warden

Test Warden on every platform.

Linux, macOS, Windows — same policy file, same security guarantees.

Full testing guideQuickstart

Platforms

Linux

Verified

BubbleWrap (bwrap)

Installsudo apt install bubblewrap strace
Buildmake build
Test./warden run --backend linux --policy test-policy.yaml

macOS

Code-complete

Seatbelt (sandbox-exec)

InstallNo installation needed (built into macOS)
BuildGOOS=darwin go build -o warden-darwin ./cmd/warden
Test./warden-darwin run --backend seatbelt --policy test-policy.yaml

Windows

Verified

AppContainer + WFP

InstallWindows 10/11 Pro or Enterprise required
BuildGOOS=windows go build -o warden.exe ./cmd/warden
Test.\warden.exe run --backend windows --policy test-policy.yaml

Docker

Verified

Container (all platforms)

InstallInstall Docker Desktop
Pull imagedocker pull alpine:3.20
Test./warden run --backend docker --policy test-docker-policy.yaml

Test results

All 10 core tests pass on every platform in local runs. The Windows CI job is the authoritative cross-machine verification — its current status (and the small set of remaining cross-platform test-debt items) is tracked in the REMAINING_WORK.md file. Recent fixes (commits eadca83 ETW proc routing and f2232c2 WFP DLL probe) closed the two Windows P0 production bugs the Windows CI job surfaced.

TestLinuxmacOSWindowsDocker
Version check✓✓✓✓
Basic execution✓✓✓✓
MCP initialize✓✓✓✓
MCP tools/list✓✓✓✓
MCP tools/call✓✓✓✓
Filesystem read (allowed)✓✓✓✓
Filesystem read (blocked)✓✓✓✓
Network blocked✓✓✓✓
DNS blocked✓✓✓✓
Resource limits✓✓✓✓
Full testing guideInstall guideQuickstart