Skip to main content
warden is the product. Everything else exists to reach it, prove it, or ship it. It is a single statically-configured server process. You give it a configuration file naming your database connections, the agents allowed to use them, and the policy each connection is governed by. It opens the database connections itself, so the credentials live in one place that no agent can reach.

​
What it does with an operation

Every request from every agent travels one path, in this order:
Two orderings are load-bearing:
  • Deduplication happens before the gate, so a retry of something a human already approved replays instead of asking them again.
  • Rewriting happens before the gate, so the human approves the statement that will actually run — scope conjunct, column list, masks and all — rather than the one the agent wrote.

​
Running it

At startup it prints the capability ladder for every connection, the state directory, and any warnings (a plaintext listener, a key in the config file, a recovered journal). A connection whose engine cannot meet its policy fails startup rather than serving traffic with a guarantee quietly missing.
The gateway is stateful on disk but not on a database: the audit chain, leases, and idempotency keys are append-only journals under data_dir. No second database is needed to run Warden, and nothing on the decision path talks to one.

​
The CLI

warden is also the operator’s command-line tool: See the CLI reference.

​
The HTTP surface

One port serves three things, separated by credential:
  • Data plane (agent keys): execute an operation, describe the schema the agent may see, confirm identity, and poll an async proposal. Reference.
  • Control plane (operator tokens): pending approvals, debug sessions, leases, agents, audit, and a live event stream. Reference.
  • Operator view (operator token): the browser interface at /. More.

​
Requirements

​
Install it

Homebrew

macOS and Linux, one command, with warden-mcp alongside.

Container image

Distroless, non-root, for a server deployment.

go install

If you already have a Go toolchain and a C compiler.

From source

The full clone, with fixtures and the certification suite. Needs access to the private repository.