{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/merge-agent-handler.json", "name": "Merge Agent Handler", "score": 69.5, "shared": [ "automation.auth", "agent.tools", "auth.audit" ], "slug": "merge-agent-handler" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/stackone.json", "name": "StackOne", "score": 69.1, "shared": [ "automation.auth", "agent.tools", "auth.audit" ], "slug": "stackone" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/one.json", "name": "One", "score": 66.6, "shared": [ "automation.auth", "agent.tools", "auth.audit" ], "slug": "one" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/composio-rube.json", "name": "Composio (API + MCP)", "score": 75.1, "shared": [ "automation.auth", "agent.tools" ], "slug": "composio-rube" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nango.json", "name": "Nango", "score": 67.7, "shared": [ "auth.audit", "agent.tools" ], "slug": "nango" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/arcade.json", "name": "Arcade.dev", "score": 66.9, "shared": [ "auth.audit", "agent.tools" ], "slug": "arcade" } ], "tool": { "slug": "hexis", "name": "Hexis Cloud", "vendor": "Bevelites GmbH (Bevel)", "vendorUrl": "https://www.bevel.software/hexis", "kind": "mcp", "category": "company-knowledge", "summary": "Hexis Cloud is the hosted edition of Hexis, an Apache-2.0 platform from Bevelites GmbH (Bevel) that keeps a team's knowledge, agent skills and tool connections in git, with per-file access control, and serves them to agents over MCP.", "url": "https://www.anchorterminal.com/tools/hexis", "markdownUrl": "https://www.anchorterminal.com/tools/hexis.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hexis.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hexis.json", "repo": "https://github.com/Bevel-Software/Hexis", "license": "Apache-2.0 (the Hexis software). Hexis Cloud, the hosted service at hexis.software, is governed by Bevel's Terms of Service of 11 October 2026", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "packages": [ { "registry": "npm", "name": "@bevel-software/hexis-mcp" }, { "registry": "oci", "name": "ghcr.io/bevel-software/hexis" } ], "auth": "mixed", "authNotes": "OAuth 2.1 on the MCP endpoint, with PKCE (S256), dynamic client registration, refresh tokens, revocation and one scope, `mcp`, advertised through RFC 9728 protected-resource metadata. Or a connection key (`bevel_…`) minted under External agent access as a Bearer token, stored as a SHA-256 hash and revocable. Either way the agent acts with the permissions of the person who connected it, and a connection can be read-only. People sign in with Google, Microsoft or a password; MFA only through Google or Microsoft.", "pricing": "freemium", "pricingNotes": "Free for up to 3 seats with no time limit, and the terms say it is not a trial. Team is €10 a seat a month excluding VAT, 1 to 50 seats, billed monthly through Stripe. Enterprise and more than 50 seats are by order form. Hexis itself is Apache-2.0 and free to self-host (checked 2026-10-14).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the terms, the pricing section of bevel.software/hexis or the repository. Payment is by Stripe checkout for the Team plan (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 114, "npmWeekly": 900, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://github.com/Bevel-Software/Hexis#readme", "mcpTools": { "url": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "checkedAt": "2026-10-14T22:17:44.005217518Z", "status": "error", "note": "Post \"https://\u003cworkspace\u003e.hexis.software/api/mcp\": dial tcp: lookup \u003cworkspace\u003e.hexis.software: no such host", "changedAt": "2026-10-14T22:17:44.005217518Z" }, "registryName": "io.github.Bevel-Software/hexis", "capabilities": [ "knowledge.search", "work.docs", "agent.tools", "automation.auth", "auth.audit" ], "tags": [ "hosted", "open-source", "self-hosted", "mcp", "mcp-registry", "oauth", "api-key", "freemium", "free-tier", "no-card", "typescript", "docker", "eu", "eu-hosted", "read-only-mode", "agent-skills", "security-txt" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 55.3, "grade": "C", "agentReady": false, "rank": 705, "ranked": true, "rankOf": 1084, "categoryRank": 11, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 57, "maintenance": 85, "payments": 30, "reliability": 18, "schema": 83, "security": 64, "transparency": 75 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 18, "points": 3.6, "reason": "Graded on the hosted lines, because the surface is Hexis Cloud's MCP endpoint. No status page found, and status.hexis.software answers 'No workspace at this address' (0). No readable incident history (5). The security page says sign-in attempts are rate limited, but we found no request limits for the MCP endpoint or any tool (0). No documented 429, Retry-After or backoff guidance (0). The terms state no uptime figure and no SLA unless an order form has one, and the pricing section lists SLAs only for Enterprise, with no terms published (3 of 10). The service carries no beta label, though it went live on 11 October 2026 and the software is version 0.29.0 (10). The terms also say there are no backups and the whole service runs on one server, which this checklist doesn't score but a reader should weigh." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 83, "points": 13.49, "reason": "Every tool on tools/list has a JSON Schema input, and the server validates each schema before listing it so one malformed tool can't blank the list (25). No llms.txt. The agent guide is Markdown in the repository and goes to agents in the MCP handshake instructions, with the first line repeated on the four core tools (7 of 10). Descriptions open with a call example, say what each verdict such as canWrite means and when to open a change request instead, and point to the guide's shared rules (15 of 20). Inputs carry required fields, minLength, integer bounds and additionalProperties false, with some free-form code strings for call_tool_chain (12 of 15). Call examples on every tool and named refusals such as branch-required, but no single error reference (11 of 15). Release notes for every version on GitHub, on 0.x versions with no stated versioning policy (13 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 57, "points": 9.26, "reason": "About 37 platform tools plus three code-mode tools are listed directly, before any connected tool, which puts the listing over 30 (5). Code mode (list_tools, tools_info and call_tool_chain in a sandbox), skill lookup through list_skills and get_skill, and connection-key callers seeing only tools whose credentials are set add back 7 (12 of 25). grep and list_files narrow results, and call_tool_chain takes max_output_size and spills a large result to a file read back with read_file (14 of 20). Refusals name the problem, a missing branch is answered 404 naming it, and list_tool_setup returns setup.reason with the next step (15 of 20). No readOnlyHint or destructiveHint annotations. Writes land on a branch, and protected branches change only through approved change requests, which limits the harm of a repeated call (8 of 20). Branch defaults on read tools. One official client, the TypeScript local server on npm (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 64, "points": 11.2, "reason": "OAuth 2.1 with PKCE, dynamic client registration and token revocation, but a single `mcp` scope, and connection keys stored as SHA-256 hashes and revocable. The agent always acts with the connecting person's permissions (25 of 30). Read access is denied by default, rules apply per folder and file, a connection can be read-only, and protected content changes only with its owners' approval (17 of 20). The tools return knowledge-base pages any writer can edit and the results of third-party tools, and we found no prompt-injection guidance (3 of 15). Admins see an audit log of agent tool calls, who and with which connection, kept 365 days by default, and can revoke any connection (14 of 15). A valid security.txt and a candid security page, but the same page says there is no certification, no penetration test, no automated vulnerability scanning and no bug bounty, and the encryption keys sit on the server with the data (5 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 (0). Plan pricing is public, Free for up to 3 seats and Team at €10 a seat a month excluding VAT, with no per-call unit (10). The Free plan has no time limit and asks for no card (20). A person must sign in with Google, Microsoft or a password and tick the terms to create a workspace. OAuth dynamic client registration lets an MCP client register itself, but a person still completes the sign-in (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 85, "points": 7.44, "reason": "v0.29.0 on 14 October 2026 (30). 36 version tags since v0.1.0 on 10 August 2026, eight of them in October (20). No issues have ever been opened on GitHub, and the open items are eight pull requests, mostly from the maintainers, reviewed with comments the same week. Little outside activity to judge responsiveness by (15 of 25). In the official MCP registry as io.github.Bevel-Software/hexis, but the entry is version 0.1.0 from 11 August and points at the demo instance, not Hexis Cloud (10 of 15). A test workflow on every push and pull request with a real Postgres, a lint ratchet and dependencies pinned to exact versions (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "note": "editorial 81, provenance 69", "reason": "Hexis is Apache-2.0 and the terms describe Hexis Cloud as a managed version of it. Releases name an extension point for distributions, so we can't confirm every Cloud-only piece is public (27 of 30). The Hexis Cloud privacy policy, DPA, security page and data-portability page agree on retention (logs capped at 150 MB, deleted workspaces kept 30 days, audit log 365 days) and say no AI provider and no analytics service receives data. Bevel's own privacy policy at bevel.software/privacy describes a different product with OpenAI and Serper as processors and carries two different dates, which a reader may confuse with Hexis Cloud's (24 of 30). The terms give six weeks' notice of price changes and a right to leave on service changes, with no deprecation policy for tools or endpoints (8 of 20). Sub-processors are listed with locations and transfer safeguards, and a change log (20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "About 37 platform tools plus three code-mode tools are listed directly, before any connected tool, which puts the listing over 30 (5). Code mode (list_tools, tools_info and call_tool_chain in a sandbox), skill lookup through list_skills and get_skill, and connection-key callers seeing only tools whose credentials are set add back 7 (12 of 25). grep and list_files narrow results, and call_tool_chain takes max_output_size and spills a large result to a file read back with read_file (14 of 20). Refusals name the problem, a missing branch is answered 404 naming it, and list_tool_setup returns setup.reason with the next step (15 of 20). No readOnlyHint or destructiveHint annotations. Writes land on a branch, and protected branches change only through approved change requests, which limits the harm of a repeated call (8 of 20). Branch defaults on read tools. One official client, the TypeScript local server on npm (8 of 15).", "maintenance": "v0.29.0 on 14 October 2026 (30). 36 version tags since v0.1.0 on 10 August 2026, eight of them in October (20). No issues have ever been opened on GitHub, and the open items are eight pull requests, mostly from the maintainers, reviewed with comments the same week. Little outside activity to judge responsiveness by (15 of 25). In the official MCP registry as io.github.Bevel-Software/hexis, but the entry is version 0.1.0 from 11 August and points at the demo instance, not Hexis Cloud (10 of 15). A test workflow on every push and pull request with a real Postgres, a lint ratchet and dependencies pinned to exact versions (10).", "payments": "No x402, MPP or L402 (0). Plan pricing is public, Free for up to 3 seats and Team at €10 a seat a month excluding VAT, with no per-call unit (10). The Free plan has no time limit and asks for no card (20). A person must sign in with Google, Microsoft or a password and tick the terms to create a workspace. OAuth dynamic client registration lets an MCP client register itself, but a person still completes the sign-in (0).", "reliability": "Graded on the hosted lines, because the surface is Hexis Cloud's MCP endpoint. No status page found, and status.hexis.software answers 'No workspace at this address' (0). No readable incident history (5). The security page says sign-in attempts are rate limited, but we found no request limits for the MCP endpoint or any tool (0). No documented 429, Retry-After or backoff guidance (0). The terms state no uptime figure and no SLA unless an order form has one, and the pricing section lists SLAs only for Enterprise, with no terms published (3 of 10). The service carries no beta label, though it went live on 11 October 2026 and the software is version 0.29.0 (10). The terms also say there are no backups and the whole service runs on one server, which this checklist doesn't score but a reader should weigh.", "schema": "Every tool on tools/list has a JSON Schema input, and the server validates each schema before listing it so one malformed tool can't blank the list (25). No llms.txt. The agent guide is Markdown in the repository and goes to agents in the MCP handshake instructions, with the first line repeated on the four core tools (7 of 10). Descriptions open with a call example, say what each verdict such as canWrite means and when to open a change request instead, and point to the guide's shared rules (15 of 20). Inputs carry required fields, minLength, integer bounds and additionalProperties false, with some free-form code strings for call_tool_chain (12 of 15). Call examples on every tool and named refusals such as branch-required, but no single error reference (11 of 15). Release notes for every version on GitHub, on 0.x versions with no stated versioning policy (13 of 15).", "security": "OAuth 2.1 with PKCE, dynamic client registration and token revocation, but a single `mcp` scope, and connection keys stored as SHA-256 hashes and revocable. The agent always acts with the connecting person's permissions (25 of 30). Read access is denied by default, rules apply per folder and file, a connection can be read-only, and protected content changes only with its owners' approval (17 of 20). The tools return knowledge-base pages any writer can edit and the results of third-party tools, and we found no prompt-injection guidance (3 of 15). Admins see an audit log of agent tool calls, who and with which connection, kept 365 days by default, and can revoke any connection (14 of 15). A valid security.txt and a candid security page, but the same page says there is no certification, no penetration test, no automated vulnerability scanning and no bug bounty, and the encryption keys sit on the server with the data (5 of 20).", "transparency": "Hexis is Apache-2.0 and the terms describe Hexis Cloud as a managed version of it. Releases name an extension point for distributions, so we can't confirm every Cloud-only piece is public (27 of 30). The Hexis Cloud privacy policy, DPA, security page and data-portability page agree on retention (logs capped at 150 MB, deleted workspaces kept 30 days, audit log 365 days) and say no AI provider and no analytics service receives data. Bevel's own privacy policy at bevel.software/privacy describes a different product with OpenAI and Serper as processors and carries two different dates, which a reader may confuse with Hexis Cloud's (24 of 30). The terms give six weeks' notice of price changes and a right to leave on service changes, with no deprecation policy for tools or endpoints (8 of 20). Sub-processors are listed with locations and transfer safeguards, and a change log (20)." }, "sources": [ { "what": "Hexis product and pricing page", "url": "https://www.bevel.software/hexis", "seen": "2026-10-14" }, { "what": "Hexis Cloud terms of service, version 1.0 of 11 October 2026", "url": "https://hexis.software/terms", "seen": "2026-10-14" }, { "what": "Hexis Cloud privacy policy", "url": "https://hexis.software/privacy", "seen": "2026-10-14" }, { "what": "Hexis Cloud security page", "url": "https://hexis.software/security", "seen": "2026-10-14" }, { "what": "Hexis Cloud sub-processors", "url": "https://hexis.software/subprocessors", "seen": "2026-10-14" }, { "what": "Hexis Cloud data portability and switching", "url": "https://hexis.software/data-portability", "seen": "2026-10-14" }, { "what": "security.txt", "url": "https://hexis.software/.well-known/security.txt", "seen": "2026-10-14" }, { "what": "Repository, README, agent guide and MCP server source", "url": "https://github.com/Bevel-Software/Hexis", "seen": "2026-10-14" }, { "what": "Release notes", "url": "https://github.com/Bevel-Software/Hexis/releases", "seen": "2026-10-14" }, { "what": "Local MCP server package", "url": "https://registry.npmjs.org/@bevel-software/hexis-mcp", "seen": "2026-10-14" }, { "what": "Official MCP registry entry", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=hexis", "seen": "2026-10-14" }, { "what": "OAuth metadata of the demo instance", "url": "https://demo.bevel.software/.well-known/oauth-authorization-server", "seen": "2026-10-14" }, { "what": "Bevel privacy policy (Bevel Knowledge Base)", "url": "https://www.bevel.software/privacy", "seen": "2026-10-14" }, { "what": "Impressum", "url": "https://www.bevel.software/impressum", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: the Product Hunt launch date of 12 October. The legal documents date Hexis Cloud to 11 October 2026, and we didn't read Product Hunt", "unchecked: the tool list a live Hexis Cloud workspace returns. We read it from the source and created no workspace", "unchecked: whether Hexis Cloud runs any code that isn't in the public repository", "Bevel's site describes '100s of tools' and '58 ready-made skills'. We didn't count either. Tools are any MCP server or API a workspace connects", "The MCP registry entry still points at demo.bevel.software at version 0.1.0" ] }, "negative": 0, "verdict": "Agents reach a git-backed knowledge base, shared skills and connected tools through one OAuth MCP endpoint that applies each person's per-file permissions, with read-only connections and an audit log of tool calls. The hosted edition dates from 11 October 2026, and its own terms state no backups, no uptime commitment and no security certification.", "bestFor": "A team that wants its agent skills, company pages and tool credentials in one git repository, reviewed and access-controlled per file, and reached by any MCP client.", "strengths": [ "Hexis core is Apache-2.0 on GitHub, with 36 version tags from v0.1.0 on 10 August to v0.29.0 on 14 October 2026", "OAuth 2.1 with PKCE and dynamic client registration on the MCP endpoint, plus hashed, revocable connection keys", "Per-folder and per-file access rules, read-only connections and owner approval for changes to protected branches", "Audit log of agent tool calls kept 365 days by default, with each connection revocable from the workspace", "Free plan for up to 3 seats with no time limit, Team at €10 a seat a month excluding VAT" ], "weaknesses": [ "The terms and security page state no backups, no SLA, no penetration test, no certification and no MFA of its own", "All workspaces share one Hetzner server in Nuremberg with logical separation, and the encryption keys sit on that server", "No status page and no published request rate limits for the MCP endpoint", "Over 35 platform tools are listed directly, with no readOnlyHint or destructiveHint annotations", "Hexis Cloud is open to businesses only, and a person must sign in with Google, Microsoft or a password to create a workspace" ], "agentNotes": [ "Ask the person for a read-only connection when the task only reads. It answers canWrite false everywhere", "Pass the branch you are working on to every knowledge-base tool. Calls without a required branch are refused", "Check canWrite from list_files, read_file or get_skill before writing, and open a change request when it is false", "Use list_tools and tools_info before call_tool_chain, and never ask the person for a tool's secret in chat", "Keep your own copy of anything important. Hexis Cloud keeps no backups of Managed repositories" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.3 } ], "editorialScores": { "ergonomics": 57, "maintenance": 85, "payments": 30, "reliability": 18, "schema": 83, "security": 64, "transparency": 81 }, "provenanceScore": 69 }, "connect": { "install": "npx -y @bevel-software/hexis-mcp --url https://\u003cworkspace\u003e.hexis.software", "config": { "mcpServers": { "hexis": { "args": [ "-y", "@bevel-software/hexis-mcp" ], "command": "npx", "env": { "HEXIS_CONNECTION_KEY": "bevel_…", "HEXIS_URL": "https://\u003cworkspace\u003e.hexis.software" } } } } }, "letme": { "capability": "https://letme.dev/knowledge.search", "tool": "https://letme.dev/hexis" }, "notable": [ "Hexis Cloud's terms, privacy policy, DPA, sub-processor list and security page are all version 1.0 of 11 October 2026. The open-source Hexis it runs dates from 30 July 2026 (https://hexis.software/terms; https://github.com/Bevel-Software/Hexis)", "Terms clause 3.6 says the service includes no AI of its own, no backups, no promised availability and no MFA of its own (https://hexis.software/terms)", "The whole service runs on one Hetzner server in Nuremberg, which also runs a test environment, a product demo and an internal dashboard. Workspaces are separated by database schema and folders (https://hexis.software/security)", "tools/list returns three code-mode tools (list_tools, tools_info, call_tool_chain) and then every platform and connected tool directly. The source defines about 37 platform tools, from read_file and grep to merge_branch and open_change_request (https://github.com/Bevel-Software/Hexis/blob/main/packages/core-backend/src/modules/mcp/mcp.service.ts)", "Connection-key callers are listed only the tools whose per-user credentials are already set, so an unattended pipeline is not handed a tool that needs a sign-in (mcp.service.ts)", "The official MCP registry entry io.github.Bevel-Software/hexis is version 0.1.0 of 11 August 2026 and points at the demo instance, demo.bevel.software, not Hexis Cloud (https://registry.modelcontextprotocol.io/v0/servers?search=hexis)", "Bevel's own privacy policy at bevel.software/privacy describes a different product, the Bevel Knowledge Base, with OpenAI and Serper as processors. Hexis Cloud's policy at hexis.software/privacy names Hetzner and Resend and says no AI provider receives data" ], "area": "business", "details": [ { "label": "Surface listed", "value": "Hexis Cloud's hosted MCP endpoint at https://\u003cworkspace\u003e.hexis.software/api/mcp, read from the repository, the README, the agent guide and the legal pages on 14 October 2026. No workspace was created" }, { "label": "Editions", "value": "Hexis, Apache-2.0, self-hosted with Docker Compose (image ghcr.io/bevel-software/hexis), and Hexis Cloud, run by Bevel at hexis.software since 11 October 2026. A local MCP server, @bevel-software/hexis-mcp on npm, adds local-only tools to either" }, { "label": "MCP tools", "value": "list_tools, tools_info and call_tool_chain (code mode in an isolated-vm sandbox), then about 37 platform tools for files, skills, branches and change requests, then the tools of connected MCP servers and APIs. No tool annotations" }, { "label": "Knowledge base", "value": "A git repository in one of three modes, Managed on Bevel's server, your own GitHub repository through Bevel's GitHub App, or any git host by address and token" }, { "label": "Access control", "value": "Deny by default, with rules per folder and file in the repository, roles and groups, owner approval on protected branches and read-only connections" }, { "label": "Connected tools", "value": "Any MCP server or HTTP API described as a UTCP manual in the repository. Secrets stay in an encrypted vault on the server, shared or per user, with OAuth sign-in per person" }, { "label": "Hosting", "value": "One Hetzner server in Nuremberg, Germany. Sub-processors Hetzner and Resend (service emails, USA). No backups. Deleted workspaces kept 30 days" }, { "label": "Rate limits", "value": "Sign-in attempts are rate limited. No published request limits for the MCP endpoint" }, { "label": "Releases", "value": "Package tags 0.1.0 on 31 July 2026, then 36 version tags from v0.1.0 (10 August) to v0.29.0 (14 October 2026), with release notes on GitHub for each" } ], "provenance": { "legalEntity": "Bevelites GmbH", "domain": "hexis.software", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://hexis.software/terms", "privacy": "https://hexis.software/privacy", "statusPage": "", "changelog": "https://github.com/Bevel-Software/Hexis/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "Bevelites GmbH, Schleißheimer Str. 188, 80797 München, HRB 303590 at Amtsgericht München, per the Impressum at bevel.software/impressum and the terms.", "hexis.software is a single-page app. The legal pages render with JavaScript, and we read their text from the site's published script bundle.", "hexis.software/.well-known/security.txt names juan@bevel.software and expires on 30 September 2027.", "hexis.software serves the app for every path, including robots.txt, so there is no robots.txt to disallow anything. bevel.software's robots.txt disallows only /api/.", "No status page found. status.hexis.software answers 'No workspace at this address'." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "Bevelites GmbH", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "hexis.software, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "\u003cworkspace\u003e.hexis.software", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://hexis.software/terms", "state": "unreadable", "reason": "the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-14", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://hexis.software/privacy", "state": "unreadable", "reason": "the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-14", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hexis.json", "live": { "slug": "hexis", "probe": { "target": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "method": "mcp-initialize", "lastAt": "2026-10-15T00:24:13.30353878Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 31, "samples30d": 31, "days": [ { "date": "2026-10-14", "probes": 26, "ok": 0 }, { "date": "2026-10-15", "probes": 5, "ok": 0 } ], "outages": [ { "start": "2026-10-14T21:31:42.133995117Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "versions": [ { "registry": "github", "name": "Bevel-Software/Hexis", "version": "v0.29.0", "released": "2026-10-14", "seenAt": "2026-10-14T23:57:19.802349377Z" }, { "registry": "npm", "name": "@bevel-software/hexis-mcp", "version": "0.29.0", "seenAt": "2026-10-14T23:57:18.908423769Z" } ], "githubStars": 114, "npmWeekly": 900, "mcpTools": { "url": "https://\u003cworkspace\u003e.hexis.software/api/mcp", "checkedAt": "2026-10-14T22:17:44.005217518Z", "status": "error", "note": "Post \"https://\u003cworkspace\u003e.hexis.software/api/mcp\": dial tcp: lookup \u003cworkspace\u003e.hexis.software: no such host", "changedAt": "2026-10-14T22:17:44.005217518Z" }, "updatedAt": "2026-10-15T00:24:13.30353878Z" } }, "verify": { "accepts": "a page on hexis.software or bevel.software or one of their subdomains, or the README of github.com/Bevel-Software/Hexis", "badgeUrl": "https://www.anchorterminal.com/badges/hexis.svg", "body": { "slug": "hexis", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/hexis", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/hexis\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/hexis.svg\" alt=\"Hexis Cloud on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Hexis Cloud on Anchor Terminal](https://www.anchorterminal.com/badges/hexis.svg)](https://www.anchorterminal.com/tools/hexis)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/hexis\"\u003eHexis Cloud on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/hexis", "json": "https://www.anchorterminal.com/tools/hexis.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/hexis.md", "slim": "https://www.anchorterminal.com/tools/hexis.min.md" }, "markdown": "## Overview\n\n**Grade C · 55.3/100 · rank #705 of 1084 · #11 in Company knowledge \u0026 data catalogues · not agent-ready · confidence medium**\n\n\n## Assessment\n\nAgents reach a git-backed knowledge base, shared skills and connected tools through one OAuth MCP endpoint that applies each person's per-file permissions, with read-only connections and an audit log of tool calls. The hosted edition dates from 11 October 2026, and its own terms state no backups, no uptime commitment and no security certification.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Bevelites GmbH (Bevel) (https://www.bevel.software/hexis) |\n| Kind | MCP server |\n| Category | Company knowledge \u0026 data catalogues (https://www.anchorterminal.com/categories/company-knowledge) |\n| Transport | Streamable HTTP, stdio |\n| Endpoint | `https://\u003cworkspace\u003e.hexis.software/api/mcp` |\n| Auth | OAuth or key · OAuth 2.1 on the MCP endpoint, with PKCE (S256), dynamic client registration, refresh tokens, revocation and one scope, `mcp`, advertised through RFC 9728 protected-resource metadata. Or a connection key (`bevel_…`) minted under External agent access as a Bearer token, stored as a SHA-256 hash and revocable. Either way the agent acts with the permissions of the person who connected it, and a connection can be read-only. People sign in with Google, Microsoft or a password; MFA only through Google or Microsoft. |\n| Pricing | Freemium (Freemium) · Free for up to 3 seats with no time limit, and the terms say it is not a trial. Team is €10 a seat a month excluding VAT, 1 to 50 seats, billed monthly through Stripe. Enterprise and more than 50 seats are by order form. Hexis itself is Apache-2.0 and free to self-host (checked 2026-10-14). |\n| x402 | No · No x402, MPP or L402 in the terms, the pricing section of bevel.software/hexis or the repository. Payment is by Stripe checkout for the Team plan (checked 2026-10-14). |\n| Licence | Apache-2.0 (the Hexis software). Hexis Cloud, the hosted service at hexis.software, is governed by Bevel's Terms of Service of 11 October 2026 |\n| Packages | npm: `@bevel-software/hexis-mcp`; oci: `ghcr.io/bevel-software/hexis` |\n| MCP registry name | `io.github.Bevel-Software/hexis` |\n| Source | https://github.com/Bevel-Software/Hexis |\n| Docs | https://github.com/Bevel-Software/Hexis#readme |\n| llms.txt | not found |\n| Last release | 2026-10-14 |\n| GitHub stars | 114 (as of 2026-10-14) |\n| npm downloads / week | 900 |\n| Surface listed | Hexis Cloud's hosted MCP endpoint at https://\u003cworkspace\u003e.hexis.software/api/mcp, read from the repository, the README, the agent guide and the legal pages on 14 October 2026. No workspace was created |\n| Editions | Hexis, Apache-2.0, self-hosted with Docker Compose (image ghcr.io/bevel-software/hexis), and Hexis Cloud, run by Bevel at hexis.software since 11 October 2026. A local MCP server, @bevel-software/hexis-mcp on npm, adds local-only tools to either |\n| MCP tools | list_tools, tools_info and call_tool_chain (code mode in an isolated-vm sandbox), then about 37 platform tools for files, skills, branches and change requests, then the tools of connected MCP servers and APIs. No tool annotations |\n| Knowledge base | A git repository in one of three modes, Managed on Bevel's server, your own GitHub repository through Bevel's GitHub App, or any git host by address and token |\n| Access control | Deny by default, with rules per folder and file in the repository, roles and groups, owner approval on protected branches and read-only connections |\n| Connected tools | Any MCP server or HTTP API described as a UTCP manual in the repository. Secrets stay in an encrypted vault on the server, shared or per user, with OAuth sign-in per person |\n| Hosting | One Hetzner server in Nuremberg, Germany. Sub-processors Hetzner and Resend (service emails, USA). No backups. Deleted workspaces kept 30 days |\n| Rate limits | Sign-in attempts are rate limited. No published request limits for the MCP endpoint |\n| Releases | Package tags 0.1.0 on 31 July 2026, then 36 version tags from v0.1.0 (10 August) to v0.29.0 (14 October 2026), with release notes on GitHub for each |\n| Capabilities | knowledge.search, work.docs, agent.tools, automation.auth, auth.audit |\n| Tags | hosted, open-source, self-hosted, mcp, mcp-registry, oauth, api-key, freemium, free-tier, no-card, typescript, docker, eu, eu-hosted, read-only-mode, agent-skills, security-txt |\n| JSON | https://www.anchorterminal.com/api/v1/tools/hexis.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 18 | 3.6 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 83 | 13.5 |\n| Agent ergonomics | 13% | 16.2 | 57 | 9.3 |\n| Security \u0026 auth | 14% | 17.5 | 64 | 11.2 |\n| Payments \u0026 pricing | 10% | 12.5 | 30 | 3.8 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 85 | 7.4 |\n| Transparency \u0026 trust (editorial 81, provenance 69) | 7% | 8.8 | 75 | 6.6 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **55.3 → C** |\n\n### Why each score\n\n- Reliability 18: Graded on the hosted lines, because the surface is Hexis Cloud's MCP endpoint. No status page found, and status.hexis.software answers 'No workspace at this address' (0). No readable incident history (5). The security page says sign-in attempts are rate limited, but we found no request limits for the MCP endpoint or any tool (0). No documented 429, Retry-After or backoff guidance (0). The terms state no uptime figure and no SLA unless an order form has one, and the pricing section lists SLAs only for Enterprise, with no terms published (3 of 10). The service carries no beta label, though it went live on 11 October 2026 and the software is version 0.29.0 (10). The terms also say there are no backups and the whole service runs on one server, which this checklist doesn't score but a reader should weigh.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 83: Every tool on tools/list has a JSON Schema input, and the server validates each schema before listing it so one malformed tool can't blank the list (25). No llms.txt. The agent guide is Markdown in the repository and goes to agents in the MCP handshake instructions, with the first line repeated on the four core tools (7 of 10). Descriptions open with a call example, say what each verdict such as canWrite means and when to open a change request instead, and point to the guide's shared rules (15 of 20). Inputs carry required fields, minLength, integer bounds and additionalProperties false, with some free-form code strings for call_tool_chain (12 of 15). Call examples on every tool and named refusals such as branch-required, but no single error reference (11 of 15). Release notes for every version on GitHub, on 0.x versions with no stated versioning policy (13 of 15).\n- Agent ergonomics 57: About 37 platform tools plus three code-mode tools are listed directly, before any connected tool, which puts the listing over 30 (5). Code mode (list_tools, tools_info and call_tool_chain in a sandbox), skill lookup through list_skills and get_skill, and connection-key callers seeing only tools whose credentials are set add back 7 (12 of 25). grep and list_files narrow results, and call_tool_chain takes max_output_size and spills a large result to a file read back with read_file (14 of 20). Refusals name the problem, a missing branch is answered 404 naming it, and list_tool_setup returns setup.reason with the next step (15 of 20). No readOnlyHint or destructiveHint annotations. Writes land on a branch, and protected branches change only through approved change requests, which limits the harm of a repeated call (8 of 20). Branch defaults on read tools. One official client, the TypeScript local server on npm (8 of 15).\n- Security \u0026 auth 64: OAuth 2.1 with PKCE, dynamic client registration and token revocation, but a single `mcp` scope, and connection keys stored as SHA-256 hashes and revocable. The agent always acts with the connecting person's permissions (25 of 30). Read access is denied by default, rules apply per folder and file, a connection can be read-only, and protected content changes only with its owners' approval (17 of 20). The tools return knowledge-base pages any writer can edit and the results of third-party tools, and we found no prompt-injection guidance (3 of 15). Admins see an audit log of agent tool calls, who and with which connection, kept 365 days by default, and can revoke any connection (14 of 15). A valid security.txt and a candid security page, but the same page says there is no certification, no penetration test, no automated vulnerability scanning and no bug bounty, and the encryption keys sit on the server with the data (5 of 20).\n- Payments \u0026 pricing 30: No x402, MPP or L402 (0). Plan pricing is public, Free for up to 3 seats and Team at €10 a seat a month excluding VAT, with no per-call unit (10). The Free plan has no time limit and asks for no card (20). A person must sign in with Google, Microsoft or a password and tick the terms to create a workspace. OAuth dynamic client registration lets an MCP client register itself, but a person still completes the sign-in (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 85: v0.29.0 on 14 October 2026 (30). 36 version tags since v0.1.0 on 10 August 2026, eight of them in October (20). No issues have ever been opened on GitHub, and the open items are eight pull requests, mostly from the maintainers, reviewed with comments the same week. Little outside activity to judge responsiveness by (15 of 25). In the official MCP registry as io.github.Bevel-Software/hexis, but the entry is version 0.1.0 from 11 August and points at the demo instance, not Hexis Cloud (10 of 15). A test workflow on every push and pull request with a real Postgres, a lint ratchet and dependencies pinned to exact versions (10).\n- Transparency \u0026 trust 75: Hexis is Apache-2.0 and the terms describe Hexis Cloud as a managed version of it. Releases name an extension point for distributions, so we can't confirm every Cloud-only piece is public (27 of 30). The Hexis Cloud privacy policy, DPA, security page and data-portability page agree on retention (logs capped at 150 MB, deleted workspaces kept 30 days, audit log 365 days) and say no AI provider and no analytics service receives data. Bevel's own privacy policy at bevel.software/privacy describes a different product with OpenAI and Serper as processors and carries two different dates, which a reader may confuse with Hexis Cloud's (24 of 30). The terms give six weeks' notice of price changes and a right to leave on service changes, with no deprecation policy for tools or endpoints (8 of 20). Sub-processors are listed with locations and transfer safeguards, and a change log (20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (16 items): https://www.anchorterminal.com/fixes/hexis.md (JSON https://www.anchorterminal.com/fixes/hexis.json)\n\n### What we couldn't check\n\n- unchecked: the Product Hunt launch date of 12 October. The legal documents date Hexis Cloud to 11 October 2026, and we didn't read Product Hunt\n- unchecked: the tool list a live Hexis Cloud workspace returns. We read it from the source and created no workspace\n- unchecked: whether Hexis Cloud runs any code that isn't in the public repository\n- Bevel's site describes '100s of tools' and '58 ready-made skills'. We didn't count either. Tools are any MCP server or API a workspace connects\n- The MCP registry entry still points at demo.bevel.software at version 0.1.0\n\n### Sources\n\n- Hexis product and pricing page: \u003chttps://www.bevel.software/hexis\u003e (seen 2026-10-14)\n- Hexis Cloud terms of service, version 1.0 of 11 October 2026: \u003chttps://hexis.software/terms\u003e (seen 2026-10-14)\n- Hexis Cloud privacy policy: \u003chttps://hexis.software/privacy\u003e (seen 2026-10-14)\n- Hexis Cloud security page: \u003chttps://hexis.software/security\u003e (seen 2026-10-14)\n- Hexis Cloud sub-processors: \u003chttps://hexis.software/subprocessors\u003e (seen 2026-10-14)\n- Hexis Cloud data portability and switching: \u003chttps://hexis.software/data-portability\u003e (seen 2026-10-14)\n- security.txt: \u003chttps://hexis.software/.well-known/security.txt\u003e (seen 2026-10-14)\n- Repository, README, agent guide and MCP server source: \u003chttps://github.com/Bevel-Software/Hexis\u003e (seen 2026-10-14)\n- Release notes: \u003chttps://github.com/Bevel-Software/Hexis/releases\u003e (seen 2026-10-14)\n- Local MCP server package: \u003chttps://registry.npmjs.org/@bevel-software/hexis-mcp\u003e (seen 2026-10-14)\n- Official MCP registry entry: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=hexis\u003e (seen 2026-10-14)\n- OAuth metadata of the demo instance: \u003chttps://demo.bevel.software/.well-known/oauth-authorization-server\u003e (seen 2026-10-14)\n- Bevel privacy policy (Bevel Knowledge Base): \u003chttps://www.bevel.software/privacy\u003e (seen 2026-10-14)\n- Impressum: \u003chttps://www.bevel.software/impressum\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 69/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Bevelites GmbH | 20/20 |\n| Domain age | hexis.software, no registry record we could read | 0/15 |\n| Endpoint on the vendor's domain | \u003cworkspace\u003e.hexis.software | 15/15 |\n| Terms of service | published, but our reader couldn't read it | 7/10 |\n| Privacy policy | published, but our reader couldn't read it | 7/10 |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nBevelites GmbH, Schleißheimer Str. 188, 80797 München, HRB 303590 at Amtsgericht München, per the Impressum at bevel.software/impressum and the terms.\n\nhexis.software is a single-page app. The legal pages render with JavaScript, and we read their text from the site's published script bundle.\n\nhexis.software/.well-known/security.txt names juan@bevel.software and expires on 30 September 2027.\n\nhexis.software serves the app for every path, including robots.txt, so there is no robots.txt to disallow anything. bevel.software's robots.txt disallows only /api/.\n\nNo status page found. status.hexis.software answers 'No workspace at this address'.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://hexis.software/terms), read 2026-10-14. Our reader couldn't read it (the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere).\n\n\n**Privacy policy** (https://hexis.software/privacy), read 2026-10-14. Our reader couldn't read it (the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere).\n\n\n## Live (updated 2026-10-15 00:24 UTC)\n\n- Right now: down, n/a, checked 2026-10-15 00:24 UTC (mcp-initialize on `https://\u003cworkspace\u003e.hexis.software/api/mcp`)\n- Uptime 24h 0.0% (31 probes) · 30 days 0.0% (31 probes) · p50 n/a · p95 n/a\n- github `Bevel-Software/Hexis` v0.29.0, released 2026-10-14\n- npm `@bevel-software/hexis-mcp` 0.29.0\n- Tools: couldn't list them, Post \"https://\u003cworkspace\u003e.hexis.software/api/mcp\": dial tcp: lookup \u003cworkspace\u003e.hexis.software: no such host (checked 2026-10-14 22:17 UTC)\n- Always current: https://www.anchorterminal.com/api/v1/live/hexis.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Hexis core is Apache-2.0 on GitHub, with 36 version tags from v0.1.0 on 10 August to v0.29.0 on 14 October 2026\n- OAuth 2.1 with PKCE and dynamic client registration on the MCP endpoint, plus hashed, revocable connection keys\n- Per-folder and per-file access rules, read-only connections and owner approval for changes to protected branches\n- Audit log of agent tool calls kept 365 days by default, with each connection revocable from the workspace\n- Free plan for up to 3 seats with no time limit, Team at €10 a seat a month excluding VAT\n\n## Weaknesses\n\n- The terms and security page state no backups, no SLA, no penetration test, no certification and no MFA of its own\n- All workspaces share one Hetzner server in Nuremberg with logical separation, and the encryption keys sit on that server\n- No status page and no published request rate limits for the MCP endpoint\n- Over 35 platform tools are listed directly, with no readOnlyHint or destructiveHint annotations\n- Hexis Cloud is open to businesses only, and a person must sign in with Google, Microsoft or a password to create a workspace\n\n\n\n## Before you call it (notes for agents)\n\n1. Ask the person for a read-only connection when the task only reads. It answers canWrite false everywhere\n2. Pass the branch you are working on to every knowledge-base tool. Calls without a required branch are refused\n3. Check canWrite from list_files, read_file or get_skill before writing, and open a change request when it is false\n4. Use list_tools and tools_info before call_tool_chain, and never ask the person for a tool's secret in chat\n5. Keep your own copy of anything important. Hexis Cloud keeps no backups of Managed repositories\n\n## Connect\n\nInstall:\n\n```bash\nnpx -y @bevel-software/hexis-mcp --url https://\u003cworkspace\u003e.hexis.software\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"hexis\": {\n \"args\": [\n \"-y\",\n \"@bevel-software/hexis-mcp\"\n ],\n \"command\": \"npx\",\n \"env\": {\n \"HEXIS_CONNECTION_KEY\": \"bevel_…\",\n \"HEXIS_URL\": \"https://\\u003cworkspace\\u003e.hexis.software\"\n }\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/hexis. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Merge Agent Handler | B | 69.5 | 191 | automation.auth, agent.tools, auth.audit | no | https://www.anchorterminal.com/tools/merge-agent-handler.md |\n| StackOne | B | 69.1 | 206 | automation.auth, agent.tools, auth.audit | no | https://www.anchorterminal.com/tools/stackone.md |\n| One | B | 66.6 | 300 | automation.auth, agent.tools, auth.audit | no | https://www.anchorterminal.com/tools/one.md |\n| Composio (API + MCP) | BB | 75.1 | 58 | automation.auth, agent.tools | no | https://www.anchorterminal.com/tools/composio-rube.md |\n| Nango | B | 67.7 | 254 | auth.audit, agent.tools | no | https://www.anchorterminal.com/tools/nango.md |\n| Arcade.dev | B | 66.9 | 283 | auth.audit, agent.tools | no | https://www.anchorterminal.com/tools/arcade.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Hexis Cloud's terms, privacy policy, DPA, sub-processor list and security page are all version 1.0 of 11 October 2026. The open-source Hexis it runs dates from 30 July 2026 (source: \u003chttps://hexis.software/terms\u003e, \u003chttps://github.com/Bevel-Software/Hexis\u003e)\n- Terms clause 3.6 says the service includes no AI of its own, no backups, no promised availability and no MFA of its own (source: \u003chttps://hexis.software/terms\u003e)\n- The whole service runs on one Hetzner server in Nuremberg, which also runs a test environment, a product demo and an internal dashboard. Workspaces are separated by database schema and folders (source: \u003chttps://hexis.software/security\u003e)\n- tools/list returns three code-mode tools (list_tools, tools_info, call_tool_chain) and then every platform and connected tool directly. The source defines about 37 platform tools, from read_file and grep to merge_branch and open_change_request (source: \u003chttps://github.com/Bevel-Software/Hexis/blob/main/packages/core-backend/src/modules/mcp/mcp.service.ts\u003e)\n- Connection-key callers are listed only the tools whose per-user credentials are already set, so an unattended pipeline is not handed a tool that needs a sign-in (mcp.service.ts)\n- The official MCP registry entry io.github.Bevel-Software/hexis is version 0.1.0 of 11 August 2026 and points at the demo instance, demo.bevel.software, not Hexis Cloud (source: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=hexis\u003e)\n- Bevel's own privacy policy at bevel.software/privacy describes a different product, the Bevel Knowledge Base, with OpenAI and Serper as processors. Hexis Cloud's policy at hexis.software/privacy names Hetzner and Resend and says no AI provider receives data\n\n- #11 of 15 in Best company knowledge search and data catalogues for AI agents: https://www.anchorterminal.com/best/company-knowledge/index.md\n- All 87 knowledge comparisons: https://www.anchorterminal.com/compare/company-knowledge/index.md\n\n## Compare\n\n- [Alation vs Hexis Cloud](https://www.anchorterminal.com/compare/alation-vs-hexis.md): C 60.3 vs C 55.3\n- [Atlan vs Hexis Cloud](https://www.anchorterminal.com/compare/atlan-vs-hexis.md): B 62.5 vs C 55.3\n- [Cohere North vs Hexis Cloud](https://www.anchorterminal.com/compare/cohere-north-vs-hexis.md): C 55.1 vs C 55.3\n- [Collibra vs Hexis Cloud](https://www.anchorterminal.com/compare/collibra-vs-hexis.md): B 64.6 vs C 55.3\n- [Dust vs Hexis Cloud](https://www.anchorterminal.com/compare/dust-vs-hexis.md): B 62.8 vs C 55.3\n- [Gemini Enterprise vs Hexis Cloud](https://www.anchorterminal.com/compare/gemini-enterprise-vs-hexis.md): B 68.1 vs C 55.3\n- [Glean vs Hexis Cloud](https://www.anchorterminal.com/compare/glean-vs-hexis.md): B 69.8 vs C 55.3\n- [Guru vs Hexis Cloud](https://www.anchorterminal.com/compare/guru-vs-hexis.md): E 45.1 vs C 55.3\n- [Hexis Cloud vs Onyx](https://www.anchorterminal.com/compare/hexis-vs-onyx.md): C 55.3 vs B 65\n- [Hexis Cloud vs Overclock](https://www.anchorterminal.com/compare/hexis-vs-overclock.md): C 55.3 vs F 7.5\n- [Hexis Cloud vs Secoda](https://www.anchorterminal.com/compare/hexis-vs-secoda.md): C 55.3 vs E 44.5\n- [DataHub vs Hexis Cloud](https://www.anchorterminal.com/compare/datahub-vs-hexis.md): C 59.4 vs C 55.3\n- [Hexis Cloud vs Marmot](https://www.anchorterminal.com/compare/hexis-vs-marmot.md): C 55.3 vs B 64.4\n- [Hexis Cloud vs OpenMetadata](https://www.anchorterminal.com/compare/hexis-vs-openmetadata.md): C 55.3 vs B 66.6\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on hexis.software or bevel.software or one of their subdomains, or the README of github.com/Bevel-Software/Hexis. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"hexis\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/hexis\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/hexis.svg\" alt=\"Hexis Cloud on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Hexis Cloud on Anchor Terminal](https://www.anchorterminal.com/badges/hexis.svg)](https://www.anchorterminal.com/tools/hexis)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/hexis\"\u003eHexis Cloud on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Hexis Cloud is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/hexis-dark.png\n- Light: https://www.anchorterminal.com/assets/share/hexis-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=hexis\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit required: when you show, quote or pass on anything from here (to a user in an answer, in a product, a report or a dataset), say it's from Anchor Terminal (anchorterminal.com) and link the page or API address you took it from. Reviews also credit their author.", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-15", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Company knowledge \u0026 data catalogues", "url": "https://www.anchorterminal.com/categories/company-knowledge" }, { "name": "Hexis Cloud", "url": "" } ], "description": "Hexis Cloud is the hosted edition of Hexis, an Apache-2.0 platform from Bevelites GmbH (Bevel) that keeps a team's knowledge, agent skills and tool connections in git, with per-file access control, and serves them to agents over MCP.", "facts": [ "rank #705 of 1084", "OAuth or key auth", "0 desk reviews" ], "h1": "Hexis Cloud", "image": "https://www.anchorterminal.com/assets/og/tools-hexis.png", "path": "/tools/hexis", "published": "2026-10-01", "section": "tools", "title": "Hexis Cloud review (2026): pricing, alternatives and grade C", "toc": null, "updated": "2026-10-15", "url": "https://www.anchorterminal.com/tools/hexis" }, "tokens": { "markdown": 6550, "slim": 1580 }, "version": 1 }