# Hexr

## Docs

- [Hexr Documentation](https://docs.hexr.dev/introduction.md): Audit-grade evidence for AI agents — in your cluster. Per-process SPIFFE identity, OPA policy enforcement, and signed evidence rows in your own Postgres.
- [Deployment Models](https://docs.hexr.dev/deployment-models.md): Hexr runs entirely in your Kubernetes cluster. Your data never leaves your infrastructure — choose how you want to root your PKI.
- [Architecture Overview](https://docs.hexr.dev/architecture/overview.md): Hexr is a 5-layer runtime platform that provides cryptographic identity, secure credential exchange, and full observability for every AI agent process.
- [Self-Hosted Quick Start](https://docs.hexr.dev/self-hosted/quickstart.md): Deploy Hexr on your own Kubernetes cluster — EKS, GKE Standard, AKS, or on-premises. Your cluster, your Postgres, your evidence.
- [Helm Configuration](https://docs.hexr.dev/self-hosted/helm.md): Complete reference for Hexr Helm chart configuration values.
- [Terraform Setup](https://docs.hexr.dev/self-hosted/terraform.md): Deploy Hexr infrastructure on AWS, GCP, or Azure using Terraform modules.
- [Air-Gapped Deployment](https://docs.hexr.dev/self-hosted/air-gapped.md): Deploy Hexr in fully disconnected environments with no internet access.
- [Five-Layer Platform Stack](https://docs.hexr.dev/architecture/five-layers.md): Hexr organizes its runtime into five distinct layers — each independently scalable and replaceable.
- [Agent Pod Architecture](https://docs.hexr.dev/architecture/agent-pod.md): Every agent deploys as a Kubernetes Pod with four containers: your agent code, Envoy mTLS proxy, A2A sidecar, and PID mapper.
- [Per-Process Identity](https://docs.hexr.dev/architecture/per-process-identity.md): Hexr assigns SPIFFE identities to individual agent processes within containers — not just pods. This is the core innovation that enables fine-grained identity attribution.
- [Credential Exchange](https://docs.hexr.dev/architecture/credential-exchange.md): Three-tier credential cache delivers sub-millisecond cloud credentials. JWT-SVID → OPA → STS exchange, cached from memory to Valkey to live refresh.
- [Observability Stack](https://docs.hexr.dev/architecture/observability.md): Full OpenTelemetry pipeline with distributed tracing, metrics, and dashboards. Every agent operation is instrumented automatically.
- [Security Overview](https://docs.hexr.dev/security/overview.md): Hexr's defense-in-depth security model — cryptographic identity, policy enforcement, and GenAI threat protection.
- [SPIFFE Identity](https://docs.hexr.dev/security/spiffe-identity.md): Every agent process gets a unique cryptographic identity — here's how SPIFFE and SPIRE make it work.
- [OPA Policies](https://docs.hexr.dev/security/opa-policies.md): Write fine-grained authorization policies that control which agent processes can access which services.
- [Threat Model](https://docs.hexr.dev/security/threat-model.md): Attack chains specific to AI agent platforms and how Hexr mitigates each one.
- [Threat Chains](https://docs.hexr.dev/security/threat-chains.md): Common AI agent attack chains and how Hexr's defense-in-depth architecture breaks each one.
- [OWASP Top 10 for GenAI](https://docs.hexr.dev/security/owasp-genai.md): How Hexr addresses every risk in the OWASP Top 10 for Large Language Model Applications.
- [Compliance Frameworks](https://docs.hexr.dev/security/compliance-frameworks.md): How Hexr maps to FFIEC, SOC 2, HIPAA §164.312, NIST 800-53, FedRAMP IL5, CMMC L3, and EU AI Act — with signed evidence rows your auditor can verify.
- [SDK Overview](https://docs.hexr.dev/sdk/overview.md): The Hexr Python SDK gives your agents cryptographic identity, authenticated cloud tools, LLM observability, and inter-agent communication — with minimal code changes.
- [Installation](https://docs.hexr.dev/sdk/installation.md): Install the Hexr Python SDK from the private PyPI registry.
- [@hexr_agent](https://docs.hexr.dev/sdk/hexr-agent.md): The core decorator that gives your Python function or class a cryptographic SPIFFE identity, OpenTelemetry instrumentation, and optional A2A communication.
- [hexr_tool()](https://docs.hexr.dev/sdk/hexr-tool.md): Returns an authenticated cloud SDK client for any supported service. No API keys in code — credentials are exchanged via SPIFFE identity through a 3-tier cache.
- [hexr_llm()](https://docs.hexr.dev/sdk/hexr-llm.md): Universal LLM observability proxy. Wraps any LLM client with OpenTelemetry tracing — per-agent token counting, cost attribution, and latency histograms.
- [hexr.vault](https://docs.hexr.dev/sdk/vault.md): SPIFFE-native secrets management. No API keys — your cryptographic identity is the authentication. AES-256-GCM encryption at rest, OPA policy enforcement.
- [hexr.gateway](https://docs.hexr.dev/sdk/gateway.md): MCP tool discovery and invocation. Import any OpenAPI spec as MCP tools. Call external APIs with SPIFFE authentication and automatic credential injection from Vault.
- [hexr.sandbox](https://docs.hexr.dev/sdk/sandbox.md): Execute arbitrary code in hardware-isolated Firecracker microVMs. Full Python environment, no SPIFFE access from inside the sandbox.
- [hexr.browser](https://docs.hexr.dev/sdk/browser.md): Headless Chromium browser running inside a Firecracker microVM. Navigate, click, type, screenshot, and extract text — all hardware-isolated.
- [hexr.guard](https://docs.hexr.dev/sdk/guard.md): LLM Guard integration for prompt injection detection, secret scanning, and invisible text detection. Scans prompts and responses automatically or on-demand.
- [hexr.a2a](https://docs.hexr.dev/sdk/a2a.md): Agent-to-Agent communication with JSON-RPC 2.0 protocol. Discover remote agents, send messages, stream responses, and manage task lifecycle — all over mTLS.
- [CLI Overview](https://docs.hexr.dev/cli/overview.md): The hexr CLI takes your agent from Python file to production Kubernetes deployment in three commands.
- [CLI Installation](https://docs.hexr.dev/cli/installation.md): Install the hexr CLI tool.
- [hexr build](https://docs.hexr.dev/cli/build.md): Analyze your Python agent with AST-based discovery. Generates Dockerfile, Kubernetes manifests, SPIFFE process contexts, and A2A artifacts.
- [hexr push](https://docs.hexr.dev/cli/push.md): Build a multi-platform container image, run vulnerability scanning, and push to your container registry.
- [hexr deploy](https://docs.hexr.dev/cli/deploy.md): Deploy your agent to a Kubernetes cluster. Applies generated manifests, waits for pod readiness, and confirms identity establishment.
- [hexr audit](https://docs.hexr.dev/cli/audit.md): Security audit: vulnerability scanning, SBOM generation, and manifest drift detection for your deployed agents.
- [hexr login](https://docs.hexr.dev/cli/login.md): Authenticate with Hexr Cloud to enable cloud builds, deploys, and dashboard access.
- [hexr status](https://docs.hexr.dev/cli/status.md): Show deployed agents with their status, container health, and SPIFFE identity.
- [hexr cache](https://docs.hexr.dev/cli/cache.md): Manage the credential cache — view status, clear cached credentials, and export cache metrics.
- [Platform Overview](https://docs.hexr.dev/platform/overview.md): The Hexr platform runs 10+ services in every agent pod and across the cluster — here is what each one does.
- [PID Mapper](https://docs.hexr.dev/platform/pid-mapper.md): Maps Linux process IDs to SPIFFE identities — enabling per-process credential isolation within a single container.
- [A2A Sidecar](https://docs.hexr.dev/platform/a2a-sidecar.md): Implements the Agent-to-Agent protocol — discovery, task delegation, and inter-agent communication over mTLS.
- [Envoy Proxy](https://docs.hexr.dev/platform/envoy-proxy.md): mTLS sidecar that terminates SPIFFE-authenticated connections and enforces OPA policies on every request.
- [Auto-Registrar](https://docs.hexr.dev/platform/auto-registrar.md): Watches Kubernetes pods for Hexr labels and automatically creates SPIRE registration entries with correct selectors.
- [Credential Injector](https://docs.hexr.dev/platform/credential-injector.md): Exchanges SPIFFE SVIDs for short-lived cloud credentials. The bridge between identity and cloud access.
- [Hexr Vault Service](https://docs.hexr.dev/platform/vault-service.md): Encrypted at-rest secret storage with per-agent SPIFFE-scoped access control.
- [Gateway Service](https://docs.hexr.dev/platform/gateway-service.md): Tool registry and credential-injecting proxy. Connects agents to 150+ external APIs with automatic authentication.
- [Sandbox Engine](https://docs.hexr.dev/platform/sandbox.md): Firecracker microVM-isolated code execution for AI agents. Runs untrusted code safely.
- [LLM Guard](https://docs.hexr.dev/platform/llm-guard.md): Prompt injection detection, PII scanning, and content safety filtering for all LLM interactions.
- [Observability Stack](https://docs.hexr.dev/platform/observability-stack.md): OpenTelemetry Collector, Prometheus, Grafana, and Loki — full observability for every agent, tool call, and LLM interaction.
- [SPIRE](https://docs.hexr.dev/platform/spire.md): SPIFFE Runtime Environment — the identity backbone that issues X.509 SVIDs and JWT-SVIDs to every agent process.
- [Valkey](https://docs.hexr.dev/platform/valkey.md): In-cluster cache for L2 credentials, A2A task state, and tool registry data.
- [Quick Start](https://docs.hexr.dev/guides/quickstart.md): Deploy your first AI agent with Hexr — per-process SPIFFE identity, OPA evidence, and signed audit rows from day one.
- [Build a CrewAI Agent](https://docs.hexr.dev/guides/multi-framework.md): Deploy CrewAI, LangChain, AutoGen, and other framework agents with full Hexr identity and observability.
- [Multi-Cloud Tool Access](https://docs.hexr.dev/guides/multi-cloud-tools.md): Access AWS, GCP, and Azure services from a single agent — no credentials in your code.
- [Agent-to-Agent Communication](https://docs.hexr.dev/guides/agent-to-agent.md): Enable AI agents to discover, delegate tasks, and collaborate using the A2A protocol.
- [LLM Observability](https://docs.hexr.dev/guides/llm-observability.md): Track every LLM call — tokens, costs, latency, and content — with zero-config OpenTelemetry instrumentation.
- [Secure Secrets Management](https://docs.hexr.dev/guides/secure-secrets.md): Store and retrieve secrets with per-agent isolation using SPIFFE identity-scoped access.
- [Code Execution in Sandbox](https://docs.hexr.dev/guides/code-execution.md): Run untrusted code safely in Firecracker microVMs with hexr.sandbox.
- [Browser Automation](https://docs.hexr.dev/guides/browser-agent.md): Give your AI agent a browser for web research, form submission, and visual analysis.