[racerxdl]

Description

The Hoop Tunnel page showed connection examples using real database usernames:

psql -h pg-prod.hoop -U readonly
mysql -h mysql-staging.hoop -u app -p

Neither works. Every database reached through the tunnel uses the fixed noop/noop placeholder — the agent completes the client's login locally and authenticates upstream with the credentials stored on the connection. The page never mentioned this, so a reader following it would fail to connect and have no idea why.

Companion to hoophq/hoop#1722 and hoophq/hsh#33, which make hsh tunnel ls print these credentials with a ready-to-paste command per connection.

Changes

• New ## Credentials section — the placeholders, sample hsh tunnel ls output, GUI-client guidance, and the two exceptions that carry no credentials (raw TCP relays bytes untouched; HTTP proxy authorization is injected as headers by the agent).
• Corrected the intro and Getting Started examples to commands that actually connect.
• Scope warning — noop/noop works only through a local Hoop listener (the tunnel or hoop connect). It is explicitly not the credential for native database access, which uses a per-user secret key that expires, can be revoked, and rejects noop. This distinction is the main thing the page was missing.
• Oracle visibility — noted that Oracle connections appear only when native Oracle access is enabled, since the agent otherwise refuses the session.
• Two troubleshooting entries — "The database rejects my login", and Oracle gating added to the missing-connection entry.
• Command reference — hsh tunnel ls now described as listing credentials too.

Testing

npx mint broken-links — the one reported break (/api-reference in concepts/agents.mdx) is pre-existing and reproduces on a clean tree.

Anchors verified: ## Credentials → #credentials, referenced twice on the page.

Notes

I did not link the native-access mention to a page, because there isn't one that documents the secret-key flow — creating-resource-roles covers configuring resources, not obtaining credentials. Described it in prose instead rather than point somewhere misleading. Worth a follow-up page if that flow deserves its own docs.

Automated by MisterMal

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
hoopdev	🟢 Ready	View Preview	Aug 18, 2026, 1:24 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[netlify]

✅ Deploy Preview for decap-documentation ready!

Name	Link
🔨 Latest commit	e865f30
🔍 Latest deploy log	https://app.netlify.com/projects/decap-documentation/deploys/6a845c8f204cc900083a02d7
😎 Deploy Preview	https://deploy-preview-165--decap-documentation.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[qodo-code-review]

PR Summary by Qodo

Document Hoop Tunnel credentials and connection exceptions

📝 Documentation 🕐 10-20 Minutes

AI Description

• Documents fixed noop credentials and distinguishes tunnel authentication from native database
 access.
• Corrects CLI examples and explains ready-to-paste connection commands.
• Adds protocol exceptions, Oracle gating, shared-host warnings, and login troubleshooting.

Diagram

sequenceDiagram
  actor User
  participant HSH as hsh CLI
  participant Client as DB Client
  participant Tunnel as Hoop Tunnel
  participant Gateway as Hoop Gateway
  participant Agent as Hoop Agent
  participant DB as Database
  User->>HSH: List connections
  HSH-->>User: Command with noop
  User->>Client: Run command
  Client->>Tunnel: Login with noop
  Tunnel->>Gateway: Authenticated session
  Gateway->>Agent: Forward connection
  Agent->>DB: Use stored credentials
  DB-->>Client: Proxied response

Loading

High-Level Assessment

A dedicated credentials section with corrected examples and contextual cross-references is the best approach. Scattering the guidance only beside commands would duplicate nuanced rules, while linking to native-access documentation is inappropriate because no accurate page currently covers that credential flow.

Files changed (1) +87 / -11

Documentation (1) +87 / -11

hsh-tunnel.mdxDocument tunnel credentials and correct connection guidance +87/-11

Document tunnel credentials and correct connection guidance

• Adds a dedicated credentials section explaining fixed 'noop' placeholders, upstream authentication, raw TCP and HTTP proxy exceptions, native-access differences, and shared-host risk. Corrects database commands, expands 'hsh tunnel ls' output and command-reference guidance, documents Oracle gating, and adds credential troubleshooting.

clients/hsh-tunnel.mdx

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗