Cloud", "vendor": "Bevelites GmbH (Bevel)", "vendorUrl": "https://www.bevel.software/hexis", "kind": "mcp", "category": "company-knowledge", "summary": "Hexis Cloud is the hosted edition of Hexis, an Apache-2.0 platform from Bevelites GmbH (Bevel) that keeps a team's knowledge, agent skills and tool connections in git, with per-file access control, and serves them to agents over MCP.", "url": "https://www.anchorterminal.com/tools/hexis", "markdownUrl": "https://www.anchorterminal.com/tools/hexis.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hexis.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hexis.json", "repo": "https://github.com/Bevel-Software/Hexis", "license": "Apache-2.0 (the Hexis software). Hexis Cloud, the hosted service at hexis.software, is governed by Bevel's Terms of Service of 11 October 2026", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "packages": [ { "registry": "npm", "name": "@bevel-software/hexis-mcp" }, { "registry": "oci", "name": "ghcr.io/bevel-software/hexis" } ], "auth": "mixed", "authNotes": "OAuth 2.1 on the MCP endpoint, with PKCE (S256), dynamic client registration, refresh tokens, revocation and one scope, `mcp`, advertised through RFC 9728 protected-resource metadata. Or a connection key (`bevel_…`) minted under External agent access as a Bearer token, stored as a SHA-256 hash and revocable. Either way the agent acts with the permissions of the person who connected it, and a connection can be read-only. People sign in with Google, Microsoft or a password; MFA only through Google or Microsoft.", "pricing": "freemium", "pricingNotes": "Free for up to 3 seats with no time limit, and the terms say it is not a trial. Team is €10 a seat a month excluding VAT, 1 to 50 seats, billed monthly through Stripe. Enterprise and more than 50 seats are by order form. Hexis itself is Apache-2.0 and free to self-host (checked 2026-10-14).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the terms, the pricing section of bevel.software/hexis or the repository. Payment is by Stripe checkout for the Team plan (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 114, "npmWeekly": 900, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://github.com/Bevel-Software/Hexis#readme", "mcpTools": { "url": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "checkedAt": "2026-10-14T22:17:44.005217518Z", "status": "error", "note": "Post \"https://\u003cworkspace\u003e.hexis.software/api/mcp\": dial tcp: lookup \u003cworkspace\u003e.hexis.software: no such host", "changedAt": "2026-10-14T22:17:44.005217518Z" }, "registryName": "io.github.Bevel-Software/hexis", "capabilities": [ "knowledge.search", "work.docs", "agent.tools", "automation.auth", "auth.audit" ], "tags": [ "hosted", "open-source", "self-hosted", "mcp", "mcp-registry", "oauth", "api-key", "freemium", "free-tier", "no-card", "typescript", "docker", "eu", "eu-hosted", "read-only-mode", "agent-skills", "security-txt" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 55.3, "grade": "C", "agentReady": false, "rank": 705, "ranked": true, "rankOf": 1084, "categoryRank": 11, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 57, "maintenance": 85, "payments": 30, "reliability": 18, "schema": 83, "security": 64, "transparency": 75 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 18, "points": 3.6, "reason": "Graded on the hosted lines, because the surface is Hexis Cloud's MCP endpoint. No status page found, and status.hexis.software answers 'No workspace at this address' (0). No readable incident history (5). The security page says sign-in attempts are rate limited, but we found no request limits for the MCP endpoint or any tool (0). No documented 429, Retry-After or backoff guidance (0). The terms state no uptime figure and no SLA unless an order form has one, and the pricing section lists SLAs only for Enterprise, with no terms published (3 of 10). The service carries no beta label, though it went live on 11 October 2026 and the software is version 0.29.0 (10). The terms also say there are no backups and the whole service runs on one server, which this checklist doesn't score but a reader should weigh." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 83, "points": 13.49, "reason": "Every tool on tools/list has a JSON Schema input, and the server validates each schema before listing it so one malformed tool can't blank the list (25). No llms.txt. The agent guide is Markdown in the repository and goes to agents in the MCP handshake instructions, with the first line repeated on the four core tools (7 of 10). Descriptions open with a call example, say what each verdict such as canWrite means and when to open a change request instead, and point to the guide's shared rules (15 of 20). Inputs carry required fields, minLength, integer bounds and additionalProperties false, with some free-form code strings for call_tool_chain (12 of 15). Call examples on every tool and named refusals such as branch-required, but no single error reference (11 of 15). Release notes for every version on GitHub, on 0.x versions with no stated versioning policy (13 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 57, "points": 9.26, "reason": "About 37 platform tools plus three code-mode tools are listed directly, before any connected tool, which puts the listing over 30 (5). Code mode (list_tools, tools_info and call_tool_chain in a sandbox), skill lookup through list_skills and get_skill, and connection-key callers seeing only tools whose credentials are set add back 7 (12 of 25). grep and list_files narrow results, and call_tool_chain takes max_output_size and spills a large result to a file read back with read_file (14 of 20). Refusals name the problem, a missing branch is answered 404 naming it, and list_tool_setup returns setup.reason with the next step (15 of 20). No readOnlyHint or destructiveHint annotations. Writes land on a branch, and protected branches change only through approved change requests, which limits the harm of a repeated call (8 of 20). Branch defaults on read tools. One official client, the TypeScript local server on npm (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 64, "points": 11.2, "reason": "OAuth 2.1 with PKCE, dynamic client registration and token revocation, but a single `mcp` scope, and connection keys stored as SHA-256 hashes and revocable. The agent always acts with the connecting person's permissions (25 of 30). Read access is denied by default, rules apply per folder and file, a connection can be read-only, and protected content changes only with its owners' approval (17 of 20). The tools return knowledge-base pages any writer can edit and the results of third-party tools, and we found no prompt-injection guidance (3 of 15). Admins see an audit log of agent tool calls, who and with which connection, kept 365 days by default, and can revoke any connection (14 of 15). A valid security.txt and a candid security page, but the same page says there is no certification, no penetration test, no automated vulnerability scanning and no bug bounty, and the encryption keys sit on the server with the data (5 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 (0). Plan pricing is public, Free for up to 3 seats and Team at €10 a seat a month excluding VAT, with no per-call unit (10). The Free plan has no time limit and asks for no card (20). A person must sign in with Google, Microsoft or a password and tick the terms to create a workspace. OAuth dynamic client registration lets an MCP client register itself, but a person still completes the sign-in (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 85, "points": 7.44, "reason": "v0.29.0 on 14 October 2026 (30). 36 version tags since v0.1.0 on 10 August 2026, eight of them in October (20). No issues have ever been opened on GitHub, and the open items are eight pull requests, mostly from the maintainers, reviewed with comments the same week. Little outside activity to judge responsiveness by (15 of 25). In the official MCP registry as io.github.Bevel-Software/hexis, but the entry is version 0.1.0 from 11 August and points at the demo instance, not Hexis Cloud (10 of 15). A test workflow on every push and pull request with a real Postgres, a lint ratchet and dependencies pinned to exact versions (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "note": "editorial 81, provenance 69", "reason": "Hexis is Apache-2.0 and the terms describe Hexis Cloud as a managed version of it. Releases name an extension point for distributions, so we can't confirm every Cloud-only piece is public (27 of 30). The Hexis Cloud privacy policy, DPA, security page and data-portability page agree on retention (logs capped at 150 MB, deleted workspaces kept 30 days, audit log 365 days) and say no AI provider and no analytics service receives data. Bevel's own privacy policy at bevel.software/privacy describes a different product with OpenAI and Serper as processors and carries two different dates, which a reader may confuse with Hexis Cloud's (24 of 30). The terms give six weeks' notice of price changes and a right to leave on service changes, with no deprecation policy for tools or endpoints (8 of 20). Sub-processors are listed with locations and transfer safeguards, and a change log (20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "About 37 platform tools plus three code-mode tools are listed directly, before any connected tool, which puts the listing over 30 (5). Code mode (list_tools, tools_info and call_tool_chain in a sandbox), skill lookup through list_skills and get_skill, and connection-key callers seeing only tools whose credentials are set add back 7 (12 of 25). grep and list_files narrow results, and call_tool_chain takes max_output_size and spills a large result to a file read back with read_file (14 of 20). Refusals name the problem, a missing branch is answered 404 naming it, and list_tool_setup returns setup.reason with the next step (15 of 20). No readOnlyHint or destructiveHint annotations. Writes land on a branch, and protected branches change only through approved change requests, which limits the harm of a repeated call (8 of 20). Branch defaults on read tools. One official client, the TypeScript local server on npm (8 of 15).", "maintenance": "v0.29.0 on 14 October 2026 (30). 36 version tags since v0.1.0 on 10 August 2026, eight of them in October (20). No issues have ever been opened on GitHub, and the open items are eight pull requests, mostly from the maintainers, reviewed with comments the same week. Little outside activity to judge responsiveness by (15 of 25). In the official MCP registry as io.github.Bevel-Software/hexis, but the entry is version 0.1.0 from 11 August and points at the demo instance, not Hexis Cloud (10 of 15). A test workflow on every push and pull request with a real Postgres, a lint ratchet and dependencies pinned to exact versions (10).", "payments": "No x402, MPP or L402 (0). Plan pricing is public, Free for up to 3 seats and Team at €10 a seat a month excluding VAT, with no per-call unit (10). The Free plan has no time limit and asks for no card (20). A person must sign in with Google, Microsoft or a password and tick the terms to create a workspace. OAuth dynamic client registration lets an MCP client register itself, but a person still completes the sign-in (0).", "reliability": "Graded on the hosted lines, because the surface is Hexis Cloud's MCP endpoint. No status page found, and status.hexis.software answers 'No workspace at this address' (0). No readable incident history (5). The security page says sign-in attempts are rate limited, but we found no request limits for the MCP endpoint or any tool (0). No documented 429, Retry-After or backoff guidance (0). The terms state no uptime figure and no SLA unless an order form has one, and the pricing section lists SLAs only for Enterprise, with no terms published (3 of 10). The service carries no beta label, though it went live on 11 October 2026 and the software is version 0.29.0 (10). The terms also say there are no backups and the whole service runs on one server, which this checklist doesn't score but a reader should weigh.", "schema": "Every tool on tools/list has a JSON Schema input, and the server validates each schema before listing it so one malformed tool can't blank the list (25). No llms.txt. The agent guide is Markdown in the repository and goes to agents in the MCP handshake instructions, with the first line repeated on the four core tools (7 of 10). Descriptions open with a call example, say what each verdict such as canWrite means and when to open a change request instead, and point to the guide's shared rules (15 of 20). Inputs carry required fields, minLength, integer bounds and additionalProperties false, with some free-form code strings for call_tool_chain (12 of 15). Call examples on every tool and named refusals such as branch-required, but no single error reference (11 of 15). Release notes for every version on GitHub, on 0.x versions with no stated versioning policy (13 of 15).", "security": "OAuth 2.1 with PKCE, dynamic client registration and token revocation, but a single `mcp` scope, and connection keys stored as SHA-256 hashes and revocable. The agent always acts with the connecting person's permissions (25 of 30). Read access is denied by default, rules apply per folder and file, a connection can be read-only, and protected content changes only with its owners' approval (17 of 20). The tools return knowledge-base pages any writer can edit and the results of third-party tools, and we found no prompt-injection guidance (3 of 15). Admins see an audit log of agent tool calls, who and with which connection, kept 365 days by default, and can revoke any connection (14 of 15). A valid security.txt and a candid security page, but the same page says there is no certification, no penetration test, no automated vulnerability scanning and no bug bounty, and the encryption keys sit on the server with the data (5 of 20).", "transparency": "Hexis is Apache-2.0 and the terms describe Hexis Cloud as a managed version of it. Releases name an extension point for distributions, so we can't confirm every Cloud-only piece is public (27 of 30). The Hexis Cloud privacy policy, DPA, security page and data-portability page agree on retention (logs capped at 150 MB, deleted workspaces kept 30 days, audit log 365 days) and say no AI provider and no analytics service receives data. Bevel's own privacy policy at bevel.software/privacy describes a different product with OpenAI and Serper as processors and carries two different dates, which a reader may confuse with Hexis Cloud's (24 of 30). The terms give six weeks' notice of price changes and a right to leave on service changes, with no deprecation policy for tools or endpoints (8 of 20). Sub-processors are listed with locations and transfer safeguards, and a change log (20)." }, "sources": [ { "what": "Hexis product and pricing page", "url": "https://www.bevel.software/hexis", "seen": "2026-10-14" }, { "what": "Hexis Cloud terms of service, version 1.0 of 11 October 2026", "url": "https://hexis.software/terms", "seen": "2026-10-14" }, { "what": "Hexis Cloud privacy policy", "url": "https://hexis.software/privacy", "seen": "2026-10-14" }, { "what": "Hexis Cloud security page", "url": "https://hexis.software/security", "seen": "2026-10-14" }, { "what": "Hexis Cloud sub-processors", "url": "https://hexis.software/subprocessors", "seen": "2026-10-14" }, { "what": "Hexis Cloud data portability and switching", "url": "https://hexis.software/data-portability", "seen": "2026-10-14" }, { "what": "security.txt", "url": "https://hexis.software/.well-known/security.txt", "seen": "2026-10-14" }, { "what": "Repository, README, agent guide and MCP server source", "url": "https://github.com/Bevel-Software/Hexis", "seen": "2026-10-14" }, { "what": "Release notes", "url": "https://github.com/Bevel-Software/Hexis/releases", "seen": "2026-10-14" }, { "what": "Local MCP server package", "url": "https://registry.npmjs.org/@bevel-software/hexis-mcp", "seen": "2026-10-14" }, { "what": "Official MCP registry entry", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=hexis", "seen": "2026-10-14" }, { "what": "OAuth metadata of the demo instance", "url": "https://demo.bevel.software/.well-known/oauth-authorization-server", "seen": "2026-10-14" }, { "what": "Bevel privacy policy (Bevel Knowledge Base)", "url": "https://www.bevel.software/privacy", "seen": "2026-10-14" }, { "what": "Impressum", "url": "https://www.bevel.software/impressum", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: the Product Hunt launch date of 12 October. The legal documents date Hexis Cloud to 11 October 2026, and we didn't read Product Hunt", "unchecked: the tool list a live Hexis Cloud workspace returns. We read it from the source and created no workspace", "unchecked: whether Hexis Cloud runs any code that isn't in the public repository", "Bevel's site describes '100s of tools' and '58 ready-made skills'. We didn't count either. Tools are any MCP server or API a workspace connects", "The MCP registry entry still points at demo.bevel.software at version 0.1.0" ] }, "negative": 0, "verdict": "Agents reach a git-backed knowledge base, shared skills and connected tools through one OAuth MCP endpoint that applies each person's per-file permissions, with read-only connections and an audit log of tool calls. The hosted edition dates from 11 October 2026, and its own terms state no backups, no uptime commitment and no security certification.", "bestFor": "A team that wants its agent skills, company pages and tool credentials in one git repository, reviewed and access-controlled per file, and reached by any MCP client.", "strengths": [ "Hexis core is Apache-2.0 on GitHub, with 36 version tags from v0.1.0 on 10 August to v0.29.0 on 14 October 2026", "OAuth 2.1 with PKCE and dynamic client registration on the MCP endpoint, plus hashed, revocable connection keys", "Per-folder and per-file access rules, read-only connections and owner approval for changes to protected branches", "Audit log of agent tool calls kept 365 days by default, with each connection revocable from the workspace", "Free plan for up to 3 seats with no time limit, Team at €10 a seat a month excluding VAT" ], "weaknesses": [ "The terms and security page state no backups, no SLA, no penetration test, no certification and no MFA of its own", "All workspaces share one Hetzner server in Nuremberg with logical separation, and the encryption keys sit on that server", "No status page and no published request rate limits for the MCP endpoint", "Over 35 platform tools are listed directly, with no readOnlyHint or destructiveHint annotations", "Hexis Cloud is open to businesses only, and a person must sign in with Google, Microsoft or a password to create a workspace" ], "agentNotes": [ "Ask the person for a read-only connection when the task only reads. It answers canWrite false everywhere", "Pass the branch you are working on to every knowledge-base tool. Calls without a required branch are refused", "Check canWrite from list_files, read_file or get_skill before writing, and open a change request when it is false", "Use list_tools and tools_info before call_tool_chain, and never ask the person for a tool's secret in chat", "Keep your own copy of anything important. Hexis Cloud keeps no backups of Managed repositories" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.3 } ], "editorialScores": { "ergonomics": 57, "maintenance": 85, "payments": 30, "reliability": 18, "schema": 83, "security": 64, "transparency": 81 }, "provenanceScore": 69 }, "connect": { "install": "npx -y @bevel-software/hexis-mcp --url https://\u003cworkspace\u003e.hexis.software", "config": { "mcpServers": { "hexis": { "args": [ "-y", "@bevel-software/hexis-mcp" ], "command": "npx", "env": { "HEXIS_CONNECTION_KEY": "bevel_…", "HEXIS_URL": "https://\u003cworkspace\u003e.hexis.software" } } } } }, "letme": { "capability": "https://letme.dev/knowledge.search", "tool": "https://letme.dev/hexis" }, "notable": [ "Hexis Cloud's terms, privacy policy, DPA, sub-processor list and security page are all version 1.0 of 11 October 2026. The open-source Hexis it runs dates from 30 July 2026 (https://hexis.software/terms; https://github.com/Bevel-Software/Hexis)", "Terms clause 3.6 says the service includes no AI of its own, no backups, no promised availability and no MFA of its own (https://hexis.software/terms)", "The whole service runs on one Hetzner server in Nuremberg, which also runs a test environment, a product demo and an internal dashboard. Workspaces are separated by database schema and folders (https://hexis.software/security)", "tools/list returns three code-mode tools (list_tools, tools_info, call_tool_chain) and then every platform and connected tool directly. The source defines about 37 platform tools, from read_file and grep to merge_branch and open_change_request (https://github.com/Bevel-Software/Hexis/blob/main/packages/core-backend/src/modules/mcp/mcp.service.ts)", "Connection-key callers are listed only the tools whose per-user credentials are already set, so an unattended pipeline is not handed a tool that needs a sign-in (mcp.service.ts)", "The official MCP registry entry io.github.Bevel-Software/hexis is version 0.1.0 of 11 August 2026 and points at the demo instance, demo.bevel.software, not Hexis Cloud (https://registry.modelcontextprotocol.io/v0/servers?search=hexis)", "Bevel's own privacy policy at bevel.software/privacy describes a different product, the Bevel Knowledge Base, with OpenAI and Serper as processors. Hexis Cloud's policy at hexis.software/privacy names Hetzner and Resend and says no AI provider receives data" ], "area": "business", "details": [ { "label": "Surface listed", "value": "Hexis Cloud's hosted MCP endpoint at https://\u003cworkspace\u003e.hexis.software/api/mcp, read from the repository, the README, the agent guide and the legal pages on 14 October 2026. No workspace was created" }, { "label": "Editions", "value": "Hexis, Apache-2.0, self-hosted with Docker Compose (image ghcr.io/bevel-software/hexis), and Hexis Cloud, run by Bevel at hexis.software since 11 October 2026. A local MCP server, @bevel-software/hexis-mcp on npm, adds local-only tools to either" }, { "label": "MCP tools", "value": "list_tools, tools_info and call_tool_chain (code mode in an isolated-vm sandbox), then about 37 platform tools for files, skills, branches and change requests, then the tools of connected MCP servers and APIs. No tool annotations" }, { "label": "Knowledge base", "value": "A git repository in one of three modes, Managed on Bevel's server, your own GitHub repository through Bevel's GitHub App, or any git host by address and token" }, { "label": "Access control", "value": "Deny by default, with rules per folder and file in the repository, roles and groups, owner approval on protected branches and read-only connections" }, { "label": "Connected tools", "value": "Any MCP server or HTTP API described as a UTCP manual in the repository. Secrets stay in an encrypted vault on the server, shared or per user, with OAuth sign-in per person" }, { "label": "Hosting", "value": "One Hetzner server in Nuremberg, Germany. Sub-processors Hetzner and Resend (service emails, USA). No backups. Deleted workspaces kept 30 days" }, { "label": "Rate limits", "value": "Sign-in attempts are rate limited. No published request limits for the MCP endpoint" }, { "label": "Releases", "value": "Package tags 0.1.0 on 31 July 2026, then 36 version tags from v0.1.0 (10 August) to v0.29.0 (14 October 2026), with release notes on GitHub for each" } ], "provenance": { "legalEntity": "Bevelites GmbH", "domain": "hexis.software", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://hexis.software/terms", "privacy": "https://hexis.software/privacy", "statusPage": "", "changelog": "https://github.com/Bevel-Software/Hexis/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "Bevelites GmbH, Schleißheimer Str. 188, 80797 München, HRB 303590 at Amtsgericht München, per the Impressum at bevel.software/impressum and the terms.", "hexis.software is a single-page app. The legal pages render with JavaScript, and we read their text from the site's published script bundle.", "hexis.software/.well-known/security.txt names juan@bevel.software and expires on 30 September 2027.", "hexis.software serves the app for every path, including robots.txt, so there is no robots.txt to disallow anything. bevel.software's robots.txt disallows only /api/.", "No status page found. status.hexis.software answers 'No workspace at this address'." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "Bevelites GmbH", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "hexis.software, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "\u003cworkspace\u003e.hexis.software", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://hexis.software/terms", "state": "unreadable", "reason": "the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-14", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://hexis.software/privacy", "state": "unreadable", "reason": "the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-14", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hexis.json", "live": { "slug": "hexis", "probe": { "target": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "method": "mcp-initialize", "lastAt": "2026-10-15T00:24:13.30353878Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 31, "samples30d": 31, "days": [ { "date": "2026-10-14", "probes": 26, "ok": 0 }, { "date": "2026-10-15", "probes": 5, "ok": 0 } ], "outages": [ { "start": "2026-10-14T21:31:42.133995117Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "versions": [ { "registry": "github", "name": "Bevel-Software/Hexis", "version": "v0.29.0", "released": "2026-10-14", "seenAt": "2026-10-14T23:57:19.802349377Z" }, { "registry": "npm", "name": "@bevel-software/hexis-mcp", "version": "0.29.0", "seenAt": "2026-10-14T23:57:18.908423769Z" } ], "githubStars": 114, "npmWeekly": 900, "mcpTools": { "url": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "checkedAt": "2026-10-14T22:17:44.005217518Z", "status": "error", "note": "Post \"https://\u003cworkspace\u003e.hexis.software/api/mcp\": dial tcp: lookup \u003cworkspace\u003e.hexis.software: no such host", "changedAt": "2026-10-14T22:17:44.005217518Z" }, "updatedAt": "2026-10-15T00:24:13.30353878Z" } } }