warden

About Warden

About Warden

Mission

Modern AI tooling runs third-party code with first-party trust. MCP servers are installed with a curl pipe or an npx one-liner and immediately inherit everything the user can do. Warden exists to make the safe path the easy path: sandbox every MCP server by default, with a policy file small enough to read in one sitting.

Why not just use Docker?

You can — and Warden uses it as a fallback. But Docker is heavyweight for "run one script with a restricted home directory": slow cold starts, a daemon dependency, and a far bigger trust boundary than a namespace sandbox needs. Warden is a single static binary over OS-native primitives (bubblewrap on Linux, sandbox-exec/Seatbelt on macOS with a Docker fallback, AppContainer + WFP on Windows), so sandboxing a server costs almost nothing.

Project status

Warden is in beta. Implemented and tested:

AreaState
Linux sandbox (bubblewrap)✅ Filesystem, network egress proxy, audit, limits
macOS sandbox (Seatbelt)✅ With Docker fallback
Windows sandbox (AppContainer/WFP/ETW)✅ Fail-closed, no unsandboxed fallback
trace / init / logs✅ Observe, generate, inspect
Approval mode (--approve)✅ Prompt instead of hard-fail
Gateway integration✅ Wrap gateway-registered servers
Compatibility matrix✅ 18 servers, 14 pass — see Compatibility

Coming soon: Homebrew tap, npm wrapper publishing, and the external beta program (join it). Track milestones in roadmap.

Security posture

Deny-by-default on filesystem, network, and environment. No silent fallback to unsandboxed runs — a missing backend fails loudly. Every blocked access is logged. Known limitations (no CPU throttling, no wildcard hosts, unix-socket grants, Seatbelt deprecation) are documented honestly in the Security Review and Compatibility pages — not buried.

License and links

Interactive Approval Mode →