Helm holds the tools your agent may call, the memory it reads and writes, and the skills that say how you work. Point any MCP client at one address and the setup is already there.
One command in the folder that should reach this agent.
# Claude Code claude mcp add --transport http helm https://app.helm.mom/mcp/<your-agent-id>
The prompt fetches the skills Helm has published to you, asks once, and installs the ones you say yes to.
Three things decide whether an agent knows what to do. All three live on Helm, not inside one app.
Gmail, Drive, Calendar, Outlook, GitHub, Linear, Notion, Zendesk and more. Set every tool for every agent to allow, ask, or block.
One vault for you, split into scopes that never mix. Grant the work agent the work scope and it cannot reach home.
The wall is real, not a prompt. A link written across two scopes does not resolve. If you need the same fact in both, you write it twice. That is the cost of a hard wall, and we would rather you knew.
The memory follows the address, so the same agent recalls the same things in every client you point at it.
Skills are written playbooks the agent reads before it acts. How you triage mail. How you keep notes. What a project record has to contain.
Write a skill once. Helm rewrites the tool names for whichever client asked, so the same words work in all of them.
A skill says which services it needs. Attach it to an agent that lacks one and Helm refuses instead of failing halfway.
Tool services in the Helm repo today, each one declaring its own tools and its own permission split. That is the count in the code, not a projection. Two of the eighteen are privileged and one is development only.
I am Felipe. I built Helm because I run agents against my own Gmail, Calendar and Drive, and I kept building the same setup again every time I changed tools.
The tools, the memory and the skills now sit on Helm. When I open a different client I point it at the same address and my agent is already itself. My permissions come with it.
Helm does not stop a prompt injection. Nothing does. It decides what an injected agent is able to reach, which is the part I can actually control. New agents are closed until a client signs in, and the agent never holds my credentials.
It is $19 a month and you bring your own model keys. If it is not carrying its weight, cancel it.
Felipe Saint-Jean, Helm