UC Launch Spring 2026 · Enterprise Preview

Audit-Grade Evidence for AI Agents — In Your Cluster

Your FFIEC, SOC 2, HIPAA, or FedRAMP auditor will ask what your AI agents did, who authorized it, and where the evidence lives. Hexr puts signed, control-mapped evidence rows into your own Postgres — per process, per agent call, any framework. Nothing leaves your VPC.

Any FrameworkAny Agentic PatternSub-Agent SPIFFE IdentityCross-Cloud Trust PolicyA2A ProtocolSOC 2 · HIPAA · FedRAMP ReadyEvidence Stays in Your VPC
Book an Auditor Demo

Per-Process

SPIFFE Identity

Customer-Owned

Evidence in Your Postgres

Auditor-Mapped

SOC 2 · HIPAA · IL5 Controls

Like Iru for audit maps · Like CrowdStrike for per-process attestation · Like Datadog for OTel spans. Built for the auditor, not the SRE.

Built on Open Standards

SPIFFE
CNCF
Kubernetes
OpenTelemetry
Envoy
OPA

Live Demos — Real Clusters, Real Evidence

EKS (Acme) and AKS (Globex) are running right now. Pick a scenario.

A CrewAI agent attempts a tool call. OPA fails it closed. Hexr writes a signed evidence row tagged SOC 2 CC6.1 and NIST-SSDF PW.4 into the customer's own Postgres on EKS. The auditor sees the deny, the policy version, and the SPIFFE identity of the process that triggered it.

Built for the Auditor and the Engineer

FFIEC, SOC 2, HIPAA, FedRAMP IL5 — every capability maps to a control your auditor recognises. Identity flows into policy, policy fires OPA, OPA writes a signed evidence row, evidence rows produce the PDF.

Per-Process Identity

Unique SPIFFE IDs per process inside containers, not just pods. Pure userspace, no kernel modifications.

Tamper-Evident Evidence

Every evidence row is hash-chained to the one before it. Edit, delete or reorder a single row and verification breaks at exactly that row. Your auditor checks it themselves with one API call — no need to trust us, or your own DBA.

Signed by an Attested Process

Each row is signed inside the emitting agent with the private key of its SPIRE-issued X.509-SVID, so it is bound to the process the kernel named — not to whoever holds database access. Signing has to happen inside the process, which is why it needs an SDK and why a gateway cannot do it.

Agentless Discovery

Finds every agent process running in your cluster, attests its binary, and tells you which ones are producing audit-grade evidence and which ones are dark. No code change required to see them — a gateway only finds the agents already routed through it.

CLI Pipeline

Source-to-deployment in three commands. Auto-generates container images, K8s configs, identity mappings from your code.

Credential Cache

Multi-level cache: in-process (<1ms), distributed cluster (1-3ms), cloud exchange. Proactive background refresh. Per-process isolation. Zero-latency hexr_tool() calls.

Cross-Cloud Trust Policy

SPIFFE identities federate to AWS IAM, GCP Workload Identity, and Azure AD without static credentials. Per-tenant Terraform modules and a `hexr trust-policy` CLI provision the cloud-side trust in one command.

Policy Engine

OPA Rego policies at every service boundary. Fail-closed enforcement. GitOps-driven. Full decision audit logging.

A2A Protocol

Purpose-built agent-to-agent communication. Durable task state, cooperative cancellation, real-time streaming, all over mTLS. Our own protocol, not a wrapper.

Vault

SPIFFE-native secrets. Zero API keys. AES-256-GCM encryption. Tenant + agent + path isolation via OPA.

LLM Observability

Complements existing LLM observability tools by adding the identity layer they lack. Per-process SPIFFE-attributed traces, per-agent cost tracking, and full OpenTelemetry spans any platform can consume.

Framework Detection

AST-based engine detects agents across any Python framework: CrewAI, LangChain, Strands, or custom. Zero configuration.

Gateway

Converts OpenAPI v3 specs to MCP tools automatically. SPIFFE-authenticated tool invocations with semantic search.

Your Cluster, Your PKI

One source-available SDK (HSAL v1) drops into any framework on your own Kubernetes (EKS, GKE Standard, AKS, or on-prem). Everything runs in your cluster; the only outbound traffic is a five-integer heartbeat. Choose who signs your intermediate CA: Hexr's control plane, or your own HashiCorp Vault PKI so we never touch your signing root. Same evidence schema and auditor PDF either way.

Topology Analysis

AST-based pattern detection at build time. Orchestrated, hierarchical, peer-to-peer, or mixed topologies identified automatically from source.

Audit-Ready Policies

Pre-built OPA/Rego templates mapped to SOC 2 Type II, NIST 800-53, HIPAA §164.312, ISO 27001, and EU AI Act. Deploy entire control frameworks in one Helm value.

One SDK. Your Cluster.

Hexr is not a SaaS platform you send data to. Everything — agent pods, evidence Postgres, policy engine, identity server — runs inside your own Kubernetes cluster, installed with Helm. The SDK is source-available under HSAL v1, with the same three decorators on every framework. The one real choice is who signs the intermediate CA inside your cluster.

The SDK, and why you can trust it

Signing has to happen inside the process. That is the whole reason an SDK exists — you cannot prove what a process did from outside it. So the SDK sits in your agent's critical path, and you should interrogate it before it goes there.

Three symbols, no framework patching

@hexr_agent, hexr_llm() and hexr_tool(). That is the entire integration surface.

hexr_tool("aws_s3") returns the native boto3 client — not a wrapper, not a proxy. Every API, every signature, every exception is unchanged. What changes is where the credentials come from: a short-lived exchange against your agent's SPIFFE identity, instead of static keys.

Nothing monkey-patches your agent framework.

Source-available, under licence

The SDK is proprietary and source-available. Design partners get full read access under licence, so a security review happens before anything reaches a critical path. That is the right order.

It is not on public PyPI. Production access is gated behind registry IAM.

We scan our own code, and publish what we find

Every push runs dependency auditing, static analysis and secret scanning across Python, Go, Rust and Node — and fails the build on a finding. A scan nobody must act on is a dashboard, not a control.

Outstanding issues are written down publicly rather than carried quietly. A security product that hides its own dependency debt has no standing to ask anyone to trust it.

How to remove it — an afternoon

Swap hexr_tool("aws_s3") back to boto3.client("s3"), unwrap the LLM client, delete the decorator, drop the dependency. Your business logic is never touched, because the SDK never wrapped it.

You lose per-process identity, signed evidence, control mapping and pre-execution policy decisions — everything that depends on being inside the process. Evidence already written stays yours and stays verifiable: it lives in your cluster, not ours.

Why we publish the exit. Lock-in is the first objection to a proprietary SDK in a critical path, and pretending otherwise does not make it go away. The exit here is genuinely cheap, so we would rather you knew. Stay because the evidence is worth having — not because leaving is hard.

The Honest Comparison

Against the two most distribution-rich agent-governance platforms. Hexr is not a replacement for AgentCore or Agent 365 — it's the per-process evidence layer regulated buyers need that neither hyperscaler can ship from their own cloud.

DimensionAWS AgentCoreMS Agent 365Hexr
Runs on any K8s (EKS / GKE / AKS / on-prem)AWS onlyMicrosoft cloud only
You hold the signing root (BYO Vault PKI)
Per-process host attestation (SPIFFE + hostPID)Pod-level onlyDevice / endpointPer process
Catches forked / unattested binary
Sub-agent SPIFFE identity
Evidence stays in customer VPCSent to AWSSent to Microsoft
Auditor-mapped (SOC 2 / HIPAA / NIST / OWASP ASI)Generic CloudTrailGeneric admin logs
BYO Root CA (Vault PKI)
Framework-agnostic instrumentationSDK contractPer-vendor SDC integrationBelow the framework
A2A mTLS between agents
Open standards (SPIFFE, OPA, OTel)ProprietaryProprietary

AgentCore on EKS, ADK on GKE, or Copilot Studio on Microsoft 365? Keep them. Hexr installs in the same cluster (or as a customer-hosted evidence-api alongside a managed runtime) and produces the auditor-mapped, per-process evidence trail none of them can.

UC LaunchSpring 2026 Cohort

Book a 15-Minute Auditor Demo

Your auditor has five questions about your AI agents. Watch Hexr answer all five — signed evidence rows, per-process SPIFFE identity, OPA deny, BYO Vault chain, and the auditor PDF — in 15 minutes flat.

No credit card required. Early access for qualified teams.