An agent with production access needs limits, not trust.
Helm7 is an MCP server for your whole application. An agent connects with a key, sees only the tools that key allows, and plans every change before making it. The same 66 operations are available over REST, so nothing is agent-only or person-only.
Four calls, one refusal.
An agent with a $5 key plans a Product, prices it, and then asks for a machine it cannot afford. Step through it. Each response is what the API returns.
- release-bot
- MCP session
1Find out what this key can do before planning anything.
whoami {}{ "key": { "scopes": [ "database:write", "deployment:write", "domain:write", "product:read", "product:write" ], "capabilities": [ "may_deploy" ], "product_id": "prd_7k2m9x4qw1nv", "budget_usd": 5, "spent_usd": 0, "budget_remaining_usd": 5 } }
Every response is what the API returns for this call.
- Agent keys
- release-bot
- Spend cap
- $5.00/month$0.00 spent
- Expires
- In 8 hours, and it cannot extend itself
- Scopes
- deployment:writedatabase:writeproduct:readproduct:writedomain:writemay_deploy
- Reach
- One Product, and never more than the person who made the key. Tools it cannot use are left out of its tool list altogether.
Any call that would cost more is refused.
What an MCP server is.
An MCP server offers tools to an AI application over the Model Context Protocol. The application asks which tools exist, the model reads their descriptions, and the application calls the ones the model picks. One server works with every client that speaks the protocol.
The protocol does not decide what a tool may reach. The credential behind it does, which is why the rest of this page is about keys.
It plans before it acts
36 operations change infrastructure, and every one of them takes dry_run: true. It returns what would change, what it would cost a month, and what could not be undone, and it is free, so "always plan first" is a rule an agent can actually follow.
It can price a thing it has not built
cost_estimate takes a shape and returns a monthly figure with the largest cost named. An agent told to keep something under $20 a month has a number to check before it spends anything.
Its key has a ceiling and a clock
An agent key carries its own scopes, an optional monthly spend cap and an optional expiry in hours. It can never exceed the person who made it, and a call past the cap is refused with budget_exceeded before anything is spent.
It can sign up with no account
cloud_init creates a temporary workspace and a scoped key with no email, no card and no person involved, so an agent can try the platform end to end and hand over to a person when there is something worth keeping.
Ask what would happen, before it happens.
Every one of the 36 operations that change infrastructure returns the same object when dry-run: the ordered changes, a monthly cost band, the largest cost by name, and a plain list of anything that cannot be undone. Destructive operations return it and refuse until confirm is set.
product_create {
"name": "Acme",
"repo": "https://github.com/acme/acme-app",
"region": "eu-central",
"dry_run": true
}- Acme
- Plan
- create productAcme eu-central
- create environmentproduction
- create serviceweb shared-0.25, sleeps when idle
- create databaseprimary Postgres 18
- change secretDATABASE_URL set on production
- create authproduction email
- create bucketuploads private
- create domainacme.com certificate issued once DNS resolves
Inside the $12 Builder minimum, so that is the bill. Largest cost: service (shared-0.25).
A key that cannot outrank you, outspend you or outlive you.
Scopes asked for are intersected with the scopes you hold, so asking for more narrows rather than fails. A key holding may_administer cannot mint another that does, which is what makes revoking one mean something.
agent_key_create {
"name": "release-bot",
"scopes": [
"product:read",
"deployment:read",
"deployment:write"
],
"product_id": "prd_7k2m9x4qw1nv",
"budget_usd": 20,
"expires_in_hours": 8,
"capabilities": [
"may_deploy"
]
}- Reads and writes are separate scopes, so granting read access can never grant the ability to spend money or drop a database.
- Tools a key cannot use are left out of tools/list, so the agent does not spend turns arguing with a permission error.
- No endpoint returns a secret value. A leaked read key cannot take your credentials, because there is nothing to read.
- Confine a key to one Product and it cannot pick another at call time. Give it eight hours and a leak stops mattering on its own.
Sign-up with no account.
An agent asked to evaluate a hosting platform meets a sign-up form, an email confirmation and a card field, and stops. cloud_init removes all three. The workspace expires, so it is for trying things; cloud_claim returns a link for a person to keep it.
cloud_init {
"label": "evaluation-run-1"
}cloud_claim {}Connecting.
One endpoint, and the key decides what it offers. A narrow key means a shorter tool list, a cheaper prompt and less that can go wrong. Call whoami first: it returns the key's scopes, capabilities, budget and expiry.
Two ways in. Sign in with your browser: in Claude Code, run claude mcp add --transport http helm7 https://www.helm7.com/mcp, then choose Authenticate and approve the connection. It receives a key limited to what you can do, and you can revoke it from the keys page. Or paste an API key into the configuration below, which is what to use for CI and for clients without OAuth.
{
"mcpServers": {
"helm7": {
"url": "https://www.helm7.com/mcp",
"headers": {
"Authorization": "Bearer hlm_sk_..."
}
}
}
}The same surface is available as REST and, for the common path, as a CLI.
llms.txt is the rules, the resource graph, a typical first session and every operation in plain text, written for a model that has never seen this API.
To have an agent test your product by signing in as a user, give it a test account instead of a password.
Questions about agent access.
What is an MCP server?
A program that offers tools to an AI application over the Model Context Protocol, an open standard now maintained under the Linux Foundation. The application asks the server which tools it has with tools/list, and calls them with tools/call.
What can an agent do through Helm7's MCP server?
Everything the REST API can: 66 operations covering Products, services, deployments, Postgres, auth, storage, domains, secrets, cost and agent keys. Both are generated from one catalogue, so neither can offer something the other cannot.
How do I stop an agent spending too much?
Give its key a monthly budget. Every call that costs money is priced first, and one that would take the key past its cap is refused with budget_exceeded, naming the balance left so the agent can pick something cheaper.
Can an agent delete my production database?
Only if its key holds the scope for it, and even then a destructive call without confirm: true is refused and returns the plan instead, listing exactly what would be lost. Keep database write scopes off keys that do not need them.
Which MCP clients work with it?
Any client that supports the Streamable HTTP transport, such as Claude Code, Cursor and VS Code. Point it at the /mcp endpoint. Clients that support OAuth open a browser to sign in and approve access; any client can instead pass an API key in the Authorization header.