Your policy, at runtime.
hoop controls the traffic between your agents and the resources they reach. Your security policy runs on every action, so nothing risky runs without your approval.
Policy first. Then analysis.
Every action is checked twice. First the rules you wrote, evaluated in order, with the same answer every time. Then an agent reads the statement itself and judges what it is trying to do and what it would touch if it ran.
Pass
The action runs. Nothing is added to the path and nothing waits on a person.
Block
It never reaches the resource. The client reads the reason you wrote, as a real protocol error rather than a dropped connection.
Route to a human
The action holds for one-off approval, with the exact statement attached.
A static rule cannot judge intent. A person cannot review at machine speed. The second layer covers both.
It reads every statement as fast as the client sends it, and catches the risk no rule was written for.
The four controls
Read what the sidecar decoded.
Pick what the client speaks. The sidecar parses the protocol, decides, and hands on only what the decision allows. Press Postgres again for its next statement.
Masked.
in · pgwire · Query · 148BSELECT name, email, ssn FROM customers LIMIT 50outAda Lovelace · j••••@••••.com · •••-••-4021
Postgres: statement 1 of 3
One hop before the resource.
A sidecar runs next to your resource, not in place of it. Every statement a client sends goes through it first. Every response comes back through it. It reads both in flight, before either side sees the other.
We call it a sidecar because it attaches to one resource and travels with it. Everything it enforces comes from one config file.
127.0.0.1:15432the sidecar127.0.0.1:5432your real resourceChange one address. Nothing else.
543215432
The address your client points at. The one thing that changes.
Stays the same
- Your application code
- Your credentials
- Your network routes
- Your agent’s prompt
Nothing on the other end can tell the difference. A control the client can opt out of is not a control.
No SDK, no agent-side config, and no cooperation from the thing being controlled. The agent keeps its client, its queries and its credentials.
Protocol agnostic, by design.
We parse the protocol, not the client. Whatever the connection speaks, the same policy runs on it.
No code changes, no new credentials, no rerouting, and nothing bolted to one driver or one vendor.
We build on wire protocols on purpose. Models change every few months. Frameworks change faster. Postgres is not going anywhere. A control that sits in the connection outlives every layer above it.
Read the code, then run it.
Anything that reads every query to your data should be code you can read too. Free and open source under MIT. One command to install. One file to configure.
Ask an assistant how hoop.dev sits between an agent and your data: Claude, ChatGPT, Grok, Gemini, Perplexity, Copilot.
$ brew tap hoophq/brew https://github.com/hoophq/brew.git
$ brew install hoop
$ hoop start sidecar --config config.yaml
# point the client at 127.0.0.1:15432 instead of the database