Helio enforces the limits your agent can't bypass — what it can spend, what needs your sign-off and what it can never touch. It runs as a proxy in front of your tools, so there's nothing to skip and no code to change. Open-source, self-hosted and works with any MCP agent.
Works with the agents you already use
Prompt-based rules drift, reset, and get talked past. Helio enforces from outside the agent - so the lines you set stay set, every call.
A rule inside the agent's context can be crowded out under load or argued away by a malicious tool. Helio enforces from outside, in the path every call travels so it can't be bypassed because it was never in the agent to begin with.
A spend cap that resets on every call isn't a cap. Helio carries a running total across a window, demands evidence from a prior result before allowing an action, and enforces that prerequisite steps actually ran. None of which a stateless checker can do.
A tool can pass review on install, then quietly redefine itself a week later to do something you never approved. Helio captures each tool's definition and diffs it on every load, blocking anything that drifted until you've reviewed the change.
GitHub
Star on GitHubnpx to governedA YAML file. A proxy. No agent code changes.
MCP Client
Agent
Helio
Governance proxy
MCP Server
Tools
MCP Client
Agent
Helio
Governance proxy
MCP Server
Tools
Optional
Python SDK
thin · annotates calls
Helio sits between your agent and your tools as a transparent MCP proxy. Every call passes through.
Scaffold helio.yaml and a starter ruleset that blocks common dangers.
$ npx @gethelio/proxy initWrite rules in YAML - what to block, what needs approval, what to rate-limit.
# helio.yaml rules: - match: "tools/payments/*" action: require_approval - match: "tools/db/write" action: deny
Start the proxy. Your dashboard ships with it - no separate install.
$ npx @gethelio/proxy start ✓ Proxy live on :3100 ✓ Dashboard at localhost:3100
What a working helio.yaml looks like:
version: '1' upstream: url: 'http://localhost:3001/mcp' # Your existing MCP server listen: port: 3000 # Helio listens here policies: default: allow rules: # Block destructive operations - match: tool: 'delete_*' action: deny feedback: message: 'Destructive operations are disabled' # Rate limit expensive API calls - match: tool: 'search_*' action: rate_limit limits: max_calls: 100 window: 1h key: tool # Spend limit on payment tools - match: tool: 'create_payment' action: spend_limit limits: max_spend: field: '$.amount' limit: 5000 currency: 'GBP' window: 24h audit: storage: sqlite retention: 90d include_responses: true dashboard: enabled: true port: 3100 api_secret: '${HELIO_DASHBOARD_SECRET}'
Declarative policies, human-in-the-loop approvals, evidence grounding, and a complete audit trail without changing your agent code or MCP servers.
Declarative YAML rules that control which tools agents can call. Match by path, method, or custom attributes.
Route sensitive actions to humans via Slack, email, or dashboard. Configurable timeouts and escalation paths.
Every tool call logged with full context - who requested it, what policy matched, whether it was approved, and the result.
Rate limits, spend caps, and budget alerts. Prevent runaway agents from burning through API credits.
Capture the reasoning context that led to each tool call. Audit not just what happened, but why.
Sits between any MCP client and server as a transparent proxy. No agent code changes required.
Most governance is locked to one platform, one framework, or only controls which tools an agent can reach. Helio governs every tool call across any MCP agent without any code changes.
Open source, local-first, free. Scaffolds your config - one more command boots the proxy and dashboard.
$ npx @gethelio/proxy init