Haldir

Haldir

Scoped permissions, spend caps, an encrypted vault, and an audit log that can prove it wasn't edited — for AI agents that call tools, move money, and read secrets.

That loop is the whole idea, running live. Someone rewrites a row in the audit log — silently, straight in the database. The entry's inclusion proof no longer matches the live Merkle root, and the verdict flips. Not caught by monitoring, not caught by a diff: caught by arithmetic, because the root is a hash of what the log actually contains and the earlier Signed Tree Head is already pinned somewhere you don't control.

→ Try it yourself. Run haldir serve (below) and open http://127.0.0.1:8000/demo — the same tamper demo, against an instance on your own machine. It ships inside the package, so there is nothing to download and no account involved.

What you get

• Scoped sessions — permissions and spend caps per agent, revocable the moment something looks wrong.
• Encrypted vault — AES-256-GCM. Your agent asks for a secret; the model never sees it. Every ciphertext records which key made it, so you can rotate the encryption key without re-entering a single secret — and without downtime.
• Tamper-evident audit — every call logged into an RFC 6962 Merkle tree with signed tree heads, so history can be proven, not just trusted.
• Human approvals — pause a run on a spend threshold and get a webhook.

pip install haldir

haldir serve

That starts a real Haldir on this machine — SQLite, no Docker, no Postgres, no account. It generates an encryption key, applies the schema, mints an API key, and points the CLI at itself, so the next command just works:

$ haldir serve

Haldir is running http://127.0.0.1:8000 data: ~/.haldir

Your API key (saved to the Haldir CLI config): hld_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Try it: haldir overview haldir session create --agent my-agent --scopes read

From there, point anything at it — the CLI, the Python SDK, an MCP client — or read the API reference at /docs on the instance you started. When you want Postgres and containers, haldir init && haldir dev scaffolds and runs that instead; SELF_HOSTING.md covers the rest.

Works with Claude Code, Cursor, LangChain, CrewAI, AutoGen, LlamaIndex and the Vercel AI SDK — anything that can make an HTTP call or speak MCP. MIT licensed: self-host it, or point at haldir.xyz (free tier, no signup).

See it in action

Here's what Haldir actually looks like — no diagrams, no spec sheets, just screenshots of the real thing.

Without Haldir, an agent calls whatever API it wants, spends whatever it wants, and accesses whatever secret it finds — with zero oversight and zero audit trail. With Haldir, every action is scoped, spend-limited, logged immutably, and secrets never leave the vault.

Here's the three things you'd see as a new visitor, in order:

1. Landing page — dark mode, live terminal animation at the top, four product cards (Gate, Vault, Watch, Proxy), a self-host vs cloud comparison, and a call to claim a design partner spot. One page, everything a first-time visitor needs.

1. Cloud dashboard — this is what you see after signing in. A sidebar on the left takes you to any page — account, quotas, sessions, audit, webhooks, approvals, compliance, or settings. The account view shows your tenant, tier, live counts, and API keys by prefix (the full key is never shown again after it's minted, and revoking one never involves a database shell).

1. Audit trail — the killer feature. Filter by session, agent, or tool. Click any row to see the full MCP call details: what tool was called, what upstream API it hit, how long it took, what arguments it sent, and what it returned. This is the one thing that makes the whole product click — you can see exactly what every agent did, when, and with what.

Here's the dashboard with the important parts labeled:

The sidebar on the left takes you anywhere. The numbered markers point at the parts you'll actually use: your tenant and tier, the live counts, and your API keys by prefix — with the revoke button right there, so ending an agent's access never means opening a database shell.

Play with it yourself

All of these ship inside the package and are served by haldir serve, so they work on your machine with no account and nothing to deploy:

→ The tamper demo at /demo/tamper — the one in the GIF above. Rewrite a real log row and watch the inclusion proof stop matching the Merkle root. Nothing is simulated; it is the same Merkle code the API ships.

→ The playground at /demo — four steps walk the happy path (mint a key, open a scoped session, check a permission, write to the audit trail), then three try to break it: spend past the cap, revoke the session mid-flight, and act after revocation. Pick a scope that was never granted in step 03 to see a denial as well as an approval.

→ The gallery at /gallery — every screenshot on this page in one place, if you'd rather look than read.

Want something to run without installing anything? There is a one-file demo binary — no Python, no clone — and a three-probe fixture that ships with the package. Both are in [DEMO.md](DEMO.md): what to run, what you'll see, and what each probe is built to catch.

The rest of the API

The full reference is at /docs and /openapi.json on whichever instance you are running. Below: the Python quickstart, performance numbers, and compliance mapping.

There is a hosted option at [haldir.xyz](https://haldir.xyz) — free tier, no signup. haldir serve is the path that works today, and the one to reach for if the cloud is not what you want anyway.

---

Two ways to run

Same product either way.

The cloud tier is free to start and needs no signup. We're taking 5 design partners — 30 days, full access, direct line to the founder: sterling@haldir.xyz.

Self-host in 5 minutes

git clone https://github.com/ExposureGuard/haldir.git

cd haldir cp .env.example .env python3 -c 'import base64, os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'

paste the output into .env as HALDIR_ENCRYPTION_KEY, then:

docker compose up -d curl http://localhost:8000/healthz

Full self-hosting guide: SELF_HOSTING.md

Cloud (no setup)

pip install haldir

That's it — point at https://haldir.xyz, no signup for the free tier.

---

CLI

Install once, drive the whole platform from the terminal:

$ haldir overview

Haldir tenant overview acct_xyz123 · tier free · 2026-09-30T18:42:11+00:00

Status ● ok API calls 4,217 / 10,000 ████████░░░░░░░░░░░░ 42.2% Spend $ 47.30 this month Sessions 3 active · 1/1 agents Vault 8 secrets · 62 accesses this month Audit 1,847 entries · 0 flagged (7d) · chain ✓ Webhooks 2 registered · 541 deliveries (24h) · 99.82% success Approvals 1 pending

pip install haldir

haldir login # one-time; stashes API key haldir overview --watch # top-style live dashboard haldir status # green/yellow/red component pills haldir ready # exits 0/1, perfect for CI haldir audit trail --agent my-bot # the last N entries haldir audit export --format=jsonl --out audit-2026-04.jsonl haldir audit verify # hash chain integrity check haldir webhooks deliveries # last 20 retry attempts haldir migrate up # apply pending schema migrations

haldir --help lists every command and [CLI.md](CLI.md) is the full reference — what each one does, the flags it takes, and which commands support --json (not all of them do; the reference says which).

---

Why Haldir

AI agents are calling APIs, spending money, and accessing credentials with zero oversight. Haldir is the missing layer:

Everything on the right is one process in front of your tools. Your agent keeps its existing tool calls; Haldir answers first:

---

Quick Start (Python)

from haldir import HaldirClient

The key and URL that haldir serve printed above.

h = HaldirClient(api_key="hld_xxx", base_url="http://127.0.0.1:8000")

Create a governed agent session

session = h.create_session("my-agent", scopes=["read", "spend:50"])

Store secrets agents never see directly

h.store_secret("stripe_key", "sk_live_xxx")

Retrieve with scope enforcement

key = h.get_secret("stripe_key", session_id=session["session_id"])

Authorize payments against budget

h.authorize_payment(session["session_id"], 29.99)

Every action is logged

h.log_action(session["session_id"], tool="stripe", action="charge", cost_usd=29.99)

Revoke when done

h.revoke_session(session["session_id"])

Under the hood that's four HTTP calls — mint a key, open a session, check a permission, write to the audit chain:

---

Products

Gate — Agent Identity & Auth

Scoped sessions with permissions, spend limits, and TTL. No session = no access.

curl -X POST https://haldir.xyz/v1/sessions \

-H "Authorization: Bearer hld_xxx" \ -H "Content-Type: application/json"