HOOP BENCHMARKS

We benchmark our own controls against labelled data.

An accuracy figure means nothing without the corpus, the labels, and the method behind it. This is what we test, how we test it, and which numbers you should read carefully.

Read the security benchmarkGet a demo
corpus.manifest
commands1,144
data spans216,000
identifiers54 types
surfaces7 protocols
labelling3 independent passes
agreement94.0%
kappa0.91

METHOD

Four rules that make a number worth reading.

The harness is shared across every track. It loads a labelled dataset, runs it through the engine we ship, compares the output against the expected result, and reports accuracy next to throughput from the same run.

Labels come first, rules come second

Every scenario is labelled by what a reviewer would call dangerous, never by what our own ruleset returns. A ruleset scored against its own output reports perfect recall and measures nothing.

Three passes, and we report the disagreement

Each command is labelled three times independently. Gold is unanimous or two of three. Raw agreement is 94.0% and Cohen’s kappa is 0.91. The 69 contested rows stay marked so anyone can exclude them and re-score.

The corpus is built to be hard

It is loaded with near-misses: a SELECT that only mentions DROP, a kubectl delete behind --dry-run, a log search quoting a destructive command. An easy corpus produces a flattering number.

A partial run publishes nothing

A run that cannot evaluate every scenario exits with an error instead of reporting metrics on whatever survived. We caught this the honest way: a simulated mid-run outage moved a score by 16 points on the surviving subset.

WHAT WE TEST

Four benchmarks, one harness.

Each track answers one question about the product in production. Building the harness once means a new dataset is a new track rather than a new project. Results publish as each track finishes, including the ones that take longer than planned.

SecurityPublished

Does Hoop stop what a reviewer would stop, and hide what a reviewer would hide? Guardrails, session analysis, and data masking, scored against labelled ground truth.

Read the results
Performance and capacityIn progress

How many concurrent sessions does one deployment carry, on what hardware, and where does the bottleneck actually sit? Measured by replaying recorded sessions until latency degrades.

LatencyPlanned

What does inspection add to a query round trip under sustained load, at the median and at the tail?

Token usagePlanned

What does AI session analysis cost per action in model tokens, and how does that scale with session volume?

RESULTS

The security benchmark, in four numbers.

Hoop evaluates an action in two stages: session analysis scores intent and risk, then the guardrail engine matches rules and enforces. The benchmark composes them in that order, so these describe the system rather than one component of it.

Gateway path2 of 450dangerous commands reached the resource unchallenged
Gateway path26,762guardrail decisions per second, on one machine
Sidecar masking2,500xfaster than review at one minute per action
Both paths216,000labelled data spans scored in a single run

Each figure carries the deployment path it came from, plus the configuration and the run-to-run variance behind it. A recall number without its false-positive rate is marketing, not measurement, so the detail page reports both.

Read the full method and results

WHAT CHANGED

From a gateway in the middle to a sidecar beside the resource.

Hoop used to put a gateway between every client and every resource, with an agent inside each network to reach back. It worked, and it made the gateway the scaling unit, the outage radius, and a network hop between the rules and the data they protect.

The sidecar runs next to one resource and enforces in process. The control plane distributes policy and collects evidence, and never sees a session. One thing the benchmark does support directly: the same rules returned identical verdicts on all 1,144 commands whether they were evaluated in process or sent to a separate service, and in process was about a hundred times faster.

See how the sidecar attaches
BeforeGateway + Agent
Client or agentpsql, kubectl, MCP, Claude Code
Hoop GatewayEvery session detours here
Hoop AgentOne per network, phones home
Database or clusterReached through the tunnel
  • Traffic leaves its own network to be inspected
  • The gateway is the scaling unit and the outage radius
  • Inspection runs a network hop away from the data
AfterSidecar + Control Plane
Client or agentSame clients, same credentials
Hoop SidecarRuns beside the resource, enforces in process
Control PlanePolicy out, evidence back. No session traffic.
Database or clusterOne hop away, on its own network
  • Traffic never leaves the network it started in
  • One resource per sidecar, so a failure is scoped to one resource
  • Rules evaluate in the same process, with no service call

What these numbers do not cover yet

The results above are a baseline of the gateway path, measured before the rebuild. The sidecar’s masking engine is already in them. Its guardrail engine is not: that engine runs the same 1,144 commands next, scored by the same harness against the same labels, and published on this page beside the gateway figures.

Measuring the architecture we are leaving is the only way to say honestly whether the one we are moving to is better.

Run the same commands against your own resource.

Attach one sidecar to something you already run and watch the controls fire on real traffic. No infrastructure project, no new credentials, nothing rerouted.

Get a demoGet started free
Ask AI how hoop.dev benchmarks its controls