halofy
Halofy is the open access and governance layer for AI agents across your organization. Identity, policy, provenance, audit, and signed erasure.
What is it?
What it is
The open access and governance layer for AI agents across your organization.
Why it exists
To provide a unified identity, access control, and governance layer for AI agents, enabling shared organizational context without siloed identity systems, policy engines, or audit trails.
Who should use it
Organizations needing centralized governance for multiple AI agents; platform engineers and DevOps teams; developers building agent-based apps requiring secure organizational knowledge access.
Who should avoid it
Solo developers with single-agent projects; those without organizational context; teams avoiding self-hosting; developers lacking TypeScript/Node.js/Postgres familiarity.
Stars over time
No change stars in the last 1 day
How it works
A quick walkthrough in plain English
How halofy works
Step 1 of 3
You interact with it
Open halofy, send a request, or connect it to your stack.
Features
Advantages
- Open source with no license key, edition flag, activation, or entitlement check
- Unmetered packaging quota; default QuotaPort is UNMETERED
- No telemetry or Halofy phone-home
- Offline deterministic defaults; optional Anthropic, OpenAI-compatible, Azure OpenAI configuration
- Embedded PGlite enables zero-setup local development and testing
- Supports regular Postgres/pgvector for durable deployments
- Open schema, export, manifest, and erasure paths
- Consistent ACL and policy across agents, applications, operators, MCP, and HTTP
- Governed context lifecycle ensures auditability, provenance, and supersedence
- Hermetic test lane with deterministic StubLlm and HashEmbedder
- Supports multiple connectors and retrieval engines via driver interface
- Clear separation between open kernel and commercial managed operations
Disadvantages
- Commercial features such as model routing, spend attribution, managed connectors, federated live query, tuned extraction prompts, and managed infrastructure are not included in the open source version
- Requires Node.js 22 and npm for kernel
- Self-hosting requires Docker Compose and Postgres for production
- Complexity of setting up ACL and namespace rules
- Limited to TypeScript ecosystem
- No built-in model serving; relies on external LLM providers or deterministic stubs
- Managed operations are required for some advanced features like model routing, spend attribution, and hosted usage plans
Installation
FAQ
What is Halofy?
Halofy is an open-source access and governance layer for AI agents across an organization. It resolves identity, enforces access, governs context changes, records audit, and makes erasure verifiable, while providing durable context and pluggable retrieval.
How can I run Halofy completely offline without any external services?
Clone the repository, go to the kernel directory, run npm ci and then npm run demo. This boots the real kernel on embedded PGlite, uses a deterministic stub LLM and hash embedder, and requires no API keys, database server, model downloads, or network access.
How do I connect an AI agent to Halofy using MCP?
Generate an API key with npx tsx src/cli.ts keygen org/support/agent-1 user:dana owner, set the HALOMEM_API_KEY environment variable, and run npm run mcp. The key resolves namespace, actor, and role server-side; MCP tool schemas do not accept caller-asserted identity fields.
How does Halofy enforce namespace isolation?
A caller sees rows belonging to its own namespace or any exact slash-separated ancestor namespace. Siblings and descendants remain hidden unless an explicit, audited administration path allows a subtree operation. The query layer enforces this rule with exact ancestor matching.
What license is Halofy and are there any commercial restrictions?
The kernel and console are AGPL-3.0-or-later, while named client and extension subtrees are Apache-2.0. The open-source build has no license key, no telemetry, no quota, and can be self-hosted. Managed operations such as model routing, billing, and hosted connectors are commercial but are not required to run the repository.
Featured in Videos
YouTube tutorials and walkthroughs for halofy
Alternatives
Similar projects ranked by category, topics, and text overlap.
