Skip to content

Heimdall

Anthropic does not manage or audit MCP servers.

Code Video Cerebral Valley

Core trick

Intercepts MCP tool calls, applies YAML policy rules, rewrites arguments in flight, and signs audit entries with SHA-256 and Ed25519.

Tags

securitydev tools

Description

Anthropic does not manage or audit MCP servers. Thousands exist in the wild — any can silently add exfiltration tools or drift in behavior. No agent framework detects this. Heimdall is the missing governance layer. Open-source MCP proxy that intercepts every AI tool call, enforces YAML policies, and produces a tamper-evident SHA-256 + Ed25519 audit trail. Works as a Claude Code hook (one command) or standalone proxy. Three actions: PASS allows. HALT blocks. RESHAPE — our unique capability — transforms arguments in-flight (e.g. redacts secrets) and lets the agent keep working. No binary allow/block tradeoff. Also: supply-chain drift detection, real-time WebSocket dashboard (Watchtower), and an AI audit pipeline — Opus 4.6 generates policies, red-teams with 4 parallel agents, and auto-patches gaps. Zero to locked down in 30 seconds. 7-package Bun monorepo, TypeScript strict, 197 tests. MIT licensed. Built entirely during the hackathon with Claude Code.
mchahed99/heimdall★ 40 forksTypeScriptMITCreated Feb 11, 2026 · last push Feb 16, 2026

README excerpt

<div align="center">

<br>

<img src="assets/logo.svg" alt="Heimdall" width="600">

<br><br>

**Runtime governance for AI agent tool calls.**

[![License: MIT](https://img.shields.io/badge/License-MIT-4A8FD4.svg)](LICENSE)
[![Tests](https://img.shields.io/badge/tests-197_passing-3D9970.svg)](#)
[![TypeScript](https://img.shields.io/badge/TypeScript-strict-4A8FD4.svg)](#)
[![Built with Opus 4.6](https://img.shields.io/badge/Built_with-Opus_4.6-D97706.svg)](#)

</div>

---

An open-source, MCP-native proxy that **enforces** security policies on every tool call, **transforms** dangerous arguments before they reach the server, and produces a **tamper-evident** cryptographic audit trail -- with supply-chain drift detection built in.

| Capability | What Heimdall does |
|-----------|-------------------|
| **Policy enforcement** | YAML rules decide PASS, HALT, or RESHAPE per tool call |
| **Controlled mutation** | RESHAPE rewrites arguments (e.g. redact secrets) -- both original and transformed are logged |
| **Signed audit trail** | SHA-256 hash chain + Ed25519 signatures on every decision |
| **Drift detection** | Baselines `tools/list` and alerts when server definitions change |
| **AI-powered policy** | Opus 4.6 generates, red-teams, and auto-patches your policy |
| **Real-time dashboard** | WebSocket-fed UI showing decisions, risk tiers, and drift alerts |

---

## Why Heimdall

Other projects address parts of the MCP security problem. Heimdall combines all four layers:

| | To

Team