Smartflow Halo
Control what your agents spend and send.
Smartflow governs the AI traffic your people generate. Smartflow Halo governs the traffic your agents generate, on runtimes you host yourself, using your own provider keys. One binary on the box. Same four questions, different half of the volume.
Why it exists
An agent does not go home at six.
86,400,000
tokens a month
one agent, nobody watching
288 calls a day
10,000 token system prompt
2,880,000 tokens a day
That is one agent. Multiply by the number your engineers have already started.
Chat spend scales with headcount, and headcount is a number you already govern. Agent spend scales with tasks, and every task fans out into retrieval, reasoning, tool calls and retries.
The first time most teams see the shape of it is on an invoice.
The bill is the symptom. Nobody can say which human the spend was for.
Where it sits
One line of products. Four places to stand.
APERION asks the same four questions everywhere it runs: what did it cost, what did it do, who authorized it, and can you prove it later. What changes is where you are standing when you ask.
APERION Shield
Free, open-source local MCP guardrail
A developer's machine
Stops destructive tool calls before they reach the tool
APERION Compass
Free, open-source, offline assessment
A laptop or a CI job
Turns governance claims into evidence you can rerun
Smartflow Halo
One binary, self-hosted agent runtimes
The box the agent runs on
What the agent spent, and what it sent
Smartflow
Runtime governance control plane, Kubernetes-native
Your data center
Inline policy at every prompt, response and MCP tool call
Maestro
The console over Smartflow
Your data center
One view of performance, cost and compliance
Halo is not a smaller Smartflow and it is not a trial for it. Smartflow sits in an enterprise deployment and answers for an organization. Halo sits on one machine, answers for the agents on that machine, and never needs a deployment at all.
The connection is not a diagram. Halo's MCP cloak and taint engine is Shield's, reused rather than rebuilt.
The same code that blocks a destructive tool call on a developer's laptop resolves {{cloak:NAME}} secrets on a self-hosted agent runtime. One codebase, three installers, and the same answer to the same question wherever you stand.
What runs on the box
What sits between your agent and the model.
01
Budgets and a kill switch that work offline
Global and per-agent caps over a rolling window. The hard cap is enforced locally and always — a single request cannot overshoot it, and it does not depend on anything being reachable. halo kill revokes a key instantly. Streaming gets a mid-stream stop-loss.
02
Keys that stay on the box
Register an agent and Halo mints a virtual key mapped to your real provider key, stored in your OS keychain, never on disk. Point your runtime at Halo and every call flows through the firewall.
03
Two cache layers
Exact-match for byte-identical repeats. An optional semantic cache for reworded repeats, including across providers, with cosine similarity re-checked at request time.
04
Compression and prompt-cache injection
Shrinks the wire body, and injects cache_control on large repeated system prompts, tool definitions and attachments.
05
MCP cloak and taint
Halo fronts your MCP servers. Reference secrets in tool arguments as {{cloak:NAME}}; Halo resolves them only on the copy sent upstream and scrubs leaked values out of results. Shield's engine, reused.
06
A dashboard that never leaves the machine
Loopback-only web UI on 127.0.0.1:8788, bundled in the same binary: live spend, cache-hit rate, agent list with one-click revoke. Writes require a local token from halo dashboard token that never leaves the machine.
The part that survives inspection
What we will not claim.
This audience reads its own network traffic. So, precisely:
-
Bring your own keys. Nothing goes to APERION.
The exact-match cache and everything on the free tier are local. The semantic cache is opt-in and off by default; when you turn it on, it calls an embedding provider on your own key.
-
No relay is configured.
Nothing leaves the machine unless you point it somewhere.
relay_urlis unset on install. -
Zero LLM dependencies.
Halo does not run a model to do its job. A governance tool that needs its own inference is a second thing to govern.
-
Source is closed. The binaries are not.
The binaries and the container image are fully public, with no GitHub authentication on any install path. Rust 1.75+,
redb/SQLite single-file stores, no Redis, no Mongo, no Postgres. 153 tests. -
LiteLLM is a stronger general routing layer.
It is. Halo is narrower on purpose: one binary, keys on the box, and a free tier that is a real firewall rather than a trial.
-
Safety is never behind a paywall.
Spend caps, the hard-cap kill switch and
halo killare free, permanently. They are the reason people leave it installed.
Getting it
Three ways in, sixty seconds to first call.
Install with curl, Docker, or a Windows .zip. Register an agent, swap two environment variables, run.
OpenClaw and Hermes ignore environment variables and take a one-command patch instead — halo openclaw apply, halo hermes apply — which is the kind of thing worth saying out loud.
The runtime governance layer for enterprise AI agents in regulated industries.
Solutions
Industries
Resources
© 2026 APERION, Inc.