Halofy ships an open-source identity, policy and audit layer for AI agents, 424 stars in 15 days

Halofy is a new open-source access and governance layer for AI agents that opens the credential, resolves the namespace server-side, enforces the ACL, and records every read, write, and denial before the agent touches organizational context. The repository was created on 22 August 2026 and reached 424 stars and 33 forks by 6 September. The kernel and console are AGPL-3.0-or-later, and the driver and MCP directories are Apache-2.0 so an integrator can embed them without relicensing the host application.

What the boundary owns

Identity is server-owned. Namespace, actor, role, and source scope are read from the credential, and the MCP tool schemas leave out the identity fields entirely, so a request body has no place to put them. Access is one policy across agents, applications, operators, MCP, and HTTP, so a caller in namespace org/support/agent-1 sees rows belonging to org, org/support, or its own path, and never a sibling like org/support/agent-2 or its own descendants unless an explicit administration path lifts the boundary and logs the fact.

The state model is append-only. A correction closes the prior fact's validity interval and links to the replacement, so history stays legible under audit. Retrieval drivers receive an already-scoped view and can return references only, with no path to writes or to the audit and storage modules. Every outcome appends an event, denial and brownout included. Erasure mints a signed certificate that a third party can verify.

The demo runs offline, with no keys and no network

The maintainers put the whole story on the local machine before asking for a database or an API key. The included demo boots the real kernel on embedded PGlite, pins a policy, assembles a working set, faults a missing context, imports data, and mints a signed erasure certificate, without an API key, an external service or a network call. The suite reports 2,678 tests across 205 files and 6 of 6 driver-conformance checks passing.

Storage is Postgres or pgvector for a durable deployment, and PGlite embeds the same model for local work. Four public connectors ship in the tree: filesystem, Postgres, Obsidian, and a manual CSV import, all feeding the one governed write path.

Open by design, with a paid edge

There is no licence key, no edition flag, no activation, and no telemetry beacon. The public quota port defaults to unmetered. Halofy's managed side, described in the docs as the funding model for the kernel, is model routing and spend attribution, hosted usage plans, operated chat integrations, a managed connector catalogue, federated live query across organizations, and support commitments. None of those are required to run the repository, and the boundary between the open and managed halves is documented file by file.

AGPL on the kernel is the same constraint every self-hostable governance product has now. A team using Halofy as-is inside its own walls is unaffected. A team that modifies the kernel and exposes the modified version as a service to third parties has to publish those changes under the same licence.

Source

halofyai/halofy on GitHub, and the project's own architecture guide and open-source scope documents. Star, fork and creation dates from the GitHub REST API, verified 7 September 2026.