alwaysreadyallies/warden

Warden is a security proxy that sits between an AI client, such as Claude Desktop or Cursor, and the Model Context Protocol tool servers those AI agents call. Instead of connecting your AI client directly to a tool server, you point it at Warden, and Warden forwards the calls while watching everything that passes through. This needs no code changes, just a line of configuration. Every tool call Warden sees goes through a chain of checks: it is logged in a way that later reveals if the log was altered, checked against a policy file that can allow, deny, or require human approval for specific actions, and scanned for attempts to inject hidden instructions or leak secrets such as passwords or private keys. Dangerous actions like transfers, deletions, or deployments can be set to require a person to approve them before they proceed, and approvals can even be sent to your phone through Telegram when running Warden as a remote server. A notable feature is protection against attacks that span multiple tool calls in one session, such as reading untrusted content from one source and then trying to leak it out through another tool later. Warden tracks this flow across the whole session and blocks or gates the exit point once untrusted content has entered. The project also ships two companion commands. One statically scans a tool server's definitions before you even connect to it, looking for hidden malicious instructions or dangerous capabilities. The other actually runs a set of realistic attacks, like path traversal or injection attempts, through the live proxy to prove whether the configured protections truly stop them, producing a report that can be signed for tamper evident proof. Warden can run locally over standard input and output for a single user, or as a deployable web server protected by OAuth 2.1 authentication tokens. It is written in Python, distributed through PyPI, and released under the Apache 2.0 license.