ExposureGuard/haldir

**Scoped permissions, spend caps, an encrypted vault, and an audit log that can prove it wasn't edited — for AI agents that call tools, move money, and read secrets.**
That loop is the whole idea, running live. Someone rewrites a row in the audit log — silently, straight in the database. The entry's inclusion proof no longer matches the live Merkle root, and the verdict flips. Not caught by monitoring, not caught by a diff: caught by arithmetic, because the root is a hash of what the log actually contains and the earlier Signed Tree Head is already pinned somewhere you don't control.
→ **Try it yourself.** Run haldir serve (below) and open **http://127.0.0.1:8000/demo** — the same tamper demo, against an instance on your own machine. It ships inside the package, so there is nothing to download and no account involved.
What you get
- **Scoped sessions** — permissions and spend caps per agent, revocable the moment something looks wrong.
- **Encrypted vault** — AES-256-GCM. Your agent asks for a secret; the model never sees it. Every ciphertext records which key made it, so you can **rotate the encryption key** without re-entering a single secret — and without downtime.
- **Tamper-evident audit** — every call logged into an RFC 6962 Merkle tree with signed tree heads, so history can be proven, not just trusted.
- **Human approvals** — pause a run on a spend threshold and get a webhook.
That starts a real Haldir on this machine — SQLite, no Docker, no Postgres, no account. It generates an encryption key, applies the schema, mints an API key, and points the CLI at itself, so the next command just works:
From there, point anything at it — the CLI, the Python SDK, an MCP client — or read the API reference at /docs on the instance you started. When you want Postgres and containers, haldir init && haldir dev scaffolds and runs that instead; SELF_HOSTING.md covers the rest.
Works with Claude Code, Cursor, LangChain, CrewAI, AutoGen, LlamaIndex and the Vercel AI SDK — anything that can make an HTTP call or speak MCP. MIT licensed: self-host it, or point at haldir.xyz (free tier, no signup).
See it in action
Here's what Haldir actually looks like — no diagrams, no spec sheets, just screenshots of the real thing.
Without Haldir, an agent calls whatever API it wants, spends whatever it wants, and accesses whatever secret it finds — with zero oversight and zero audit trail. With Haldir, every action is scoped, spend-limited, logged immutably, and secrets never leave the vault.
Here's the three things you'd see as a new visitor, in order:
1. **Landing page** — dark mode, live terminal animation at the top, four product cards (Gate, Vault, Watch, Proxy), a self-host vs cloud comparison, and a call to claim a design partner spot. One page, everything a first-time visitor needs.
2. **Cloud dashboard** — this is what you see after signing in. A sidebar on the left takes you to any page — account, quotas, sessions, audit, webhooks, approvals, compliance, or settings. The account view shows your tenant, tier, live counts, and API keys by prefix (the full key is never shown again after it's minted, and revoking one never involves a database shell).
3. **Audit trail** — the killer feature. Filter by session, agent, or tool. Click any row to see the full MCP call details: what tool was called, what upstream API it hit, how long it took, what arguments it sent, and what it returned. This is the one thing that makes the whole product click — you can see exactly what every agent did, when, and with what.
Here's the dashboard with the important parts labeled:
The sidebar on the left takes you anywhere. The numbered markers point at the parts you'll actually use: your tenant and tier, the live counts, and your API keys by prefix — with the revoke button right there, so ending an agent's access never means opening a database shell.
Play with it yourself
All of these ship inside the package and are served by haldir serve, so they work on your machine with no account and nothing to deploy: