feat(search): add Hex project search and notebook reads (#9757)

* feat(search): add Hex project search and notebook reads

* fix(search): preserve readable Hex search candidates

* docs(search): keep Hex setup requirements concise

Author: waleedlatif1

apps/docs/content/docs/search/hex.mdx

@@ -0,0 +1,37 @@
+---
+title: Hex
+description: Find Hex projects and read their available draft notebook source
+---
+
+Hex Search uses **Member accounts** through Hex's official MCP service. It searches published and unpublished projects available to your connected account, then reads supported draft notebook cells on demand.
+
+## Connect
+
+You need a Hex Team or Enterprise plan, the Editor workspace role or above, and view access to the projects you want to search. Sim uses read-only tools; project edit permission is not required.
+
+1. An admin adds **Hex → Member accounts** in **Settings → Sources**.
+2. Open **Integrations → Hex → ⋯ → Connect** and authorize your Hex account.
+3. Ask a focused question such as `Find the deployment analysis project`, then read a result.
+
+Sim connects to `https://app.hex.tech/mcp`. Hex deployments on other hosts, including EU and HIPAA environments, are not supported by this connection. [Hex MCP requirements](https://learn.hex.tech/docs/api-integrations/mcp-server).
+
+## Search projects
+
+Use plain terms of up to 400 characters, without wildcards or provider-specific query operators. Search retrieves and verifies metadata for at most ten projects. It has no continuation cursor or complete workspace listing, so narrow the query if you need more coverage.
+
+Previews contain the current project title and description. They do not contain notebook evidence. Date filters use the project's last edit time and apply only to the retrieved candidates; date sorting does not search the entire workspace.
+
+## Read notebook source
+
+Reading a result retrieves its current draft cells in notebook order. Sim includes Markdown, SQL, and Python source. Other cell types show their labels and types, with an explicit notice that their content is unavailable.
+
+This does not retrieve published app snapshots, rendered charts, query results, attachments, or warehouse data. It does not execute code or queries. Notebook section nesting is not preserved, and citations open the draft editor in Hex.
+
+Each read is limited to eight pages of 100 cells and 512 KiB of text. If those limits are exceeded, the response is malformed, or the project changes during the read, Sim returns an error instead of incomplete notebook source. Search again after a project changes, or open large projects directly in Hex.
+
+Sim uses only four read operations: `get_me`, `search_projects`, `get_project`, and `list_cells`. Each request uses the member's current grant. Switching the connected Hex workspace invalidates earlier results; search again in the intended workspace.
+
+## Related docs
+
+- [Connect your account](/search/connect-your-account)
+- [Hex MCP guide](https://learn.hex.tech/docs/api-integrations/mcp-server)

apps/docs/content/docs/search/meta.json

@@ -21,6 +21,7 @@
     "google-drive",
     "google-meet",
     "granola",
+    "hex",
     "hubspot",
     "jama",
     "jira",

apps/sim/lib/api/contracts/credential-groups.ts

@@ -370,6 +370,7 @@ export type UpdateCredentialGroupBody = z.input<typeof updateCredentialGroupBody
 export const createCredentialGroupMcpConnectorBodySchema = z.discriminatedUnion('connectorId', [
   z.object({ connectorId: z.literal('fireflies') }).strict(),
   z.object({ connectorId: z.literal('granola') }).strict(),
+  z.object({ connectorId: z.literal('hex') }).strict(),
   z.object({ connectorId: z.literal('notion') }).strict(),
   z.object({ connectorId: z.literal('coda') }).strict(),
   z.object({ connectorId: z.literal('hubspot') }).strict(),

apps/sim/lib/credential-groups/managed-mcp-connector-icons.ts

@@ -3,6 +3,7 @@ import {
   DatabricksIcon,
   FirefliesIcon,
   GranolaIcon,
+  HexIcon,
   HubspotIcon,
   LucidIcon,
   NotionIcon,
@@ -13,6 +14,7 @@ import type { ManagedMcpConnectorId } from '@/lib/credential-groups/managed-mcp-
 export const MANAGED_MCP_CONNECTOR_ICONS = {
   fireflies: FirefliesIcon,
   granola: GranolaIcon,
+  hex: HexIcon,
   hubspot: HubspotIcon,
   lucid: LucidIcon,
   zoom: ZoomIcon,

apps/sim/lib/credential-groups/managed-mcp-connectors.ts

@@ -3,6 +3,7 @@ import { CREDENTIAL_GROUP_ACCOUNTS_PER_PROVIDER_LIMIT } from '@/lib/credential-g
 export const MANAGED_MCP_CONNECTOR_IDS = [
   'fireflies',
   'granola',
+  'hex',
   'databricks',
   'coda',
   'notion',
@@ -44,6 +45,13 @@ export type ManagedMcpConnector =
   | FixedPreregisteredManagedMcpConnector
 
 export const MANAGED_MCP_CONNECTORS = {
+  hex: {
+    id: 'hex',
+    name: 'Hex',
+    description: 'Search projects using your Hex account',
+    url: 'https://app.hex.tech/mcp',
+    oauthClientRegistration: 'dynamic',
+  },
   zoom: {
     id: 'zoom',
     name: 'Zoom',

apps/sim/lib/mothership/generated/docs-manifest.ts

@@ -456,6 +456,7 @@ export const DOCS_MANIFEST: readonly string[] = [
   'search/google-drive.mdx',
   'search/google-meet.mdx',
   'search/granola.mdx',
+  'search/hex.mdx',
   'search/hubspot.mdx',
   'search/jama.mdx',
   'search/jira.mdx',

apps/sim/lib/mothership/generated/sim-assistant-tools.generated.ts

@@ -18,6 +18,7 @@ export const liveSearchProviderSchema = z.enum([
   'gitlab',
   'linear',
   'lucid',
+  'hex',
   'hubspot',
   'fireflies',
   'granola',

apps/sim/lib/mothership/generated/tool-catalog-v1.ts

@@ -6111,6 +6111,7 @@ export const SearchWorkspace: ToolCatalogEntry = {
                 'gitlab',
                 'linear',
                 'lucid',
+                'hex',
                 'hubspot',
                 'fireflies',
                 'granola',

apps/sim/lib/mothership/generated/tool-schemas-v1.ts

@@ -6024,6 +6024,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
                   'gitlab',
                   'linear',
                   'lucid',
+                  'hex',
                   'hubspot',
                   'fireflies',
                   'granola',

apps/sim/lib/sim-search/live/README.md

@@ -84,6 +84,12 @@ MCP search covers page and table-row content, permits empty-query recency listin
 
 In service mode, the source's selected document IDs restrict MCP retrieval. Every candidate's parent document must also be currently visible to the source token. With an Enterprise organization ID, the Admin API must return that exact document in the configured organization; deleted documents and revoked key access are rejected. Personal MCP still enforces the member's permission to read the actual content. [Official MCP tool catalog](https://coda.io/resources/mcp/tools-and-endpoints).
 
+### Hex
+
+Member mode uses managed OAuth against `https://app.hex.tech/mcp`. Only `get_me`, `search_projects`, `get_project`, and `list_cells` are allowed. The current workspace ID from `get_me` binds search results, references, and canonical draft-editor citations; a changed workspace requires a fresh search. Every candidate is hydrated through `get_project`, and search previews are explicitly project metadata rather than notebook evidence. Search verifies at most ten unique projects and has no continuation. Date filtering and sorting apply only to those candidates.
+
+Reads verify the project revision before and after paging through its draft cells. SQL, Python, and Markdown source are included; other cell types retain their labels with an explicit unavailable-content marker. Rendered outputs, attachments, published app snapshots, and warehouse data are not retrieved. Reads fail instead of returning incomplete source when cells are malformed, project access changes, a cursor repeats, or the eight-page / 512 KiB text limit is exceeded. This path never executes projects or queries. Hex requires a Team or Enterprise plan and the Editor workspace role or above for these project-read tools; view access to each project is sufficient.
+
 ### GitLab
 
 Service mode only, with no member GitLab connection. Each configured source fixes the instance, project, token, and permission strategy. Members search the configured project through that token, but each result must separately match their verified organization identity and source ACLs.
@@ -116,7 +122,7 @@ Paths below are relative to `apps/sim`.
 
 The provider catalog holds a trusted origin, not an arbitrary URL supplied by a model. Actual endpoint paths and query translation belong in the provider module. `http.ts` supplies bounded responses, a per-client request budget, timeout/cancellation, configured-endpoint validation, and no credential-bearing redirects. Use its origin-bound path API; do not return tokens to UI or model tools.
 
-Self-managed GitLab is resolved from the saved source's validated host/project instead of the catalog's default origin. Managed MCP providers resolve the current member server/grant through `mcp-accounts.ts` and `managed-mcp.ts`, discover tool schemas and permit only fixed read tools. Coda, Fireflies, Granola and Notion each have an adapter for their actual search/read formats. Neither exception lets a search query choose a credential destination.
+Self-managed GitLab is resolved from the saved source's validated host/project instead of the catalog's default origin. Managed MCP providers resolve the current member server/grant through `mcp-accounts.ts` and `managed-mcp.ts`, discover tool schemas and permit only fixed read tools. Coda, Fireflies, Granola, Hex and Notion each have an adapter for their actual search/read formats. Neither exception lets a search query choose a credential destination.
 
 ### Provider endpoint map