hoop

Hi HN, we built an extension to Envoy proxy that parses and sends contents of requests to an LLM at runtime. We do that by adding a deterministic SQL parser, gGRPC payload inspection and LLM analysis of the payload before upstream call. Users are proxying headless agents traffic with it so that sec teams can have their prompts blocking harmful actions via network traffic before it leaves the agent. When you tell the LLM analyzing the traffic to block writes, it will spot it across the different protocols by looking at the structured payload we build from parsing the binary protocol. It runs as a UDS upstream, and we're exploring bundling it inside envoy to remove the UDS hop. Envoy is incredible, but it has limited support for anything outside http. Basic database query parsing, little policy enforcement on request contents, most of the s

Hi HN, I’m the founder of an open-source infra access gateway. I’ve always been frustrated by how our users were missing the cool data generated by our tool. Think a list of all actions devs perform on infrastructure: SQL, shell, CLIs, etc. I dreamed of the day our tool would be able to tell users: “hey, you run this query every week, consider adding it to an internal tool or scheduler”. Or: “you read 1000 customer e-mails last week, likely a mistake, please remove this column from your queries.” We tried building it a few times. First indexing session contents on Elasticsearch. Then trying to query directly from Postgres blob data types in-line parsing to json. All failed. Data is too big and making this work would be it’s own product (SIEM?). Thanks to LLMs we were able to launch something much simpler that does a better job then I ever

Hey HN! I'm Andrios, founder of Hoop.dev, an OSS layer-7 gateway for infra access. We just released a new integration: put LLMs between devs' or agents' actions and databases or Kubernetes. The model gives a more nuanced analysis of the action, not only the syntax. Like: is this deleting data? Updating large number of entries? How risky is it? Then it decides if it will allow the execution, send it to human approval, or block it completely. Because Hoop sits at the network layer, this process happens in-transit, as data is passing through the gateway. Very low setup required. As product teams put agents in production, we're seeing security and SRE teams also shipping agents to enforce controls, and this is a nice way of deploying them. What do you think about this approach? Any feedback is super welcome here. Project is here: https://gith

Fair point about StrongDM and Teleport pricing. Actually, even their enterprise features are free in Hoop. We took a different approach - core PAM stuff is all free and open source. We monetize on a new layer - packet manipulation, like AI data masking. So you get enterprise PAM features without the enterprise price tag. Might be worth a look as given the strategy these features should remain free. Could save you some serious cash. Repo's public if you wanna kick the tires: https://github.com/hoophq/hoop

Consider Hoop (https://hoop.dev) as an open source alternative. It's designed to be lightweight and developer-friendly. Key features that are free/open source: 1. SSH, K8s, database access 2. RBAC and just-in-time access 3. Session recording 4. IdP integration We monetize on advanced layer 7 features like AI data masking and firewall rules. But the core access management stuff stays free. Repo is public if you want to check it out:https://github.com/hoophq/hoop Good luck finding a solution that fits your needs.

Hi everyone, We've been building an access gateway for the past few years. The first version was built in Clojure, and we rewrote it in Golang. But that's a whole other story. The gateway has a new type of architecture that allows packet manipulation (one of the reasons for Golang), which basically means you can programmatically change contents of connections in real-time. Therefore it enables a whole set of problems to be consolidated at the access gateway layer, like data access policies (DLP), review of critical operations before they run (Change Management), automate repeat operations (Runbooks) and more. And this is how we monetize the solution. Because of that we're open-sourcing the core of the gateway under MIT license. And we're including enterprise features from other gateways and some unique and new options enabled by our archi