HELM AI Kernel

Fail-closed execution firewall for AI agents.

HELM sits between Claude Code, Codex, MCP tools, shell commands, and other agent actions. It decides ALLOW, DENY, or ESCALATE, then writes a signed receipt you can verify later. Verification checks signature integrity out of the box; trusting who signed is a separate, explicit step — see local signer and trusted verification.

Try It

brew install mindburn-labs/tap/helm-ai-kernel
helm-ai-kernel                 # interactive TTY → operator TUI
# Text catalog: HELM_NO_TUI=1 helm-ai-kernel   (also TERM=dumb / pipes)
helm-ai-kernel setup claude-code --yes
# Codex: helm-ai-kernel setup codex --yes
# Hermes: helm-ai-kernel setup hermes --scope user --yes
# DeepSeek: helm-ai-kernel setup deepseek --scope user --yes

The fully qualified Homebrew install adds the tap and trusts only this formula. See Homebrew Tap Trust.

Ask your agent to do something risky. HELM blocks or escalates the action before it runs, then records the decision.

helm-ai-kernel workstation verify-decision \
  --receipt ~/.helm-ai-kernel/receipts/hooks/<decision>.json

This proves the receipt was not altered (integrity_valid). Signer trust is a separate verdict (signer_trusted), evaluated against an expected workstation public key — by default the one in your local --data-dir; for receipts copied from another machine, pin the signer's key out of band with --trusted-public-key-file. Receipts signed by the legacy derivable seed (retired in the security patch line) always remain untrusted.

No cloud account. No model key. No Docker. No production credentials.

Security Model (short)

Fail-closed by default: unknown tools escalate or deny before dispatch; signed receipts prove the verdict; EvidencePacks verify offline. HELM does not replace host OS isolation, secret scanning, or network firewalls, and it only governs effects that cross a HELM adapter, hook, wrapper, proxy, or API route. Full model: Execution security model.

Ceremony in the operator TUI requires typing APPROVE or DENY. The catalog ranks Doctor, Watch, Policy, Freeze, and Threat before setup convenience. Local mcp approve does not mint MCP authority. Escape hatches: HELM_NO_TUI=1, TERM=dumb, pipes. Details: CLI I/O Convention.

What It Does

Agent tries to...	HELM does this	Proof
Run a destructive shell command¹	DENY	signed receipt
Use an unknown MCP tool	ESCALATE	quarantine record
Read protected secrets	DENY	fail-closed receipt
Run approved work	ALLOW	receipt + evidence
Export a review bundle	verify offline	EvidencePack

¹ The local agent hook is an observed-only integration, not an enforced boundary. Its shell guard matches an intentionally narrow set of destructive command patterns and denies syntax it cannot evaluate statically — it is not a general shell analyzer. See the guard's scope.