Skip to main content

​
What It Does

The Hexr Gateway is the single entry point for all external tool calls. When an agent calls hexr_tool("aws_s3", ...), the request flows through the Gateway, which:
  1. Resolves the tool name to an API endpoint
  2. Injects credentials from the Credential Injector
  3. Forwards the authenticated request to the target service
  4. Records telemetry (spans, metrics) for observability

​
Tool Registration

Tools are registered via three mechanisms:

​
Pre-loaded Tools

​
Request Flow

1

Agent calls hexr_tool()

Your agent calls hexr_tool("aws_s3") which invokes s3.list_buckets(). The request goes to the Gateway via Envoy.
2

Gateway resolves tool

The Gateway resolves aws_s3 to the S3 endpoint and validates the request.
3

Credential exchange

The Gateway calls the Credential Injector to exchange the caller’s SPIFFE identity for temporary AWS credentials.
4

API call with credentials

The Gateway calls ListBuckets on the S3 API using SigV4 signing with the temporary credentials.
5

Response with telemetry

The API response is returned to the agent. A telemetry span is recorded for the entire request lifecycle.

​
API Endpoints

​
Configuration

​
Image