Helio enforces policy on MCP tool calls before they reach your servers. Set spend limits, require evidence or approval, and keep an audit trail. No agent or server code changes.
Step through one MCP tool call and see what Helio checks before it reaches the server.
policies:
rules:
- match:
tool: process_refund
input:
"$.amount": { gt: 1000 }
action: denyrequires [orders.lookup] depends process_refund ← lookup grounding idle
baseline frozen on_tool_drift block diff none
ChatGPT 
Claude 
Cursor 
LangChain 
LangGraph 
CrewAI 
AutoGen 
PydanticAI 
LlamaIndex 
Mastra 
Any MCP agent Why Helio exists
Agents spend money, change records, and touch production. A prompt cannot enforce the next tool call by itself. Helio governs what agents do to the rest of the world.
The prompt
You wrote “never refund over $1,000.” The model can ignore it, work around it, or lose it as the context fills up. A prompt is an instruction, not enforcement.
The platform
Your agents run across models, frameworks, and tools such as GitHub, Salesforce, and Stripe. Each platform sees its own piece. None sees every action or keeps one policy across all of them.
The transcript
When something goes wrong, you need to know who called what, which rule matched, and whether the call was forwarded. Grepping a conversation will not tell you that.
The path
Helio evaluates each call before forwarding it. If policy says deny, a call routed through Helio never reaches the upstream. Put the policy file and the audit trail where the agent cannot write them and the rule cannot be weakened silently; on the default same-user install Helio records the change instead.
How it works
Point your MCP client at Helio, then point Helio at your server. Your agent code and MCP server stay as they are.
Run init, set your upstream MCP server, and start Helio. Then change your client's MCP URL to Helio. No agent or server code changes.
The generated config starts with no active policy rules. Calls keep flowing while Helio records what your agents actually do. Use that trail to decide what needs a rule.
Add rules to the same helio.yaml. Changes hot-reload. Deny calls, set limits, require approval or evidence, and block tool drift. When Helio owns the path, a blocked call never reaches the server.
Features
Write policy in one YAML file and hot-reload changes. Use dry-run to test a decision without forwarding the call. Every MCP client meets the same policy at Helio.
Write YAML rules to deny calls, set limits, or require approval. Changes hot-reload. Dry-run tests a decision without touching the upstream.
Give Stripe, PayPal, and every other payment tool one shared limit. The ledger survives restarts, with human approval for an overage.
Require a verified lookup before a refund or deployment can run. The dependency lives in policy, not in the prompt.
Hold a sensitive call and send it to Slack, a webhook, or the bundled dashboard. That call goes nowhere until a human decides.
If a server changes a reviewed tool, Helio can block it, ask for approval, or log the change. The default is to block.
Every call becomes a record: who called what, which rule matched, what Helio decided, and what the server returned.
A blocked agent gets a useful next step: run the missing lookup, request approval, or retry when the limit resets.
Change the MCP endpoint, not your application code. Use the proxy alone or add the thin Python SDK for richer evidence.
Helio is Apache 2.0 and self-hosted. When agents reach production, we can help you write the policy, assess the controls, and review the deployment.
Apache 2.0, self-hosted.
For teams and agencies running agents that touch money, customer data, or production systems.
What security and platform teams ask before they put Helio in the path.
No. The generated config starts with no active policy rules, so calls keep flowing while Helio records them.
Review that traffic, then add the rules you want. You decide when Helio starts blocking anything.
No. Change your MCP client configuration so it connects to Helio, and point Helio at your existing server.
There is an optional thin Python SDK for richer evidence and dependency data. The proxy itself needs no changes to your agent or MCP server code.
A prompt is an instruction to the model. Helio evaluates the actual tool call before forwarding it.
For tool access routed through Helio, a denied call never reaches the upstream server. Keep Helio on the only network path to make that enforcement structural.
On the default same-user install the agent's own file tools can rewrite the policy file. Helio records every reload attempt and stamps every decision with the hash of the policy it ran under; those records are durable only while the agent cannot write the audit file, and the dashboard event stream and stderr are the channels that leave the box before that. The separate-user and sidecar recipes in the docs put the file, the secret, and the trail where the agent cannot write them.
Helio keeps the tool definition you reviewed. If the server changes its description or input schema, Helio can block the tool, ask for approval, or log the change.
The default is to block until you review it, so a tool cannot quietly gain a destructive argument overnight.
Yes. Each matching tool draws from the same budget, even when the amount lives in a different input field.
The ledger survives restarts. When the pot runs out, Helio can deny the call or send the overage to a human for approval.
The held call cannot continue until a human approves it. Any other MCP call routed through Helio is evaluated against its own rules.
To prevent a true bypass, route every relevant tool path through Helio, control direct network access to the upstream servers, keep each upstream credential only in Helio's environment so a client pointed straight at the upstream has nothing to authenticate with, and keep Helio's policy file where the agent cannot write it.
No. The open-source proxy and bundled dashboard run in your environment, and your tool traffic does not need to pass through a Helio cloud.
Teams can bring in the maintainers for policy design, a written control assessment, deployment review, and production support.
A general API gateway can inspect HTTP. Helio understands MCP tool calls, their input schemas, and the state that carries across calls.
That is how it can require an order lookup before a $2,400 refund, share one budget across payment tools, or block a tool whose definition changed.
Install the open-source proxy, watch real traffic, then add the rules your agents need.