DOCSEARCHbyAlgolia
Submit Docs

Hoop Documentation

website·Indexed 35 days ago

https://hoop.dev/?referer=runops.io

Documentation for Hoop, a gateway providing secure access to cloud services, development environments, and web applications. Includes guides for integrating with AWS (ECS, CloudWatch, SSM), Kubernetes (EKS), GitHub, and various Identity Providers (Okta, Azure, Google, Auth0, JumpCloud). Features support for the Model Context Protocol (MCP) for AI/LLM connectivity and deployment options including SPIFFE and Microsoft Presidio.

Tokens
158K
Snippets
537
Records
1.1K
Agent score
71%

What's inside Hoop

  1. Overview of Hoop Secrets Management

    Secrets Management in Hoop allows users to connect to databases and servers without exposing credentials. Instead of storing literal passwords in resource role configurations, Hoop references secrets stored in external providers. At runtime, the Hoop agent fetches the secret from the provider and injects it into the session, ensuring the end-user never sees the actual credential value.

  2. Overview of Hoop Live Data Masking

    Live Data Masking automatically detects and redacts sensitive data (PII, financial data, secrets, and health information) in query results in real-time. It operates at the protocol layer, intercepting the response stream and sending content to a configured DLP provider for inspection. Redaction happens in memory, ensuring original sensitive data is never stored or exposed to the end-user. This feature helps organizations meet compliance standards such as GDPR, HIPAA, PCI DSS, SOC 2, and CCPA.

  3. Overview of GCP IAM Federation in Hoop

    IAM Federation in Hoop prevents the need to share a single Google service-account key across a team. Instead, each user's GCP activity is attributed to their own principal, ensuring a clean audit trail in Cloud Logging and removing the risk of long-lived shared keys. Hoop mints short-lived tokens at session time based on the chosen provider.

  4. Overview of SPIFFE authentication for Hoop agents

    Hoop supports authenticating agents using SPIFFE JWT-SVIDs as an alternative to the default static HOOP_KEY token. This allows for short-lived, automatically rotating credentials and cryptographically attested identities tied to workloads via SPIRE registration. SPIFFE is additive; static HOOP_KEY tokens continue to work even when SPIFFE is enabled. Currently, Hoop supports JWT-SVID validation; X.509-SVID/mTLS and native SPIRE Workload API integration are planned for the future.

  5. Overview of the Alcatraz PII detection provider

    Alcatraz is Hoop's in-process PII detection engine, compiled directly into the agent binary. Unlike Microsoft Presidio, it requires no external Analyzer, Anonymizer, or Envoy services, eliminating HTTP round-trips for masking. It supports 48 built-in entity types. Most detections are pattern-based, but statistical entity types (PERSON, LOCATION, and NRP) require an ONNX NER model to be present on the agent's disk. If these statistical types are requested but the model is missing, the agent will refuse the session.

  6. Overview of Hoop.dev Web App Resource Role Management

    The Hoop.dev Web App serves as the central interface for managing secure access to infrastructure. It allows administrators to create and manage resource roles for databases (PostgreSQL, MySQL, MongoDB), cloud services (AWS, Kubernetes), web applications, APIs, and development environments. Key capabilities include defining granular permission controls, integrating with identity providers, and implementing AI-powered security features like data masking and real-time command filtering (Guardrails).

  7. Overview of Hoop Admin Federation

    The hoop admin federation command group allows administrators to wire short-lived, per-user cloud credentials onto an existing Hoop connection. When federation is configured for a connection, sessions resolve per-user credentials at the time the connection is opened. Connections without a federation configuration continue to use their standard static credentials. All federation commands require the Admin role and target a connection by name or UUID.

  8. Overview of Alcatraz PII Scanning Library

    Alcatraz is an open-source Go native library designed to scan text for Personally Identifiable Information (PII) locally within a process. It requires no external services or network calls, ensuring data does not leave the local environment. It uses pattern-based recognizers and checksum validators for 25 of its 45 entity types to ensure matches are verified rather than guessed.

  9. Overview of the Hoop Gateway

    The Hoop Gateway is a Layer 7 gateway that sits between users (engineers, AI agents, and service accounts) and infrastructure. It provides a centralized platform for managing access, enforcing security controls at the wire protocol, and auditing activity. Key capabilities include access requests, session recording, runbooks, resource provisioning, identity federation, and integrations with tools like Slack, Teams, and Jira.

  10. Overview of Hoop Tunnel

    Hoop Tunnel allows users to access Hoop connections using local hostnames under the .hoop domain. It uses a daemon called hsh-tunneld to create a virtual network interface and handle DNS for *.hoop names, forwarding TCP connections to the Hoop gateway over gRPC. This enables the use of standard TCP clients (like psql, mysql, DBeaver, or application code) without needing to manage proxies, ports, or specific database credentials.

  11. Overview of the hsh CLI

    hsh is a companion CLI that wraps ssh and kubectl to allow them to work against resources behind a Hoop gateway without changing user workflows. It handles authentication, identifies the correct Hoop resource role, and routes calls through the gateway. It is separate from the hoop CLI; hoop is used for administration and automation, while hsh is for day-to-day terminal work. For databases and TCP services, hsh includes the Hoop Tunnel daemon (hsh-tunneld).

  12. Overview of Hoop Reverse Proxy

    Hoop is a protocol-aware reverse proxy that inspects statements (rather than just bytes) on the wire for protocols including Postgres, ClickHouse, SQL Server, and HTTP. It allows administrators to block dangerous queries (e.g., DELETE without a WHERE clause), mask sensitive data in result sets, and record activity with less than 10ms added to the round trip. It can be deployed as a single Sidecar binary or managed as a fleet via the Hoop Enterprise Control Plane.