OPEN SOURCE

Every useful piece of our platform becomes a community project.

The hoop gateway is open source under MIT. When a part of it solves a problem on its own, it becomes a standalone hoop.labs project. 11 so far: guardrails, PII detection, credential isolation, token savings, and more. Every issue and pull request makes the tools better, and the platform they came from.

Star on GitHub →Explore hoop.labs →

Open Source Gateway

1Kstars goal

Wire protocols

PostgreSQL

MySQL

SSH

Kubernetes

HTTP/gRPC

Gateway

Active controls

Mask PII

Block DDL

Approve

Record

Analyze

Contributors

619/ 1K goal

Stars

Forks

MIT

License

THE MODEL

Find the useful piece. Break it out. Build it in the open.

The platform solves the whole problem of data security in transit. Inside it are parts that stand on their own. Those become community projects under hoop.labs.

Extracted, not invented

Labs tools start as production code inside the platform. The PII engine became Alcatraz. The guardrail engine became Fence and Warden. You get the piece we already trust with customer traffic.

One problem, fully solved

Each tool does one job end to end. No account, no trial clock, no feature gate. Install it, run it locally, keep it forever.

The value flows both ways

You get production tooling for free. We get feedback, edge cases, and contributions from environments we would never see alone. Every issue and PR hardens the platform the pieces came from.

HOOP.LABS

Every piece we broke out so far.

11 standalone tools for teams running AI agents, 9 of them open source on GitHub. Each one solves a single problem, works without the platform, and takes issues and pull requests.

Business caseWeb tool

Implementation Savings Calculator

Puts a yearly price on the access work your team does by hand: credential requests, service desk tickets, manual queries. Defaults from a real rollout, every assumption editable.

View project →

GuardrailsWeb tool + CLI

Warden

Build a Hoop guardrail regex from a query you want blocked, test it live against your own examples, and export it ready to enforce. The CLI proves rules in CI.

View project →hoophq/warden

Database discoveryCLI

Blueprint

A read-only census of every managed database your AWS credentials can reach: RDS, Aurora, DynamoDB, ElastiCache, Redshift and more. Computed locally, zero telemetry.

View project →hoophq/blueprint

Claude Code pluginPlugin

Hoop Plugin for Claude

The whole toolbelt in one install: Fence guardrails, AI session risk analysis, Julius token savings, and Alcatraz PII masking, wired into every Claude Code session.

View project →hoophq/claude-marketplace

CI/CD securityGitHub Action

Alcatraz Action

Detects PII in PR diffs, log files, and issue text before it ships: 45 entity types, checksum validated. Runs entirely in the runner, no external API.

View project →hoophq/alcatraz-action

GuardrailsClaude Code hook

Fence

Blocks the catastrophic command before your agent runs it, and stays silent for everything else. Semantic guardrails for Claude Code with no denylist to evade.

View project →hoophq/fence

Agent securityLocal proxy

Credential Cloak

Hands your agent a fake credential and swaps in the real one on egress, loaded from your OS keychain. The real secret never enters context or logs.

View project →hoophq/cloak

Token efficiencyCLI + proxy

Julius

Cuts token spend where it actually burns: dev-command output entering agent context and API traffic from your scripts. Typically 60 to 90% savings on supported commands.

View project →hoophq/julius

PII detectionGo library

Alcatraz

A dependency-free Go library that detects PII in-process: 45 entity types across 12 countries, checksum validated. No service to deploy, no network call.

View project →hoophq/alcatraz

Session auditCLI

AI Risk Summary

One command scans your AI session logs locally, surfacing security risks, PII exposure, and unauthorized access before they become incidents.

View project →hoophq/rs

Business caseWeb tool

AI ROI Calculator

Models labor savings, retained revenue, and time-to-value acceleration into payback plus 90-day, 1-year, and 5-year ROI. Partial inputs work.

View project →

Visit hoop.labs →

THE GATEWAY

The platform they come from is open too.

The gateway (everything on the data path) is open source under MIT. The commercial layer adds AI capabilities, the web UI, and enterprise integrations. No ambiguity about which is which.

Open source gateway

MIT

Protocol parser

PostgreSQL, MySQL, MongoDB, SSH, Kubernetes, HTTP wire protocol parsing

Gateway engine

Connection routing, session management, TLS termination

SSO and IdP integration

OIDC and SAML. Okta, JumpCloud, Azure AD, any provider. Free.

Plugin system

Masking, guardrails, runbooks, webhooks, and custom extensions

CLI

hoop connect, hoop exec, hoop admin — full command-line interface

Session recording

Full session capture, storage, and replay

Audit logging

Every action, identity, timestamp, and outcome

Commercial platform

Built on the open source core

AI-powered masking

ML models for context-aware PII detection beyond regex

AI session analysis

LLM-based risk scoring, anomaly detection, behavioral analysis

Web UI

Developer portal, admin console, session browser

IdP group sync

Automatic group sync via OAuth 2.0 for role-based access

Managed hosting

Hoop-hosted control plane with your self-hosted gateway

Enterprise support

SLA, guided onboarding, private Slack channel

$0No SSO tax

SSO is included in the open-source license. Not behind an enterprise paywall.

Every product in this space charges extra for SSO. We don’t. Connect Okta, JumpCloud, Azure AD, Google Workspace, or any OpenID Connect and SAML-compatible identity provider. In the open-source version. For free. Identity is a security primitive, not a revenue lever.

OktaJumpCloudAzure ADGoogle WorkspaceAuth0OneLoginKeycloakAny OIDCAny SAML

GET STARTED

From clone to first session in 10 minutes.

Clone the repo, deploy the gateway, connect your identity provider. The quickstart gets you to a working deployment faster than reading most vendor evaluation docs.

View on GitHub →Get started free →

$ git clone https://github.com/hoophq/hoop/hoop
$ cd hoop && make deploy
✓ Gateway deployed
✓ OIDC connected
✓ Policies applied
$ hoop connect postgres://prod-db
✓ Connected. Masking active. Session recorded.