alexar76/warden

> canonical AI-Factory monorepo. History here is append-only (no force-push).
> **Pull requests are welcome** — merged PRs are imported back into the monorepo
> and re-synced here, so your contribution becomes canonical.
> 💬 **Issues** · **Pull requests** both welcome.
WARDEN — MCP server
=20" />
> 🌐 **English** · Русский · Español · Français · 中文 · Glossary
> WARDEN quality cycle: MOMUS → AI-Factory → SKOPOS → shared node agent → deployment.
**Check every MCP server on your machine.** No account, no API key, no model. The only network traffic is to the servers in your config.
Against two other open-source scanners on the same servers: on the held-out half of MCPTox (an AAAI 2026 benchmark; WARDEN's rules were written from the other half) WARDEN blocks 171 of 218 poisoned tools, mcp-audit 25, mcp-shield 41; on 986 public servers it blocks 3, they block 33 and 343. Method and every number · scan guide.
> 0.7.0 security changes and migration: vetLaunch, durable pins, anti-rollback, ruleset v6, runtime revalidation.
**One MCP server. Security firewall for advertised tool definitions. Library included.**
Transport: **stdio** (npx -y @aimarket/warden / node dist/mcp-server.js). Compatible hosts:
Claude Desktop, Cursor, Glama, and any MCP client that speaks stdio. No API keys.
| Item | Location |
|------|----------|
| MCP entrypoint (stdio) | warden-mcp → src/mcp-server.ts |
| Tools | vet_mcp_server, static_scan_tools, classify_sensitive_tools, check_egress_url, canonicalize_json, list_scan_rules, status_mcp_server, approve_mcp_server, revoke_mcp_server |
| Library | import { Warden } from "@aimarket/warden" |
| Glama / Docker (stdio) | Dockerfile, glama.json |
| Official MCP Registry | server.json → io.github.alexar76/warden |
| Smithery | smithery.yaml |
An MCP server tells your agent what its tools do. The agent believes it — that sentence is the
attack surface. A tool description is prompt text delivered by a third party straight into your
model's context, and a schema field named api_key is a request for your secrets phrased as an API.
WARDEN vets a server **before any of its tools reach the model**, and returns a verdict you can
record: allow/block, a 0..1 score, the findings that produced it, a per-tool partition, and the
exact rule table that was in force.
**Zero npm runtime dependencies.** The library's only import is node:crypto. The stdio MCP
server adds other node: builtins (fs, path, process) and still pulls in no packages. It is
the firewall out of ARGUS, extracted so you can put it in front
of your own MCP host without adopting an agent.
Protect Claude Desktop or Cursor with one wrapper
**Use 0.8.2 or later: 0.8.0 and 0.8.1 let a wrapped server forge the reply to the client's own tools/list** (CHANGELOG). From source, node /absolute/path/warden/dist/mcp-server.js wrap ... works the same. Adding WARDEN as a separate MCP server does not inspect other servers. Tested end to end with the MCP TypeScript SDK and fixture servers; runs in Claude Desktop and Cursor themselves are not yet recorded (release validation). Replace each protected server’s command with wrap:
For explicit first-contact review, add --require-approval to wrap. It withholds new definitions until warden-mcp pins approve --id filesystem in an operator terminal, then rejects any changed field or launch identity. Automatic/legacy pins need reapproval. See the language-independent admission boundary.
Always specify --id: without it, changing command arguments creates a new identity and a new first contact. A stable ID turns a command or path change into SERVER_IDENTITY_DRIFT. Environment variables are inherited by the child and excluded from identity. To avoid repeated cold npx starts, install globally with npm install -g @aimarket/warden@0.16.0, then use warden-mcp.
The default policy blocks the **whole server** at high severity, pins tool definitions, and allows operator-declared servers. There is no partial mode. The first successful check creates a durable TOFU pin. Later changes, including harmless edits, require human reapproval. With an explicit {"pinToolDefs":false} policy, vetted clean changes can be announced automatically. An unchanged list notification also passes after verification.