> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Overview

> The Hexr platform runs 10+ services in every agent pod and across the cluster — here is what each one does.

## Architecture

Every Hexr agent pod runs as a **bare Kubernetes Pod** (not a Deployment) with these containers:

<Tabs>
  <Tab title="Agent Pod">
    | Container                  | Role                                                              |
    | -------------------------- | ----------------------------------------------------------------- |
    | **init: install-hexr-sdk** | Init container — installs the Hexr SDK into the agent environment |
    | **Agent Container**        | Your code — the agent you wrote and deployed                      |
    | **Envoy Proxy Sidecar**    | mTLS mesh — all outbound traffic encrypted with SPIFFE SVIDs      |
    | **A2A Sidecar**            | Agent-to-agent communication (JSON-RPC 2.0 over mTLS)             |
    | **PID Mapper**             | Maps host PIDs to SPIFFE identities for per-process attestation   |
  </Tab>

  <Tab title="Cluster Services">
    | Service                  | Purpose                                                   |
    | ------------------------ | :-------------------------------------------------------- |
    | **SPIRE Server + Agent** | Certificate authority + per-node workload attestation     |
    | **Auto-Registrar**       | Watches for hexr pods, creates SPIRE registration entries |
    | **Credential Injector**  | Exchanges SPIFFE SVIDs for short-lived cloud credentials  |
    | **Hexr Vault**           | SPIFFE-native secret storage (AES-256-GCM)                |
    | **Hexr Gateway**         | Tool proxy — routes `hexr_tool()` calls to external APIs  |
    | **Sandbox Engine**       | Firecracker microVM code execution                        |
    | **LLM Guard**            | Prompt/response scanning (injection, PII, secrets)        |
    | **Valkey (Redis)**       | 3-node HA — credential cache + A2A task state             |
    | **OTel Collector**       | Telemetry aggregation (traces, metrics, logs)             |
    | **OPA**                  | Policy enforcement sidecar (per pod)                      |
  </Tab>
</Tabs>

```
Agent Container → Envoy Proxy → Credential Injector / Gateway / Vault
Agent Container → A2A Sidecar
PID Mapper → SPIRE Agent/Server
Auto-Registrar → SPIRE Server
All services → OTel Collector → Grafana
```

***

## Pod Containers

| Container                                    | Purpose                                         | Port  |
| -------------------------------------------- | ----------------------------------------------- | ----- |
| [Agent Container](/platform/agent-container) | Your Python code + Hexr SDK                     | —     |
| [Envoy Proxy](/platform/envoy-proxy)         | mTLS termination, traffic routing, OPA sidecall | 15001 |
| [A2A Sidecar](/platform/a2a-sidecar)         | Agent-to-agent protocol handler                 | 8090  |
| [PID Mapper](/platform/pid-mapper)           | Per-process identity → SPIRE registration       | —     |

***

## Cluster Services

| Service                                              | Purpose                                          | Docs                               |
| ---------------------------------------------------- | ------------------------------------------------ | ---------------------------------- |
| [SPIRE](/platform/spire)                             | SPIFFE identity issuance (X.509 SVIDs)           | [→](/platform/spire)               |
| [Auto-Registrar](/platform/auto-registrar)           | Watches pods, creates SPIRE registration entries | [→](/platform/auto-registrar)      |
| [Credential Injector](/platform/credential-injector) | SPIFFE → cloud credentials (STS exchange)        | [→](/platform/credential-injector) |
| [Hexr Vault](/platform/vault-service)                | Encrypted secret storage (AES-256-GCM)           | [→](/platform/vault-service)       |
| [Hexr Gateway](/platform/gateway-service)            | Tool registry + credential-injecting proxy       | [→](/platform/gateway-service)     |
| [Sandbox Engine](/platform/sandbox)                  | Firecracker-isolated code execution              | [→](/platform/sandbox)             |
| [LLM Guard](/platform/llm-guard)                     | Prompt/response security scanning                | [→](/platform/llm-guard)           |
| [Valkey](/platform/valkey)                           | In-cluster cache (L2 credentials, A2A tasks)     | [→](/platform/valkey)              |
| [OTel Collector](/platform/observability-stack)      | Telemetry pipeline (traces, metrics, logs)       | [→](/platform/observability-stack) |