HELM AI Kernel CLI
An execution firewall for agent actions: decides ALLOW, DENY or ESCALATE and writes a signed receipt that can be verified later.
- 61 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Setup registers hooks in the agent config, and with a misconfiguration protection can miss an action that did not pass through its boundary.
Install
- Works in
Manual install
brew install mindburn-labs/tap/helm-ai-kernelThe command from Try It; then `helm-ai-kernel setup claude-code --yes` for Claude Code.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Setup registers hooks in the agent config, and with a misconfiguration protection can miss an action that did not pass through its boundary.
This is third-party code. Review the repository files before installing.
What it does
HELM sits between Claude Code, Codex, MCP tools and shell commands. Before an action runs it returns `ALLOW`, `DENY` or `ESCALATE` and writes a signed receipt. A destructive command is denied, an unknown MCP tool goes to quarantine, reading protected secrets is blocked, and approved work passes with a receipt and evidence. The `helm-ai-kernel setup claude-code --yes` command wires the agent hooks. Receipt verification confirms signature integrity, while trust in the signer is configured as a separate explicit step. No cloud account, model key or Docker is needed.
Who it is for. Teams letting agents touch real databases and shell commands who want a decision log with verifiable signatures.
Good fit when
- An agent with shell access could delete a database and a barrier is needed before the command runs.
- Unknown MCP tools should land in quarantine first instead of being called at once.
- An audit needs decision receipts verifiable offline on another machine.
- Before putting agents into a workflow you want to audit the machine: the Agent Risk Scan document covers it.
Not a fit when
- A replacement for a sandbox, network firewall or secret scanning is expected: HELM does not replace them.
- The agent does not call tools through HELM hooks, wrappers, proxies or API routes: such actions stay invisible to it.
- A hard block from a hook is needed: the local agent hook is observe-only rather than enforcing.
Example request
Show the latest HELM decisions for this session and verify the receipt signature of the most recent denial.Limitations
HELM governs only actions that cross its adapter, hook, wrapper, proxy or API route. The local agent hook is observe-only, and its shell guard matches a narrow set of destructive command patterns and denies syntax it cannot evaluate statically. A receipt signature proves only integrity, and signer trust is pinned with a key through `--trusted-public-key-file`. It is not Kubernetes Helm and not the hosted HELM Enterprise product.
How to disable. Remove the agent hooks with the setup command for your agent and uninstall the Homebrew package. Delete the `~/.helm-ai-kernel` directory of receipts by hand after exporting the entries you need.
FAQ
How do I install HELM?
`brew install mindburn-labs/tap/helm-ai-kernel`. The fully qualified form adds the tap and trusts only this formula.
How do I connect it to an agent?
`helm-ai-kernel setup claude-code --yes` for Claude Code, `helm-ai-kernel setup codex --yes` for Codex. Hermes and DeepSeek variants exist too.
How do I verify a receipt?
With `helm-ai-kernel workstation verify-decision --receipt <path to file>`. It reports `integrity_valid` and a separate `signer_trusted` verdict.
What happens to an unknown MCP tool?
It gets `ESCALATE` and lands in a quarantine record until explicitly approved. Local `mcp approve` alone does not grant MCP authority.
Is a cloud account needed?
No: to start you need no cloud account, model key, Docker or production credentials.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
A policy engine for AI agent actions: a Claude Code hook scores each call before it runs, then allows, blocks or waits for you
MCP checks shell commands, while shellfirm hooks apply rules to supported agent calls before they execute
ai-engineering installs hooks that deny risky agent calls and write a receipt for every verdict into your repository
A guard on an AI agent's execution path: every tool call gets a PASS, AUTH or BLOCK verdict before it runs
README in short
Installation is a single Homebrew command. The README gives a security model summary, a "what HELM does" table and a list of documents for the next step.