Hoop.dev

A team self-hosted an open-source gateway, connected it to SSO, and placed it in front of production databases. It reached around 20,000 governed database sessions a week before enabling governance itself.

Engineering deep-dives, security research, and product thinking from the team building the data security layer for AI agents.

The page describes gateway data masking for BigQuery analytics, where AI models receive insights without personally identifiable information and auditors can verify requests.

The page discusses masking secrets from CI/CD AI agents and says build pipelines often resolve stored secrets to clear text, while CI runners may have broad access to databases and artifact stores.

The hoop.dev sidecar is free and open source under the MIT license. Enterprise adds a control plane that distributes rules to deployed sidecars.

The white paper compares CyberArk and hoop.dev on infrastructure access: CyberArk identifies which credential was used, while hoop.dev controls what that credential can do.

That is the gap between controlling the door and controlling the room. Credential brokering decides who gets a key and who walks in. Runtime governance decides what the identity is allowed to do once it is inside, in the path of execution, while the action is happening. hoop.dev does both.

Hoop.dev builds the protocol-layer gateway that governs what happens between authentication and action. Open source. MIT license. CNCF member.

Data and context make agents useful. hoop.dev makes it safe. Attach a sidecar to a database, cluster, or agent sandbox and get masking, guardrails, and approvals on live traffic. No code changes, no new credentials.

GitHubRepository owner