Hexabot
Build cross-channel agentic workflows, tool calls, and conversational automation in one runtime.
CI explicitly limits repository permissions to contents: read, npm promotion is manually dispatched and uses a repository secret, and the security policy defines a vulnerability-reporting path. The README identifies major data-touching features such as databases, channels, MCP, memory, and RAG, while the license and source headers consistently attribute the project to Hexastack. Deductions apply because the supplied files do not establish runtime least privilege, tool authorization, confirmation before external calls, detailed data destinations, credential storage, log redaction, an effects inventory, or rollback. Frozen installs and CI checks support dependency hygiene, but Actions use mutable major-version tags and no dependency audit or vulnerability-mitigation evidence is supplied. Unknown publisher identity is not treated as adverse evidence.
The README, package manifest, and CI are broadly consistent about Node, pnpm, build, and test workflows. CI covers type checking, linting, unit tests, builds, a PostgreSQL migration integration test, and an explicit SQLite-driver check. Deductions apply because the root package description still presents a chatbot-oriented product while the README describes a broader v3 agentic automation platform, the release is a beta, and the supplied source provides no evidence of runtime retries, degradation behavior, recovery, or actionable user-facing failure messages.
The evidence covers CLI project creation, local development, optional Docker services, SQLite and PostgreSQL, multiple channels, YAML workflows, actions, bindings, memory, MCP, and RAG. Schema-first typed inputs and outputs provide reasonable support for precise configuration. Deductions apply because no representative workflow definition or executor implementation demonstrates trigger matching, conflict resolution, or boundary behavior, and unsupported models, channels, deployment forms, and resource limits are not systematically documented.
The README has clear quick-start, capability, data-layer, contribution, and licensing sections. Installation requirements, TTY constraints, endpoints, and CLI commands are thorough; the full license is present, package and promotion names align, and SECURITY.md identifies a maintenance contact and response timetable. Deductions apply because there is no supplied FAQ, complete worked example, systematic limitations section, or changelog. The 3.5.0-beta.2 status and the older chatbot wording in package.json also create modest positioning and naming drift.
The combination of workflows, actions, agent facilities, conversational channels, memory, MCP, and RAG in one runtime offers plausible integration value, and the CLI plus documented UI/API endpoints make intended outputs usable for ordinary development. Deductions apply because the evidence contains no end-to-end output example, performance or resource measurements, deployment and model-call costs, operational burden analysis, or comparison with alternatives, leaving actual utility and cost-benefit only partially demonstrated.
Key facts can be traced across the README, package manifest, CI, security policy, and license. Node and pnpm versions, database support, quality scripts, promoted packages, and licensing are strongly corroborated across the supplied files. Deductions apply because most capability claims remain README-level assertions without corresponding workflow, action, permission, or data-handling implementation files, and promotional claims are not explicitly separated from demonstrated behavior. Confidence therefore remains low for this static review.
- No implementation evidence is supplied for agent-tool permissions, confirmation of external actions, or effect isolation; inspect workflow and action executors individually before production integration.
- The evidence does not document credential encryption, key rotation, log redaction, memory/RAG retention, or third-party data-transfer rules.
- No rollback or compensating-transaction mechanism is shown; migrations, channel sends, and tool calls may create difficult-to-reverse effects.
- The reviewed manifest is 3.5.0-beta.2 and no changelog or systematic limitations list is supplied; confirm upgrade paths and compatibility before adoption.
- FCL-1.0-ALv2 restricts competing uses and grants a future Apache-2.0 license after the second anniversary of release; verify the relevant version's release date and intended commercial use.
What does this agent do, and when should you use it?
Hexabot v3 is a self-run automation platform that combines workflows, actions, agents, and conversational channels in one runtime. Agentic workflows are defined in YAML and governed by typed runtime contracts, while Zod schemas validate inputs, outputs, and settings. Actions implement workflow behavior, and bindings keep reusable capabilities and configuration separate from task logic. The runtime also includes explicit memory definitions, RAG, MCP integration points, and multi-channel continuity. Its backend uses TypeORM with SQLite as the local default and Postgres as a production option; generated projects expose an admin UI, an API, and non-production API documentation.
A user creates a project with hexabot create, defines workflows in YAML, and uses actions to specify executable behavior with schema-validated inputs, outputs, and settings. The runtime evaluates those workflows, applies capability or configuration bindings, and can incorporate memory, RAG, and MCP tools or context. Workflows can operate through conversational channels, with channels and helpers supporting continuity across them. hexabot dev or hexabot start launches the project and exposes the admin UI at http://localhost:3000, the API at http://localhost:3000/api, and API documentation at http://localhost:3000/docs outside production. TypeORM handles persistence through the default SQLite setup or a Postgres configuration supplied with DB_TYPE and DB_* variables.
- Engineering teams that need to express multi-step automation in YAML can organize execution through actions, typed contracts, and bindings.
- Product teams serving the same automated process through multiple conversational channels can use the channel and continuity concepts.
- Teams building contextual or knowledge-assisted conversations can define runtime memory and add RAG.
- Developers connecting external tools or contextual resources to workflows can use the documented MCP integration points.
- Small teams can prototype locally with SQLite and move to a TypeORM-backed Postgres setup for production.
- Organizations self-hosting an automation service can expose an admin interface, HTTP API, and development-time API documentation from one project.
What are this agent's strengths and limitations?
- It places YAML workflows, actions, agents, and conversational channels in one runtime instead of requiring separate execution systems for each path.
- Actions use schema-validated inputs, outputs, and settings, while Zod and shared contracts provide explicit runtime boundaries.
- The binding system separates reusable capabilities and configuration from task logic, supporting more composable workflow definitions.
- Memory, RAG, and MCP integration points are explicitly part of the platform, covering stateful conversations and external tool interoperability.
- SQLite provides a low-friction local default, while TypeORM and first-class Postgres support provide a documented production data path.
- Node.js
^24.17.0is required, so environments pinned to older Node.js releases may need an upgrade. hexabot createrequires an interactive TTY and administrator-credential prompts, preventing direct first-time scaffolding in a fully non-interactive CI shell.- Docker is optional, but adopting Docker-based services adds another runtime and deployment dependency.
- The source does not document explicit native support status for ChatGPT, Claude Code, the OpenAI API, or the Claude API, so provider-specific setup must be verified separately.
- Repository metadata reports
NOASSERTIONfor the license while the README names FCL-1.0-ALv2; adopters should review the completeLICENSE.mdterms.
How do you install or deploy this agent?
Install Node.js ^24.17.0 and one of npm, pnpm, yarn, or bun. Docker is additionally required only for Docker-based services.
Install the CLI globally:
npm install -g @hexabot-ai/cliCreate and run a project:
hexabot create my-project
cd my-project
hexabot devWithout a global installation:
npx @hexabot-ai/cli create my-project
cd my-project
npx @hexabot-ai/cli devhexabot create must run in an interactive terminal and prompts for initial administrator credentials. It detects the package manager automatically, or one can be selected with an option such as --pm npm. Contributors working on the Hexabot monorepo must use PNPM.
How do you use this agent?
Run hexabot dev for local development. Use hexabot dev --docker when Docker-backed services are needed, with --services <list> to select services. After startup, open http://localhost:3000 for the admin UI, call http://localhost:3000/api, or inspect http://localhost:3000/docs in a non-production environment. For a production-style launch, use hexabot start; its Docker mode supports --docker, --services <list>, --build, and -d. Configure persistence with DB_TYPE and the applicable DB_* variables, using SQLite locally by default or Postgres for production. The CLI also provides hexabot env <init|list>, hexabot config <show|set>, and hexabot migrate [args...] for environment, configuration, and migration work.
FAQ
What credentials are required for the first run?
hexabot create prompts for initial administrator credentials in an interactive terminal. No fixed default username or password is provided in the source.Is Docker mandatory?
^24.17.0 and one supported package manager.Which databases can it use?
DB_TYPE and DB_* variables.Can project creation run unattended in CI?
hexabot create requires a TTY. The documented approach is to create the project from a local interactive terminal first.Can it be adopted for commercial use?
NOASSERTION. Review the complete LICENSE.md terms against the intended use before adoption.