The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Helixar Security listing page.
Agentic-AI security tools for Claude, exposed as a remote MCP server.
Status: Live at
https://mcp.helixar.ai/mcp. Two tools available remotely (Streamable HTTP); a third runs locally over stdio. Public, no-auth in v1 — OAuth lands with Phase 8.
| Tool | What it does |
|---|---|
helixar_inspect_mcp | Scan an MCP server (URL or raw manifest JSON) against Sentinel detection rules. Returns risk score, findings, and a Claude-generated security brief. Quick mode is free + authless (top 8 rules). Deep mode runs all 26 rules with an API key. |
helixar_hdp_validate | Validate an HDP delegation chain against IETF draft draft-helixar-hdp-agentic-delegation-00. Surfaces scope escalations, depth violations, expired hops, missing signatures. Every output cites the IETF draft + Zenodo DOI. |
helixar_releaseguard | Wraps Helixar-AI/ReleaseGuard. Quick mode scans dist/ / release artifacts for secrets, metadata leaks, license gaps. Deep mode runs the full harden pipeline (fix + obfuscate + sign + attest). Requires the releaseguard binary on PATH. |
https://mcp.helixar.ai/mcphelixar_inspect_mcp and helixar_hdp_validate appear in the tool picker.mcp_servers)Add the server directly in a Messages API call (beta header mcp-client-2025-11-20):
The Workers deployment exposes two of three tools. helixar_releaseguard shells out to a Go binary via child_process and has no Workers equivalent — it remains stdio-only. For the full set, run locally:
Once the connector is added, paste either of these into a Claude chat. Both target the same intentionally-risky manifest in examples/risky-manifest.json and trip 7 of 8 quick-mode rules.
Inline JSON (works anywhere — no internet fetch from Claude's side):
URL (the same fixture, fetched by Sentinel through its SSRF guard):
Either prompt produces a CRIT-level finding (risk_score 100) flagging:
| ID | Severity | What it caught |
|---|---|---|
| S-001 | critical | No auth block — server is fully open |
| S-003 | high | transport: "http" — plaintext on the wire |
| S-004 | high | delete_repository is destructive but has no requires_confirmation |
| S-007 | high | export_all_users is an unbounded data dump |
| S-008 | high | ssn, date_of_birth, credit_card, address surfaced in tool descriptions |
| S-010 | high | "ignore previous instructions" + "unconditionally" — prompt-injection phrasing aimed at the calling model |
| S-017 | medium | No rate_limit — saturation risk |
@modelcontextprotocol/sdk (official Anthropic)src/worker.ts), WebStandardStreamableHTTPServerTransport, statelesssrc/server.ts)api_key field in the tool's input arguments). OAuth 2.0 + Dynamic Client Registration is Phase 8.| Mode | How auth is signaled | Tools / scope | Purpose |
|---|---|---|---|
| Quick / public | no api_key in tool args | inspect_mcp (top-8 rules), hdp_validate, releaseguard check (stdio only) | Maximum reach — zero-friction for community adoption |
| Deep | non-empty api_key field in tool args | inspect_mcp deep mode (26 rules), releaseguard fix/harden/sbom (stdio only) | Pilot customers + paid tier (real key validation lands with Phase 8 OAuth) |
Per the implementation plan §6, internal detection methodology, Hunch Mode internals, sensor implementation, and exact thresholds are never exposed in this codebase. Public surface is rule IDs, severity buckets, public-safe detection categories, and remediation guidance only. The earlier helixar_triage_alert tool was revoked in v0.4.1 after review flagged that exposing kill-chain stage classifiers — even stripped — widened the public attack surface too far; helixar_releaseguard (wrapping the already-open-source Helixar-AI/ReleaseGuard) replaces it.
draft-helixar-hdp-agentic-delegation-0010.5281/zenodo.19332023Helixar-AI/HDP