Summary

Fast enough to sit in the hot path, and it publishes the numbers.

The primitives are cheap — secret encrypt and decrypt and audit hash computation all measured under 10 microseconds in-process — while a full governed-tool envelope over REST lands around 100-250 ms, against the 500-3000 ms an agent already waits on a model completion. That framing is the argument: the overhead disappears into noise the agent was already producing. The audit chain signs itself, so an archived compliance pack can be re-verified against the live manifest.

What it is

An open-source control plane for AI agents, with an MCP server as one of its faces. It issues scoped sessions, holds secrets encrypted with AES-256-GCM, authorizes spend against per-session budgets, and writes every action into a tamper-evident audit chain. Self-host it or use the hosted service at haldir.xyz.

What you get

Agent sessions with scopes, spend limits and a TTL, revocable at any time, plus permission checks against them — `createSession`, `getSession`, `revokeSession`, `checkPermission`
Secret storage and scoped retrieval, so credentials are fetched under a session's authority rather than sitting in the model's context — `storeSecret`, `getSecret`
Payment authorization against a session's budget — `authorizePayment`
The audit side: log an action, query the trail, and read spend totals — `logAction`, `getAuditTrail`, `getSpend`
Beyond MCP: a proxy that registers upstream MCP servers and intercepts every call for policy enforcement, human approval rules that pause execution for review, and a compliance evidence pack covering eight sections mapped to SOC2 criteria
A CLI over the whole platform — a live overview, `haldir ready` for CI, audit tail and export, and `haldir audit verify` for hash chain integrity

Requirements

An API key as `HALDIR_API_KEY` for the hosted service. Install with `pip install haldir` — the package is `haldir` (0.3.0 in pyproject) — and the MCP entry point is the `haldir-mcp` command over stdio; there is also an HTTP endpoint at https://haldir.xyz/mcp. Self-hosting needs Docker Compose, an API service plus Postgres, and a base64 32-byte `HALDIR_ENCRYPTION_KEY` in `.env`; Postgres is enabled with `DATABASE_URL`. MIT licensed.

Setup effort

One command plus a key — pip install haldir, then supply credentials

Haldir