Haldir

Guardian layer for AI agents: identity, secrets, audit.

Connector by ExposureGuard · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 4

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/exposureguard-haldir

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Guardian layer for AI agents: identity, secrets, audit via MCP.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools: 14 read · 3 write · 1 delete · 2 not yet classified
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Tools by what they do 20

Read from the source code; the running server may list different tools.

Read 14 · Look things up without changing anything.

haldir_check_permission
haldir_compliance_score
haldir_get_approval_status
haldir_get_audit
haldir_get_consistency_proof
haldir_get_inclusion_proof
haldir_get_secret
haldir_get_session
haldir_get_spend
haldir_get_tree_head
haldir_list_secrets
haldir_log_audit_action

Show 2 more tools

haldir_query_audit_trail
haldir_verify_audit_chain

Write 3 · Create, change, send or run things.

haldir_build_evidence_pack
haldir_create_session
haldir_store_secret

Delete 1 · Delete, drop, revoke or wipe things.

haldir_revoke_session

Not yet classified 2 · We could not tell from the name and description.

haldir_authorize_payment
haldir_request_approval

Files it touches

/tmp/haldir_capture.db
/tmp/haldir_hero
Your home directory (~)
~/.haldir/haldir.db

Tools (20)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

haldir_authorize_payment
Authorize a payment against an agent session's spend budget. The amount is deducted from the session's remaining budget if sufficient funds exist. If the payment would exceed the budget, it is denied. Every authorization is logged to the audit trail for full financial accountability.
haldir_build_evidence_pack
Build a signed audit-prep evidence pack for a given period. Returns JSON with all eight evidence sections + SHA-256 document signature.
haldir_check_permission
Check whether a specific session has a given permission scope. Returns a boolean indicating if the action is allowed. Use this before performing any sensitive operation to enforce least-privilege access control without risking a 403 error on the actual call.
haldir_compliance_score
Get the tenant's live audit-prep readiness score (0-100) with per-criterion pass/warn/fail + remediation hints. Criteria are relevant to SOC2 Trust Services Criteria (CC5.2, CC6.1, CC6.7, CC7.2, CC7.3, CC8.1) but this is NOT a SOC2 attestation.
haldir_create_session
Create a new agent session with scoped permissions and an optional spend budget. Every AI agent must have an active session before it can access secrets, make payments, or perform auditable actions. You specify which scopes (e.g. read, write, admin) the agent is allowed, a TTL in seconds, and an optional USD spend limit.
haldir_get_approval_status
Check the current status of an approval request. Takes the request_id that haldir_request_approval returned. `approval_id` is accepted as an alias for callers written against the old name.
haldir_get_audit
Get the audit trail for this agent's actions.
haldir_get_consistency_proof
Prove the tree of size `second` is an append-only extension of the tree of size `first`. Same primitive Certificate Transparency uses to detect forks in the global WebPKI log.
haldir_get_inclusion_proof
Get an RFC 6962 inclusion proof for a specific audit entry. Returns audit_path + root_hash + STH that an auditor can verify offline — no trust in the server needed.
haldir_get_secret
Retrieve a decrypted secret from the Vault. If a session_id is provided, the session's scopes are checked against the secret's required scope before returning the value. This is the primary way agents access credentials — through policy-controlled, auditable retrieval.
haldir_get_session
Retrieve the current state of an agent session including its scopes, spend budget, remaining balance, and validity status. Use this to check whether a session is still active before performing privileged operations, or to inspect how much budget remains.
haldir_get_spend
Get a summary of total spend across agent sessions, broken down by session or agent. Returns total USD spent, number of transactions, and budget utilization. Use this to monitor cost control and detect runaway spending before budgets are exhausted.
haldir_get_tree_head
Get the current Signed Tree Head (STH) for the tenant's audit log. Returns tree_size, root_hash, signed_at, and HMAC signature. Auditors pin the STH and demand inclusion proofs against it later.
haldir_list_secrets
List all secret names in this tenant's vault (values never leak).
haldir_log_audit_action
Log an agent action to the tamper-evident audit trail with automatic anomaly detection. Every tool call, API request, or decision an agent makes should be logged here. The Watch module automatically flags suspicious patterns like rapid-fire actions, high-cost operations, or unusual tool usage. Returns whether the action was flagged.

Show 5 more tools

haldir_query_audit_trail
Query the audit trail to review all actions taken by agents. Filter by session ID, agent ID, tool name, or flagged-only entries. Returns a chronological list of logged actions with their costs, timestamps, and anomaly flags. Essential for compliance reviews and debugging agent behavior.
haldir_request_approval
Request human-in-the-loop approval for a risky action. Returns a request_id; pass that to haldir_get_approval_status, or wait for a webhook, until the status becomes 'approved' or 'denied'.
haldir_revoke_session
Immediately revoke an agent session, permanently disabling all permissions and blocking further actions under that session. Use this when an agent misbehaves, exceeds its mandate, or when a task is complete and the session should be cleaned up for security hygiene.
haldir_store_secret
Store an encrypted secret in the Haldir Vault with an optional scope requirement. Secrets are encrypted at rest using AES and can only be retrieved by sessions that hold the required scope. Use this to safely store API keys, tokens, credentials, or any sensitive data that agents need access to.
haldir_verify_audit_chain
Verify the SHA-256 hash chain end-to-end for this tenant's log.

Signals

Stars: 4
Forks: 1
Open issues: 3
Weekly downloads: 44
Last commit: Oct 4, 2026 (25 days ago)
Last release: Oct 3, 2026 (26 days ago)
Last package publish: Oct 3, 2026 (26 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name: io.github.ExposureGuard/haldir
Version: 0.1.0
Auth: No auth
Packages: pypi haldir
License: MIT
Repository: github.com/ExposureGuard/haldir
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql