Warden

Warden is a governed data-access runtime for AI agents. It runs as a server between your agents and your database, holds the credentials the agents never see, and decides what each agent may read, propose, and commit.

   Before:   Agent ─────────────────────────────▶ Database
                    full access · forever · unlogged


   After:    Agent ──MCP/HTTP──▶ Warden Gateway ──▶ Database
                                       │
                                       ▼
                           you, only when it matters

Warden is a binary you run, not a package you import. That is the product’s central design decision, not an implementation detail — see Is Warden a Go package?. Your agent points at Warden instead of at the database; its code barely changes.

What you can install today

The gateway. Parses, classifies, governs, and audits every operation, and holds the database credentials.

warden-mcp

An MCP server so any MCP-speaking agent (Claude Code, Claude Desktop) reaches the gateway as a tool.

wardencert

The certification harness. Proves a connector’s guarantees against a real database rather than asserting them.

Container image

A distroless image running as a non-root user, plus a compose file that brings up Warden and PostgreSQL together.

Why it exists

Give an agent a database connection and you have handed it a permanent, unscoped, unaudited capability. Warden replaces that connection with a governed one:

Problem	What Warden does
You cannot see what the agent does to the database	Debug Mode — a breakpoint debugger for database traffic. Step, continue, or reject each operation
You cannot let it write to production	Approvals — changes become proposals with an exact before/after preview and a human decision
One missing `WHERE` wipes a table	Blast-radius analysis — whether an operation is provably bounded, decided before it runs
The diff someone approved is not the change that happened	Commit-time fences — the records are re-checked at approval; if they moved, the commit is refused
Customer data reaches a model’s prompt	Masking inside the statement, so no alias or join gets around it
After an incident nobody can reconstruct what happened	Tamper-evident audit — hash-chained, with the agent, its reason, the rules that fired, and the reviewer

The honest part

Databases differ in what they can enforce. Every guarantee is labelled with who actually provides it — native (the engine), enforced (Warden, by rewriting the statement), advisory (observed, not prevented), or unavailable — and a connection whose engine cannot meet its policy refuses to start. See the capability ladder.

Status. PostgreSQL is the reference connector, MongoDB the second engine, and Neo4j the third; all three are certified against a real server on every commit. MySQL is designed for but not built. Nothing here describes an engine that does not work — where a feature is planned, the page says so.

Quickstart

A governed PostgreSQL in about five minutes, with Docker.

Everything on offer

Every artefact, what it is for, and how it is distributed.

Start here

Offerings

Install

Configure

Operate

Warden

What you can install today

warden

warden-mcp

wardencert

Container image

Why it exists

The honest part

Quickstart

Everything on offer

​What you can install today

warden

warden-mcp

wardencert

Container image

​Why it exists

​The honest part

Quickstart

Everything on offer

What you can install today

Why it exists

The honest part