Hexr Documentation

What Hexr is

Hexr is what you get if Iru, CrowdStrike, and Datadog had a child specifically for AI agents.

Like Iru — every agent action maps to a named control: SOC 2 CC6.1, HIPAA §164.312, NIST SSDF PW.4, FedRAMP AU-2.
Like CrowdStrike — a privileged DaemonSet with hostPID gives every subprocess its own SPIFFE identity, cryptographically attested at the node level. Not per pod. Per process.
Like Datadog — full OpenTelemetry spans emitted automatically by hexr_llm(), consumed by whatever observability stack you already run.

Your FFIEC, SOC 2, HIPAA, or FedRAMP auditor will ask what your AI agents did, who authorized it, and where the evidence lives. Hexr puts signed, control-mapped evidence rows into your own Postgres — per process, per agent call, any framework. Nothing leaves your VPC.

From decorator to production in three commands

Write your agent

Use any Python framework — CrewAI, LangChain, OpenAI, or raw Python. Add one decorator.

from hexr import hexr_agent, hexr_tool, hexr_llm

@hexr_agent(name="research-analyst", tenant="acme-corp")
def analyze(topic: str):
    s3 = hexr_tool("aws_s3")            # authenticated — no keys in code
    client = hexr_llm(openai.OpenAI())   # auto-traced with cost attribution
    return client.chat.completions.create(
        model="gpt-4o",
        messages=[{"role": "user", "content": f"Analyze {topic}"}]
    ).choices[0].message.content

Build + Push

The CLI scans your source code via AST, discovers every @hexr_agent, hexr_tool(), and hexr_llm() call, then generates a Dockerfile, Kubernetes manifests, and injects four sidecar containers automatically.

hexr build   # AST discovery → Dockerfile + manifests + sidecar injection
hexr push    # Container image → registry

Deploy

One command schedules your agent as a Kubernetes Pod. The Auto-Registrar creates a SPIFFE identity. The Credential Injector provisions cloud access. Envoy starts mTLS. Observability flows.

hexr deploy  # Kubernetes scheduling → SPIFFE registration → ready

What every deployed agent gets — automatically

Per-Process SPIFFE Identity

Every subprocess your agent spawns gets its own X.509 SVID — cryptographically attested by a hostPID DaemonSet on the node. Not per pod. Per process. Same mechanism as CrowdStrike Falcon, built for AI agents.

OPA Policy Enforcement

Every agent action hits OPA before it executes. Rego policies at every service boundary. Fail-closed. Allow or deny logged with the SPIFFE ID of the caller, the policy version, and the mapped compliance control.

Signed Evidence Rows

Every action writes a signed row to your Postgres — tagged with the SPIFFE ID, timestamp, policy result, and the compliance control it maps to. Your database. Your VPC. Nothing sent to Hexr.

Auditor PDF on Demand

hexr audit generates a signed PDF from your evidence rows. SOC 2, HIPAA §164.312, NIST 800-53, FedRAMP AU-2, EU AI Act. Every agent action, every control it maps to.

Zero-Secret Cloud Access

hexr_tool("aws_s3") returns an authenticated boto3 client. JWT-SVID → AWS STS / GCP WIF / Azure exchange. No long-lived credentials. No rotation.

Agent-to-Agent mTLS

A2A sidecar with JSON-RPC 2.0. Both sides validate SPIFFE SVIDs via federated trust bundle. The full delegation chain appears as a single evidence row.

Deployment

Hexr runs on your Kubernetes cluster — EKS, GKE Standard, AKS, or on-premises. You own the cluster, the Postgres, and every evidence row. The Hexr Control Plane handles licensing and cluster registration; it never sees your agent evidence or credentials.

Mode A — Hexr-Managed PKI

Hexr CP acts as SPIRE UpstreamAuthority. Fastest path to production. Suits teams without an existing PKI. Connected deployment.

Mode B — BYO Vault PKI

Your HashiCorp Vault PKI is the intermediate CA. Hexr CP is the upstream authority. Required for HIPAA BAA scope, FedRAMP IL5, or any deployment where your security team controls the root.

Air-Gapped

Zero outbound connectivity. All images pre-loaded. No api.hexr.cloud egress required. Required for FedRAMP IL5, ITAR, CMMC L3 — or any environment where the security team must approve every network path.

Framework Agnostic

Write agents with any Python framework. Hexr detects and adapts automatically.

CrewAI

Multi-agent crews with role-based agents.

LangChain

Chains, agents, and tools with LangGraph orchestration.

AutoGen

Multi-agent conversation patterns.

Strands Agents

AWS-native agent framework with tool decorators.

Google ADK

Google Agent Development Kit.

Pure Python

No framework needed. Just @hexr_agent and go.

Who Hexr is for

Buyer	Compliance Pain	Hexr Answer
Multi-cloud finserv (hedge funds, banks)	FFIEC, SEC, FINRA — per-process attestation	Per-process SPIFFE + signed evidence rows in customer Postgres
Regulated healthcare	HIPAA §164.312 — PHI access audit trail	BYO Vault PKI (Mode B), evidence stays in customer VPC, zero Microsoft/AWS/GCP cloud involvement
Defense / govtech	FedRAMP IL5, ITAR, CMMC L3 — no SaaS vendors	Air-gapped Helm chart, no internet egress, customer-owned trust root
AmLaw 100 + Big-4 audit firms	Client data cannot leave jurisdiction	Cross-cluster A2A mTLS, federated SPIFFE, full delegation chain in evidence

Next Steps

Deploy on Your Cluster

Helm + Terraform quickstart for EKS, GKE, or AKS. Running in under an hour.

Architecture Deep Dive

How identity flows: SPIRE → SVID → OPA → evidence row → auditor PDF.

Security & Compliance

SPIFFE identity model, OPA policies, FFIEC/HIPAA/FedRAMP control mapping.

Book an Auditor Demo

15-minute walkthrough: OPA deny, evidence row, signed PDF. Live cluster.

Getting Started

Self-Hosted Deployment

Architecture

Security & Compliance

Hexr Documentation

What Hexr is

From decorator to production in three commands

What every deployed agent gets — automatically

Per-Process SPIFFE Identity

OPA Policy Enforcement

Signed Evidence Rows

Auditor PDF on Demand

Zero-Secret Cloud Access

Agent-to-Agent mTLS

Deployment

Mode A — Hexr-Managed PKI

Mode B — BYO Vault PKI

Air-Gapped

Framework Agnostic

CrewAI

LangChain

AutoGen

Strands Agents

Google ADK

Pure Python

Who Hexr is for

Next Steps

Deploy on Your Cluster

Architecture Deep Dive

Security & Compliance

Book an Auditor Demo

​What Hexr is

​From decorator to production in three commands

​What every deployed agent gets — automatically

Per-Process SPIFFE Identity

OPA Policy Enforcement

Signed Evidence Rows

Auditor PDF on Demand

Zero-Secret Cloud Access

Agent-to-Agent mTLS

​Deployment

Mode A — Hexr-Managed PKI

Mode B — BYO Vault PKI

Air-Gapped

​Framework Agnostic

CrewAI

LangChain

AutoGen

Strands Agents

Google ADK

Pure Python

​Who Hexr is for

​Next Steps

Deploy on Your Cluster

Architecture Deep Dive

Security & Compliance

Book an Auditor Demo

What Hexr is

From decorator to production in three commands

What every deployed agent gets — automatically

Deployment

Framework Agnostic

Who Hexr is for

Next Steps