> ## Documentation Index
> Fetch the complete documentation index at: https://warden.buildlab.in/llms.txt
> Use this file to discover all available pages before exploring further.

# From source

> Clone, build, and run the full development environment, including the certification suite.

Building from source gives you the gateway, the MCP server, the certification harness, the policy examples, and the fixtures — everything the other install routes leave out.

> [!WARNING]
>
> The source repository is private, so this route needs access to it. To *use* Warden, [Homebrew](https://warden.buildlab.in/install/homebrew.md) or [the container image](https://warden.buildlab.in/install/docker.md) serve public artefacts built from it.

## Prerequisites

| | |
| - | - |
| Go | 1.25 or newer |
| C toolchain | Required — Warden compiles PostgreSQL's parser ([why](https://warden.buildlab.in/install/go-install.md)) |
| PostgreSQL client and server | Optional, for the PostgreSQL connector's tests and certification |
| MongoDB server | Optional, for the MongoDB connector's tests and certification (a single-node replica set — transactions do not exist on standalone) |
| Neo4j server | Optional, for the Neo4j connector's tests and certification |
| Docker | Optional, for the compose stack |

## Build

```bash theme={null}
git clone https://github.com/Abhishek-Mallick/Warden.git warden && cd warden
make build          # bin/warden, stamped with the git description
go build -o bin/warden-mcp ./mcp/warden-mcp
```

## Verify your build

```bash theme={null}
make check          # format, vet, layering rule, lint, tests, memory certification
go test -race ./... # the pause/approve paths are concurrent by nature
```

`make check` is what CI runs. The layering rule (`make importguard`) is worth knowing about: nothing above the connector layer may import a database driver, and CI fails if that stops being true.

## Run it against a real PostgreSQL

```bash theme={null}
make pg-fixture     # creates warden_dev, the schema, and a least-privilege role
make pg-serve       # runs the gateway against it on 127.0.0.1:9470
```

`make pg-fixture` creates a `warden_gateway` role with no superuser and no `BYPASSRLS` — the connection Warden itself uses is least-privilege, so a gateway compromise is bounded by the grant. It also creates `warden_agent`, the `NOLOGIN` role that holds what agents may touch, and the two functions that create and drop one role per lease inside it. The gateway may call those functions but can't create roles itself.

```bash theme={null}
make pg-cert                      # certify the connector against that database
make pg-serve-strict              # the strict policy: exact previews, fences, and
                                  # a real database role per lease
```

Remove `lease_role` from `warden-strict.yaml` and it refuses to start. That refusal is a feature and a test: a connection cannot serve traffic with a guarantee its policy requires and its engine cannot provide.

## Run it against a real MongoDB

```bash theme={null}
docker run -d -p 27017:27017 mongo:7 --replSet rs0 --bind_ip_all
docker exec <container> mongosh --quiet --eval 'rs.initiate({_id:"rs0",members:[{_id:0,host:"localhost:27017"}]})'
WARDEN_MONGO_DSN='mongodb://localhost:27017/?directConnection=true' make mongo-fixture
```

Then point a connection at it as in [MongoDB](https://warden.buildlab.in/engines/mongodb.md#setting-it-up), and `make mongo-cert` to certify the connector.

> [!NOTE]
>
> If another `mongod` already owns port 27017 — very common with a Homebrew install — connections meant for the container reach the local standalone instead, and the suite fails confusingly. The connector now names that mismatch outright, but the fastest check is still `lsof -nP -iTCP:27017 -sTCP:LISTEN`: if a non-Docker `mongod` is listening, either stop it or publish the container on a free port (e.g. `-p 27018:27017`) and point `WARDEN_MONGO_DSN` at that port with `?directConnection=true`.

## Run it against a real Neo4j

```bash theme={null}
docker run -d -p 7474:7474 -p 7687:7687 -e NEO4J_AUTH=neo4j/password neo4j:5
make neo4j-fixture   # wipes and reseeds the database with the fixture graph
```

Then point a connection at it as in [Neo4j](https://warden.buildlab.in/engines/neo4j.md#setting-it-up), and `make neo4j-cert` to certify the connector.

> [!WARNING]
>
> `make neo4j-fixture` wipes the configured database first — Community serves only the default database, so run this against a throwaway server, never against data you keep.

## Useful targets

| Target | What it does |
| - | - |
| `make check` | Everything CI runs |
| `make test-race` | The race detector over the whole tree |
| `make cert` | Certify the in-memory reference connector |
| `make pg-cert` | Certify PostgreSQL against your local database |
| `make mongo-cert` | Certify MongoDB against your local replica set |
| `make mongo-fixture` | Seed the MongoDB development database |
| `make neo4j-cert` | Certify Neo4j against your local server |
| `make neo4j-fixture` | Wipe and reseed the Neo4j development database |
| `make pg-inspect` | Print the capability ladder, catalog, and the IR for a corpus of tricky statements |
| `make mcp-backtest` | Drive the MCP shim over stdio against a running gateway and assert every answer |
| `make cover` | Coverage summary |

## Repository layout

| Path | What lives there |
| - | - |
| `cmd/warden` | The gateway binary and CLI |
| `cmd/wardencert` | [The certification harness](https://warden.buildlab.in/offerings/wardencert.md) |
| `mcp/warden-mcp` | [The MCP server](https://warden.buildlab.in/offerings/mcp-server.md) |
| `internal/` | The product: gate, connectors, policy, masking, audit, leases, IR |
| `pkg/` | The two public packages: error taxonomy and IDs |
| `certification/` | Profiles and cases every connector must pass |
| `deploy/` | Example configurations and policies |
| `web/` | This documentation site |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.