Build on Helix

Helix is a user-owned context vault. Your users keep one curated set of facts about themselves — and, with the likeness layer, the photos of their people and pets — and grant your app scoped, revocable, audited access. You get personalization from the first interaction; they keep ownership; every read is on the record.

There are two doors. Both use the same OAuth 2.1 server, the same scopes, and the same audit log.

Door 1 — MCP, for assistants and agents

Any MCP client (Claude, ChatGPT, Cursor, Gemini, your agent framework) connects with one URL:

https://vault.helix.ai/mcp

The client walks the standard OAuth flow (dynamic registration + PKCE), the user approves scopes on Helix's consent page, and your session gets tools matching exactly what was granted: get_context, propose_learning, list_subjects, generate_image. See MCP — assistants.

Door 2 — REST, for apps

Native and web apps use the same tokens against JSON endpoints: list the user's subjects (names + thumbnails only), create subjects device-direct, and request generated images the app receives as finished artwork — never the source photos. See REST — apps.

Quickstart (REST)

# 1. Register a client (dynamic registration)
curl -X POST https://vault.helix.ai/register \
  -H 'Content-Type: application/json' \
  -d '{"redirect_uris":["yourapp://helix"],
       "client_name":"Your App",
       "token_endpoint_auth_method":"none"}'

# 2. Send the user to /authorize (OAuth 2.1 + PKCE)
#    scope: "identity preferences likeness" — request only what you need
#    The user approves on Helix's consent page; you get a code, then a token.

# 3. Read the cast
curl https://vault.helix.ai/api/subjects -H "Authorization: Bearer $TOKEN"

# 4. Generate
curl -X POST https://vault.helix.ai/api/generate \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"subject_ids":["a1b2c3d4"],"prompt":"A vintage photobooth strip, warm tones"}'

The short version of the rules

• Request only the scopes you need — the consent page shows the user everything you ask for.
• Your app never receives source photos. Refs and thumbnails are cacheable; full photos are not available to you at all.
• Facts you learn about the user are proposed, never written — the user approves each one.
• Revocation is immediate. Build for tokens that die mid-session.

The full rules live in the trust contract. Helix is in invite-only beta — request an invite and mention you're building.