Sandbox every server by default.
Modern AI tooling runs third-party code with first-party trust. MCP servers install with a one-liner and inherit everything you can do. Warden exists to make the safe path the easy path — with a policy file small enough to read in one sitting.
Why not just use Docker?
You can — Warden uses it as a fallback. But Docker is heavyweight for “run one script with a restricted home directory”: slow cold starts, a daemon dependency, and a far bigger trust boundary than a namespace sandbox needs. Warden is a single static binary over OS-native primitives, so sandboxing a server costs almost nothing.
Status: beta
- Linux sandbox (bubblewrap)Filesystem, network proxy, audit, limits
- macOS sandbox (Seatbelt)With Docker fallback
- Windows sandboxAppContainer + WFP + ETW audit, fail-closed
- trace / init / logsObserve, generate, inspect
- Approval modePrompt instead of hard-fail
- Gateway integrationWrap gateway-registered servers
- Compatibility matrix18 servers, 14 pass
Security posture
Deny-by-default on filesystem, network, and environment. No silent fallback to unsandboxed runs — a missing backend fails loudly. Every blocked access is logged. Known limitations (no CPU throttling, no wildcard hosts, no unix-socket grants) are documented, not buried.
warden — MIT licensed