Build on Helix

Helix is a user-owned context vault. Your users keep one curated set of facts about themselves — and, with the likeness layer, the photos of their people and pets — and grant your app scoped, revocable, audited access. You get personalization from the first interaction; they keep ownership; every read is on the record.

There are two doors. Both use the same OAuth 2.1 server, the same scopes, and the same audit log.

Door 1 — MCP, for assistants and agents

Any MCP client (Claude, ChatGPT, Cursor, Gemini, your agent framework) connects with one URL:

https://vault.helix.ai/mcp

The client walks the standard OAuth flow (dynamic registration + PKCE), the user approves scopes on Helix's consent page, and your session gets tools matching exactly what was granted: get_context, propose_learning, list_subjects, generate_image. See MCP — assistants.

Connecting is not the last step.It gives an assistant the tools; it does not tell it when to reach for them, and server-supplied text does not get to set a model's defaults — nor should it. Tell your assistant to use it is the one paste that closes the loop, and why we cannot do it for you.

Door 2 — REST, for apps

Native and web apps use the same tokens against JSON endpoints: list the user's subjects (names + thumbnails only), create subjects device-direct, and request generated images the app receives as finished artwork — never the source photos. See REST — apps.

Quickstart (REST)

# 1. Register a client (dynamic registration)
curl -X POST https://vault.helix.ai/register \
  -H 'Content-Type: application/json' \
  -d '{"redirect_uris":["yourapp://helix"],
       "client_name":"Your App",
       "token_endpoint_auth_method":"none"}'

# 2. Send the user to /authorize (OAuth 2.1 + PKCE)
#    scope: "identity preferences likeness" — request only what you need
#    The user approves on Helix's consent page; you get a code, then a token.

# 3. Read the cast
curl https://vault.helix.ai/api/subjects -H "Authorization: Bearer $TOKEN"

# 4. Generate
curl -X POST https://vault.helix.ai/api/generate \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"subject_ids":["a1b2c3d4"],"prompt":"A vintage photobooth strip, warm tones"}'

Working reference client: https://vault.helix.ai/demo is a complete browser app (view source) that registers, authorizes with PKCE, loads a cast, and generates — against this exact API.

A shipping app, start to finish: A real integration walks through Dog Photobooth — every call it makes, the Swift and server code that makes it, and screenshots of what the vault owner sees for each one. Read it before you design your auth flow; the token-holder decision is hard to change later.

The short version of the rules

Request only the scopes you need — the consent page shows the user everything you ask for.
Your app never receives source photos. Refs and thumbnails are cacheable; full photos are not available to you at all.
Facts you learn about the user are proposed, never written — the user approves each one.
Revocation is immediate. Build for tokens that die mid-session.

The full rules live in the trust contract. Anyone can create a vault and connect an assistant today. Access to the app door, for building on other people's vaults, is still by conversation — tell us what you're making.

Don't want to depend on us? The vault format and protocol are published as the spec, and the vault itself is open source — run your own.