Haldir

Haldir — The Guardian Layer for AI Agents

The open-source governance layer for AI agents.Identity, secrets, audit, and policy enforcement — MIT licensed, self-host or use our cloud.

Haldir enforces governance on every AI agent tool call: scoped sessions with spend caps, encrypted secrets the model never sees, hash-chained tamper-evident audit trail, human-in-the-loop approvals, and a proxy that intercepts every MCP call before it reaches your tools. Native SDKs for LangChain, CrewAI, AutoGen, and Vercel AI SDK.

$ haldir overview Haldir tenant overview acct_xyz123 · tier pro · 2026-04-19T18:42:11+00:00 Status ● ok Actions 4,217 / 50,000 ████░░░░░░░░░░░░░░░░ 8.4% Spend $ 47.30 this month Sessions 12 active · 3/10 agents Vault 8 secrets · 62 accesses this month Audit 1,847 entries · 0 flagged (7d) · chain ✓ Webhooks 2 registered · 541 deliveries (24h) · 99.82% success Approvals 1 pending

Install once, drive the whole platform from the terminal:

pip install haldir haldir login # one-time; stashes API key haldir overview --watch # top-style live dashboard haldir status # green/yellow/red component pills haldir ready # exits 0/1, perfect for CI haldir audit tail --agent my-bot # the last N entries haldir audit export --format=jsonl --out audit-2026-04.jsonl haldir audit verify # hash chain integrity check haldir webhooks deliveries # last 20 retry attempts haldir migrate up # apply pending schema migrations

Every command takes--jsonfor scripts.haldir --helpfor the full surface.

git clone https://github.com/ExposureGuard/haldir.git cd haldir cp .env.example .env python3 -c 'import base64, os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())' # paste the output into .env as HALDIR_ENCRYPTION_KEY, then: docker compose up -d curl http://localhost:8000/health

Full self-hosting guide:SELF_HOSTING.md

Live now:haldir.xyz·API Docs·OpenAPI Spec·Smithery

🧪Now accepting 5 design partners.30 days free, full access, direct line to the founder. If you're shipping AI agents to production, emailsterling@haldir.xyz.

# Concurrent HTTP throughput (launches a local gunicorn, ~60s total) python bench/bench_http.py --duration 10 --concurrency 32 --workers 4 # Primitive cost only (no API key needed) python bench/bench_primitives.py --local # End-to-end against the hosted service export HALDIR_API_KEY=hld_... python bench/bench_primitives.py

haldir compliance evidence --since 2026-01-01 --out evidence-q1-2026.md

from sdk.client import HaldirClient h = HaldirClient(api_key="hld_xxx", base_url="https://haldir.xyz") # Create a governed agent session session = h.create_session("my-agent", scopes=["read", "spend:50"]) # Store secrets agents never see directly h.store_secret("stripe_key", "sk_live_xxx") # Retrieve with scope enforcement key = h.get_secret("stripe_key", session_id=session["session_id"]) # Authorize payments against budget h.authorize_payment(session["session_id"], 29.99) # Every action is logged h.log_action(session["session_id"], tool="stripe", action="charge", cost_usd=29.99) # Revoke when done h.revoke_session(session["session_id"])

Scoped sessions with permissions, spend limits, and TTL. No session = no access.

curl -X POST https://haldir.xyz/v1/sessions \ -H "Authorization: Bearer hld_xxx" \ -H "Content-Type: application/json" \ -d '{"agent_id": "my-bot", "scopes": ["read", "browse", "spend:50"], "ttl": 3600}'

Vault — Encrypted Secrets & Payments

AES-encrypted storage. Agents request access; Vault checks session scope. Payment authorization with per-session budgets.

curl -X POST https://haldir.xyz/v1/secrets \ -H "Authorization: Bearer hld_xxx" \ -H "Content-Type: application/json" \ -d '{"name": "api_key", "value": "sk_live_xxx", "scope_required": "read"}'

Immutable log for every action. Anomaly detection. Cost tracking. Compliance exports.

curl https://haldir.xyz/v1/audit?agent_id=my-bot \ -H "Authorization: Bearer hld_xxx"

Sits between agents and MCP servers. Every tool call is intercepted, authorized, and logged. Supports policy enforcement: allow lists, deny lists, spend limits, rate limits, time windows.

# Register an upstream MCP server curl -X POST https://haldir.xyz/v1/proxy/upstreams \ -H "Authorization: Bearer hld_xxx" \ -H "Content-Type: application/json" \ -d '{"name": "myserver", "url": "https://my-mcp-server.com/mcp"}' # Call through the proxy — governance enforced curl -X POST https://haldir.xyz/v1/proxy/call \ -H "Authorization: Bearer hld_xxx" \ -H "Content-Type: application/json" \ -d '{"tool": "scan_domain", "arguments": {"domain": "example.com"}, "session_id": "ses_xxx"}'

Pause agent execution for human review. Webhook notifications. Approve or deny from dashboard or API.

# Require approval for spend over $100 curl -X POST https://haldir.xyz/v1/approvals/rules \ -H "Authorization: Bearer hld_xxx" \ -H "Content-Type: application/json" \ -d '{"type": "spend_over", "threshold": 100}'

Haldir is available as an MCP server with 10 tools for Claude, Cursor, Windsurf, and any MCP-compatible AI:

{ "mcpServers": { "haldir": { "command": "haldir-mcp", "env": { "HALDIR_API_KEY": "hld_xxx" } } } }

MCP Tools:createSession,getSession,revokeSession,checkPermission,storeSecret,getSecret,authorizePayment,logAction,getAuditTrail,getSpend

MCP HTTP Endpoint:POST https://haldir.xyz/mcp

Agent (Claude, GPT, Cursor, etc.) │ ▼ ┌─────────────────────────────┐ │ Haldir Proxy │ ← Intercepts every tool call │ Policy enforcement layer │ └──────┬──────────┬───────────┘ │ │ ┌────▼────┐ ┌───▼────┐ │ Gate │ │ Watch │ │identity │ │ audit │ │sessions │ │ costs │ └────┬────┘ └────────┘ │ ┌────▼────┐ │ Vault │ │secrets │ │payments │ └────┬────┘ │ ▼ Upstream MCP Servers (your actual tools)

Haldir is discoverable through every major protocol:

- Website:haldir.xyz
- API Docs:haldir.xyz/docs
- Smithery:View on Smithery
- PyPI:haldir
- OpenAPI:haldir.xyz/openapi.json

MCP server for AI-native Identity Verification & Anti-Fraud