Skip to main content
Hoop is a reverse proxy that reads the protocol it carries. Every query, every result set, every API call passes through it, and Hoop decides what gets through. It adds less than 10ms to the round trip. Most proxies see bytes. Hoop sees statements. It speaks Postgres, ClickHouse, SQL Server, HTTP and more, right on the wire (see all protocols). So it knows a DELETE with no WHERE from a harmless SELECT. It blocks the first, masks the emails in the second, and records both. Your clients stay the same. Your credentials stay where they are. Start with one Sidecar. One binary and one config file, running next to the resource it protects. Grow into a fleet. When one Sidecar becomes fifty, the Control Plane pushes your rules to all of them from one place. It ships with Hoop Enterprise.

​
Install the Sidecar

The Sidecar ships in the hoop CLI: one binary, no external dependency. See Install the CLI for macOS, Linux, Windows, WSL and manual installs.

​
Next step

Install the Sidecar and get it running. Pick the path that fits how you deploy.

Command Line

Install the hoop binary on macOS, Linux, Windows or WSL, then run the Sidecar directly.
Start here

Container Images

The official hoophq/hoopsidecar image, in a default and a distroless flavour.

Kubernetes

A Helm chart, including running it as a native Kubernetes sidecar container.

​
Core Concepts

Sidecar

The engine. A proxy beside your resource that reads the wire protocol and decides what gets through. No external dependency.
Learn more

Control Plane

One place to run every Sidecar. Change a rule once and the whole fleet enforces it. Part of Hoop Enterprise.
Learn more

​
Features

Two ways a request can travel through the Sidecar, and two controls that apply on either path.

Direct Access

The straight-through path. Guardrails and Data Masking apply inline, deterministically, with no model call and no third party in the chain.
Learn more

Agentic Access

The AI Analyzer classifies the statement and the risk level picks a tool: block, allow, review, apply a guardrail, or mask the response.
Learn more

Data Masking

Rewrite sensitive values in the response, in memory, before they reach the client. Requests are never touched.
Learn more

Guardrails

An ordered deny list evaluated against every statement, refusing what should never run with a message you wrote.
Learn more