From source

Building from source gives you the gateway, the MCP server, the certification harness, the policy examples, and the fixtures — everything the other install routes leave out.

The source repository is private, so this route needs access to it. To use Warden, Homebrew or the container image serve public artefacts built from it.

Prerequisites


Go	1.25 or newer
C toolchain	Required — Warden compiles PostgreSQL’s parser (why)
PostgreSQL client and server	Optional, for the PostgreSQL connector’s tests and certification
MongoDB server	Optional, for the MongoDB connector’s tests and certification (a single-node replica set — transactions do not exist on standalone)
Neo4j server	Optional, for the Neo4j connector’s tests and certification
Docker	Optional, for the compose stack

Build

git clone https://github.com/Abhishek-Mallick/Warden.git warden && cd warden
make build          # bin/warden, stamped with the git description
go build -o bin/warden-mcp ./mcp/warden-mcp

Verify your build

make check          # format, vet, layering rule, lint, tests, memory certification
go test -race ./... # the pause/approve paths are concurrent by nature

make check is what CI runs. The layering rule (make importguard) is worth knowing about: nothing above the connector layer may import a database driver, and CI fails if that stops being true.

Run it against a real PostgreSQL

make pg-fixture     # creates warden_dev, the schema, and a least-privilege role
make pg-serve       # runs the gateway against it on 127.0.0.1:9470

make pg-fixture creates a warden_gateway role with no superuser and no BYPASSRLS — the connection Warden itself uses is least-privilege, so a gateway compromise is bounded by the grant. It also creates warden_agent, the NOLOGIN role that holds what agents may touch, and the two functions that create and drop one role per lease inside it. The gateway may call those functions but can’t create roles itself.

make pg-cert                      # certify the connector against that database
make pg-serve-strict              # the strict policy: exact previews, fences, and
                                  # a real database role per lease

Remove lease_role from warden-strict.yaml and it refuses to start. That refusal is a feature and a test: a connection cannot serve traffic with a guarantee its policy requires and its engine cannot provide.

Run it against a real MongoDB

docker run -d -p 27017:27017 mongo:7 --replSet rs0 --bind_ip_all
docker exec <container> mongosh --quiet --eval 'rs.initiate({_id:"rs0",members:[{_id:0,host:"localhost:27017"}]})'
WARDEN_MONGO_DSN='mongodb://localhost:27017/?directConnection=true' make mongo-fixture

Then point a connection at it as in MongoDB, and make mongo-cert to certify the connector.

If another mongod already owns port 27017 — very common with a Homebrew install — connections meant for the container reach the local standalone instead, and the suite fails confusingly. The connector now names that mismatch outright, but the fastest check is still lsof -nP -iTCP:27017 -sTCP:LISTEN: if a non-Docker mongod is listening, either stop it or publish the container on a free port (e.g. -p 27018:27017) and point WARDEN_MONGO_DSN at that port with ?directConnection=true.

Run it against a real Neo4j

docker run -d -p 7474:7474 -p 7687:7687 -e NEO4J_AUTH=neo4j/password neo4j:5
make neo4j-fixture   # wipes and reseeds the database with the fixture graph

Then point a connection at it as in Neo4j, and make neo4j-cert to certify the connector.

make neo4j-fixture wipes the configured database first — Community serves only the default database, so run this against a throwaway server, never against data you keep.

Useful targets

Target	What it does
`make check`	Everything CI runs
`make test-race`	The race detector over the whole tree
`make cert`	Certify the in-memory reference connector
`make pg-cert`	Certify PostgreSQL against your local database
`make mongo-cert`	Certify MongoDB against your local replica set
`make mongo-fixture`	Seed the MongoDB development database
`make neo4j-cert`	Certify Neo4j against your local server
`make neo4j-fixture`	Wipe and reseed the Neo4j development database
`make pg-inspect`	Print the capability ladder, catalog, and the IR for a corpus of tricky statements
`make mcp-backtest`	Drive the MCP shim over stdio against a running gateway and assert every answer
`make cover`	Coverage summary

Repository layout

Path	What lives there
`cmd/warden`	The gateway binary and CLI
`cmd/wardencert`	The certification harness
`mcp/warden-mcp`	The MCP server
`internal/`	The product: gate, connectors, policy, masking, audit, leases, IR
`pkg/`	The two public packages: error taxonomy and IDs
`certification/`	Profiles and cases every connector must pass
`deploy/`	Example configurations and policies
`web/`	This documentation site

Start here

Offerings

Install

Configure

Operate

Prerequisites

Build

Verify your build

Run it against a real PostgreSQL

Run it against a real MongoDB

Run it against a real Neo4j

Useful targets

Repository layout

​Prerequisites

​Build

​Verify your build

​Run it against a real PostgreSQL

​Run it against a real MongoDB

​Run it against a real Neo4j

​Useful targets

​Repository layout

Prerequisites

Build

Verify your build

Run it against a real PostgreSQL

Run it against a real MongoDB

Run it against a real Neo4j

Useful targets

Repository layout