Integrations · Hex
A Guild agent can trigger Hex project runs, edit notebook cells, manage workspace resources, and drive Hex agent threads without leaving your automation workflow. Guild stores your Hex API key server-side so the key never appears in agent code, prompts, or logs. Credential policies let you restrict which operations each agent may call, and every request is auditable through Guild’s credential proxy.
Book a demo
See how teams govern agents that use Hex.
Talk to sales
Get access to Guild, then connect Hex to your first agent.
What the Hex integration exposes
The integration packageguildai~hex provides tools covering Hex projects, notebook cells, project runs, data connections, collections, groups, users, and agent threads. Tools follow the hex_ naming prefix. Use pick() to load only the tools your agent needs rather than the full set.
How it works
1
Get a Hex API key
In Hex, go to Settings > API keys and generate a key. A Team or Enterprise plan is required.
2
Connect the credential in Guild
In Guild, go to Access & setup > Credentials, click Connect, select hex, and paste the key into API Key. See Credentials for workspace, member, and agent-scoped options.
3
Add HexTools to your agent
Import
HexTools from @guildai-services/guildai~hex and spread it into your agent’s tools object. Guild sends the key as a bearer token in the Authorization header on every call.Why Hex access needs governing
The Hex integration can deactivate users, delete cells, update project sharing, and trigger runs against published notebooks. Without controls, any agent with the credential can make those changes across the entire workspace. Guild’s credential policies let you write ALLOW and DENY rules that the credential proxy enforces before any request reaches Hex. You can restrict a credential to read-only operations, limit it to specific agents or workspaces, or block destructive tools such ashex_deactivate_user and hex_delete_cell by name or pattern.
Guild stores the Hex API key server-side and injects it at the proxy layer, so agent code never sees the secret. You can scope a credential to one workspace, one member, or a single agent using the options on the Credentials page. A workspace can also be restricted to its own credentials, preventing shared account credentials from reaching it. Because all requests pass through the proxy, every call is logged there rather than left to individual agents to record.
About the Hex integration
Agents can create, run, and manage Hex projects and notebooks, including editing cells and triggering project runs. They can manage workspace resources such as data connections, collections, groups, and users. Agents can also start and continue Hex agent threads and review context suggestions. The integration isguildai~hex.
Authentication
- Type: API key
- Header: Guild sends the key as a bearer token in the
Authorizationheader
Setup
1
Connect Hex
In Guild, go to Access & setup > Credentials, click Connect, select hex, and paste the key into API Key.
Usage
Selecting specific tools
Tools are named with thehex_ prefix. Use pick() to include only what your agent needs.
Tools
Tools in the latest published version ofguildai~hex:
All 61 tools
All 61 tools
Frequently asked questions
Can an agent react to events in Hex, like when a run finishes?
Can an agent react to events in Hex, like when a run finishes?
No. The catalog entry for
guildai~hex lists no webhook events, so the integration does not support event-triggered runs. Agents must poll run status using tools such as hex_get_run_status or hex_get_project_runs.How do I stop an agent from deactivating Hex users or deleting cells?
How do I stop an agent from deactivating Hex users or deleting cells?
Write a DENY rule in the credential’s credential policy targeting
hex_deactivate_user and hex_delete_cell by name. DENY rules take precedence over any ALLOW rules, so those operations are blocked even if a wildcard ALLOW is also present.Can I give one agent a different Hex account than the rest of my workspace?
Can I give one agent a different Hex account than the rest of my workspace?
Yes. Connect a dedicated credential from the installed agent’s page, or grant an existing credential to that agent alone. Guild’s credential resolution checks agent-dedicated and granted credentials before falling back to workspace or account credentials, so that agent will always use its own key.
How does Guild keep my Hex API key out of agent code?
How does Guild keep my Hex API key out of agent code?
Guild stores the key and injects it as a bearer token in the Authorization header inside its credential proxy. The key never enters the agent’s code, container, prompt, or state, as described in the security architecture and Credentials docs.
Put a governed agent on Hex this week
Book a demo
See how teams govern agents that use Hex.
Talk to sales
Get access to Guild, then connect Hex to your first agent.