Skip to main content
Warden ships executables and an image. It is not a library you add to an agent’s dependencies.

​
The artefacts

warden and warden-mcp ship in the same archive and the same Homebrew formula: an agent host usually needs the shim, and an operator usually needs the gateway, and keeping them in step avoids a version skew between the two halves of one conversation.

​
Which do I need?

I want to try it

The compose stack. Warden, a PostgreSQL, and seed data in one command.

I run the database

The gateway, from Homebrew or the container image, pointed at your database with a policy.

I build the agent

The MCP server if your agent speaks MCP; otherwise call the HTTP data plane directly.

I am reviewing this for security

The certification harness, plus the capability ladder your connection prints at startup.

​
What a deployment looks like

The agent holds an agent key, never a database credential. Reviewers hold operator tokens with separate capabilities. The database credential exists only in the gateway’s configuration.

​
Open artefacts, closed source

The source repository is private. Everything you install from is public: Neither public repository contains source code. warden-mcp is the one component whose code is meant to be read, and it contains no enforcement logic by design — see the MCP server.

​
Versioning and support

  • Releases are tagged vX.Y.Z and carry binaries for macOS and Linux on both CPU architectures, plus a checksums.txt. See releases and verification.
  • Pre-1.0. The HTTP API, the policy file, and the configuration file may change between minor versions. Breaking changes are called out in the release notes.
  • The certification suite is the compatibility contract for connectors. A connector that passes wardencert -strict behaves as this documentation describes; one that does not is not shipped.

​
Licence

Warden is proprietary. The binaries are freely downloadable; the source is not published. You may install and run them for your own internal purposes, including in production. You may not redistribute them, offer them as a service, or reverse engineer them. The full terms ship inside every release archive as LICENSE.md, alongside THIRD-PARTY-NOTICES.md — the open-source libraries Warden links carry their own licences, and those notices travel with the binary as those licences require.