{"slug": "show-hn-hexis-open-source-claude-skills-management", "title": "Show HN: Hexis, open-source Claude Skills management", "summary": "Bevel Software released Hexis, an open-source, git-backed control plane for managing AI-agent skills, tools, context, permissions, and identity, self-hosted and MCP-native. The platform allows centralized management of AI plugins and knowledge, with every skill and permission stored as files in a git repository for auditability, and integrates with Claude and Cline via MCP. Hexis is available as a public demo at demo.bevel.software and can be deployed via Docker.", "body_md": "**Git-backed control plane for AI-agent skills, tools, context, permissions and\nidentity. Self-hosted and MCP-native.**\n\nOne place where your company's AI plugins, tools and knowledge live: centrally\nmanaged, reviewed and access-controlled, and usable from **any AI agent**. The\nopen-source core of the Bevel platform.\n\nOne place where engineers and non-technical people alike can browse and load plugins, propose suggestions, and manage access.\n\nEvery skill, tool manual and permission is a file in a git repository you own, so the audit trail is the storage layer: who changed what, when, who approved it, and how to undo it. An agent can only do what the person running it can do, resolved per file, and it never holds the credentials it uses. Runs on your infrastructure, behind your own SSO.\n\nA gateway decides which tools an agent may call. It has no opinion on whether the skill telling that agent what to do is any good.\n\nIn Hexis, skills and tool manuals are reviewable files. Anyone can propose a change; on protected branches it reaches the owners of the files it touches and ships only once they approve. Agents propose too: one that hits a broken skill mid-task can suggest the fix, and a person decides whether it lands.\n\n[See Hexis in action](#see-hexis-in-action)[Connect Hexis to Cline](#connect-hexis-to-cline)[Try the live demo](#try-it-first-the-live-demo)[Managed hosting](#want-a-managed-instance)[Deploy with Docker](#deploy-it-in-5-minutes-docker)[Local development](#local-development-run-from-source)[Configuration reference](/Bevel-Software/Hexis/blob/main/docs/configuration.md)[Troubleshooting](/Bevel-Software/Hexis/blob/main/docs/troubleshooting.md)[Repository layout](#repository-layout)[FAQ](#faq)\n\n*Watch the full walkthrough: connect an agent, use company context, review\nproposed changes, and manage team access.*\n\nAnyone can propose a new skill or improve an existing one. On protected branches, owners review the exact change and approve it before it becomes available to the team's agents.\n\nConnect Claude to Hexis over MCP, then ask normally. Claude can discover and load the approved skill instructions and company context your role can access, without copying prompts between tools.\n\nCline can connect directly to Hexis as a remote Streamable HTTP MCP server. Install the public demo connection from the Cline CLI:\n\n```\ncline mcp install hexis --transport http https://demo.bevel.software/api/mcp --yes\n```\n\nComplete the OAuth sign-in in your browser when prompted. Cline then discovers\nthe skills, tools and context your Hexis role can access. For your own Hexis\ndeployment, replace `demo.bevel.software`\n\nwith your deployment's host.\n\nAdd teammates to roles or grant access directly when needed. Everyone connects to the same workspace, while each person and their agent only sees what they are allowed to read.\n\n** demo.bevel.software**\nis a public instance you can sign into with your Google account, populated\nwith a fictional company's knowledge, skills and tools. The\n\n*Start here*page walks you through the whole loop: connect your own agent over MCP, have it build a sales deck from a skill, watch its proposed improvement arrive as a change request. The demo is shared and read-mostly (visitors propose, owners approve); everything below gets you the same thing with none of the limits.\n\nWe run it for you (hosting, upgrades, backups, SSO) and your team just signs\nin. Write to ** ali.raza@bevel.software**.\n\nYou need: [Docker](https://docs.docker.com/get-docker/) with Compose on a\nserver (or your laptop; one line below differs), and an\n**empty git repository** on any host (GitHub, GitLab, Bitbucket, Azure DevOps,\nself-hosted) to hold your knowledge base. The app seeds it with a starter\ntemplate on first run.\n\n```\ngit clone https://github.com/Bevel-Software/Hexis.git\ncd Hexis\ncp .env.example .env\n```\n\nOpen `.env`\n\nand fill in the **four required values** (everything else can wait):\n\n```\nADMIN_EMAIL=you@example.com     # the deployment owner, always an admin\nADMIN_PASSWORD=pick-something   # sign-in password; only with password login (SSO-only deployments drop it)\nJWT_SECRET=…                    # generate with the command below\nSECRETS_ENC_KEY=…               # generate with the command below\n```\n\nGenerate the two secrets (run twice, paste one result into each):\n\n``` js\nnode -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"\n# no Node installed? docker run --rm node:22-slim node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"\n```\n\nFor a public deployment, also set the origin values:\n\n```\nPUBLIC_BACKEND_URL=https://bevel.your-domain.com   # public origin; OAuth redirects are built from it\nPUBLIC_FRONTEND_URL=https://bevel.your-domain.com  # same origin: the backend serves the SPA\n```\n\nThen start everything (Postgres + the app). **Behind a reverse proxy**\n(Coolify, Traefik, nginx; recommended):\n\n```\ndocker compose -f docker-compose.yml up -d\n```\n\nAlso set `TRUST_PROXY`\n\nto your proxy hop count (`1`\n\nfor a single proxy), so\nrate limits see real client IPs instead of the proxy's.\n\nThe explicit `-f`\n\nskips `docker-compose.override.yml`\n\n, so the app publishes\n**no host port**: your proxy reaches it on port `3001`\n\nover the compose\nnetwork. This is deliberate: a fixed published port makes every redeploy fail\nwith `port is already allocated`\n\n, because the replacement container starts\nwhile the outgoing one still holds it.\n\n**Directly exposed** (no proxy): plain `docker compose up -d`\n\npublishes\n`:3001`\n\n; use `APP_PORT=8080 docker compose up -d`\n\nfor a different host port.\nLeave `TRUST_PROXY`\n\nunset here. With no proxy in front, trusting forwarded\nheaders would let clients spoof their own address.\n\nOpen your domain and sign in with `ADMIN_EMAIL`\n\n/ `ADMIN_PASSWORD`\n\n.\n\n**Just trying it on your laptop?** Same steps, minus the origin values: plain\n`docker compose up -d`\n\n, then open ** http://localhost:3001**.\n\nThe app asks for the things it could not guess, and **tests them against the\nreal host before saving**:\n\n**Knowledge-base repo**: the https clone URL of that empty repository.** Git credential**: a token with read/write access to it (for GitHub: a fine-grained personal access token with*Contents: read & write*on that one repo is enough).**Branch model**: which branch is the default and which are protected (changes to protected branches only land through approved change requests). The repository's real branches are offered as suggestions; for an empty repo the default (`main`\n\n) is fine.\n\nSince the repo is empty, the app initialises it from the bundled template and\nwrites a `roles.yaml`\n\nwhose first Admin is you. That's it: you're in the\nworkspace. Head to **Skills & Tools** to make your first plugin and skill, and to\n**Connect** (in the app menu) to hook up an agent over MCP.\n\nGoing to production? [Configuration reference](/Bevel-Software/Hexis/blob/main/docs/configuration.md) covers\nsingle sign-on, the state you need to back up, health checks, and configuring\nby environment instead of the setup screen.\n\nYou need: **Node 22** (`.nvmrc`\n\n; the engine range is `>=22 <23`\n\n),\n**pnpm 10**, **git ≥ 2.41**, and a Postgres 17 (the bundled one is fine):\n\n```\ndocker compose up -d db        # just the database\npnpm install\npnpm build                     # builds the packages the apps import\ncp .env.example .env           # fill the same four required values;\n                               # the default DATABASE_URL already points at the bundled db\npnpm dev                       # backend on :3001, Vite dev server on :5173\n```\n\nOpen ** http://localhost:5173** (the dev server proxies to the backend). Useful\ncommands:\n\n`pnpm test`\n\n, `pnpm typecheck`\n\n, `pnpm lint`\n\n.Migrations run automatically on boot; there is no separate migrate step, in dev or in production.\n\n: every environment variable, SSO setup, secret generation, backups and health.[Configuration](/Bevel-Software/Hexis/blob/main/docs/configuration.md): the failures you are most likely to hit, and what causes them.[Troubleshooting](/Bevel-Software/Hexis/blob/main/docs/troubleshooting.md)\n\n| Path | What it is |\n|---|---|\n`packages/shared` |\n`@bevel-software/platform-shared` : shared types + pure domain utilities |\n`packages/core-backend` |\n`@bevel-software/platform-core-backend` : the core backend (ships `migrations/` + `kb-template/` ) |\n`packages/core-frontend` |\n`@bevel-software/platform-core-frontend` : the core UI, published as raw TS/TSX source |\n`apps/server` |\nstandalone core backend shell |\n`apps/web` |\nstandalone core SPA shell (Vite) |\n\nQuestions that come up when teams evaluate Hexis as a central, versioned catalogue for agent skills and tools.\n\n**How do agents find skills without flooding the context window?**\n\nThey look them up rather than loading them all: `list_skills`\n\nand `search`\n\nnarrow the field, `get_skill`\n\nreturns one skill at call time.\n\n**Which agents can connect?**\n\nAny MCP-capable client, including Claude Code, Codex, Cursor, Cline and ChatGPT, each seeing only what its user's role allows.\n\n**How is the catalogue versioned?**\n\nBy git: every save is a commit, so history, blame and revert work as they do for code, and changes to protected branches ship as reviewable change requests.\n\n**What governance do we get?**\n\nPer-file access control, review-gated change requests, and a git audit trail of who changed what and who approved it.\n\nLicense: [Apache-2.0](/Bevel-Software/Hexis/blob/main/LICENSE)", "url": "https://wpnews.pro/news/show-hn-hexis-open-source-claude-skills-management", "canonical_source": "https://github.com/Bevel-Software/Hexis", "published_at": "2026-08-14 16:14:19+00:00", "updated_at": "2026-08-14 16:41:57.275121+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-infrastructure", "ai-policy"], "entities": ["Bevel Software", "Hexis", "Claude", "Cline", "MCP", "Docker", "GitHub", "demo.bevel.software"], "alternates": {"html": "https://wpnews.pro/news/show-hn-hexis-open-source-claude-skills-management", "markdown": "https://wpnews.pro/news/show-hn-hexis-open-source-claude-skills-management.md", "text": "https://wpnews.pro/news/show-hn-hexis-open-source-claude-skills-management.txt", "jsonld": "https://wpnews.pro/news/show-hn-hexis-open-source-claude-skills-management.jsonld"}}