Haldir MCP server

<!-- mcp-name: io.github.ExposureGuard/haldir -->

Haldir

Scoped permissions, spend caps, an encrypted vault, and an audit log that can prove it wasn't edited — for AI agents that call tools, move money, and read secrets.

That loop is the whole idea, running live. Someone rewrites a row in the audit log — silently, straight in the database. The entry's inclusion proof no longer matches the live Merkle root, and the verdict flips. Not caught by monitoring, not caught by a diff: caught by arithmetic, because the root is a hash of what the log actually contains and the earlier Signed Tree Head is already pinned somewhere you don't control.

→ Try it yourself. Run haldir serve (below) and open http://127.0.0.1:8000/demo — the same tamper demo, against an instance on your own machine. It ships inside the package, so there is nothing to download and no account involved.

What you get

• Scoped sessions — permissions and spend caps per agent, revocable the moment something looks wrong.
• Encrypted vault — AES-256-GCM. Your agent asks for a secret; the model never sees it. Every ciphertext records which key made it, so you can rotate the encryption key without re-entering a single secret — and without downtime.
• Tamper-evident audit — every call logged into an RFC 6962 Merkle tree with signed tree heads, so history can be proven, not just trusted.
• Human approvals — pause a run on a spend threshold and get a webhook.

pip install haldir
haldir serve

That starts a real Haldir on this machine — SQLite, no Docker, no Postgres, no account. It generates an encryption key, applies the schema, mints an API key, and points the CLI at itself, so the next command just works:

$ haldir serve

  Haldir is running  http://127.0.0.1:8000
  data: ~/.haldir

  Your API key (saved to the Haldir CLI config):
    hld_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

  Try it:
    haldir overview
    haldir session create --agent my-agent --scopes read

From there, point anything at it — the CLI, the Python SDK, an MCP client — or read the API reference at /docs on the instance you started. When you want Postgres and containers, haldir init && haldir dev scaffolds and runs that instead; SELF_HOSTING.md covers the rest.

Works with Claude Code, Cursor, LangChain, CrewAI, AutoGen, LlamaIndex and the Vercel AI SDK — anything that can make an HTTP call or speak MCP. MIT licensed: self-host it, or point at haldir.xyz (free tier, no signup).

See it in action

Here's what Haldir actually looks like — no diagrams, no spec sheets, just screenshots of the real thing.

Without Haldir, an agent calls whatever API it wants, spends whatever it wants, and accesses whatever secret it finds — with zero oversight and zero audit trail. With Haldir, every action is scoped, spend-limited, logged immutably, and secrets never leave the vault.

Here's the three things you'd see as a new visitor, in order:

Shortened. The full README is on GitHub.