Skip to main content
Agents and engineers reach real infrastructure with real credentials. Someone has to decide what they can do. Hoop decides it at runtime, per command. The Sidecar is where you start. It is a proxy that runs next to your resource, decodes the wire protocol, and decides what reaches the database and what comes back, blocking destructive statements and masking sensitive values in responses. Nothing else to deploy and no database to run: one binary, one config file.

​
Install the Sidecar

The Sidecar ships in the hoop CLI — one binary, no external dependency. See Install the CLI for macOS, Linux, Windows, WSL and manual installs.

​
Next step

Install the Sidecar and get it running — pick the path that fits how you deploy.

Command Line

Install the hoop binary on macOS, Linux, Windows or WSL, then run the Sidecar directly.
Start here

Container Images

The official hoophq/hoopsidecar image, in a default and a distroless flavour.

Kubernetes

A Helm chart, including running it as a native Kubernetes sidecar container.

​
Core Concepts

Sidecar

The engine. A proxy beside your resource that reads the wire protocol and decides what gets through — with no external dependency.
Learn more

Control Plane

The brain. Centralizes every Sidecar you run and delivers rule sets to all of them from one place. An Enterprise feature.
Learn more

​
Features

Two ways a request can travel through the Sidecar, and two controls that apply on either path.

Direct Access

The straight-through path. Guardrails and Data Masking apply inline, deterministically, with no model call and no third party in the chain.
Learn more

Agentic Access

The AI Analyzer classifies the statement and the risk level picks a tool: block, allow, review, apply a guardrail, or mask the response.
Learn more

Data Masking

Rewrite sensitive values in the response, in memory, before they reach the client. Requests are never touched.
Learn more

Guardrails

An ordered deny list evaluated against every statement, refusing what should never run with a message you wrote.
Learn more