Deploy an internal agent in one command
Every internal agent — hosted, metered, and scoped — without anyone touching a Kubernetes cluster.
The problem
Engineers write agents. Then what?
Agents ship as ad-hoc scripts, notebooks, or—worse—unsandboxed processes. Nobody knows how many are running or what they access.
IT has no visibility
Spend is unmetered. Tool access is unconstrained. When things break, there is no audit trail. Kill switches do not exist.
The gap is a compliance nightmare
Teams build in secret. IT finds out when something goes wrong. By then, the agent has already run wild.
How it works
Write with defineAgent
Your team writes an agent using the @helm/agent contract.
Deploy with one command
Run `npx helm deploy`. The CLI bundles and sends it to your control plane.
Auto-provisioned execution
Your agent runs in an isolated child process. A per-agent Convex DB provisions automatically.
IT governs everything
Dashboard shows scope, token spend, and per-agent kill switches. No agent runs without governance.
IT sees and controls every agent
This is what separates Helm from "just run it on a VM." IT controls what every agent can do, how much it costs, and when it stops.
Tool & domain scoping
Each agent runs with an explicit allowlist of which APIs and domains it can reach.
Per-agent spend caps
Set a hard token budget. When it hits zero, the agent stops. No exceptions.
Hard kill switch
One click in the dashboard stops any agent mid-run.
Full audit trail
Every execution logged. Token spend tracked. Who changed what and when.
Agent: invoice-processor
Free and open source
Helm is MIT licensed and self-hosted. There is no paid tier, no seat count, and nothing to talk to sales about.
Run it yourself
Clone the monorepo and run the control plane on your own infrastructure.
Governance included
Every control ships in the repo. Nothing is held back behind a tier.
Built to be read
The repo is the documentation: architecture notes, research, and tests.
Deploy your first agent
Helm is open source and self-hosted. Clone the repo to run it, or leave your email to hear when a release lands.