Give MCP servers a sandbox, not your filesystem.

From install to a sandboxed server in four steps. No daemon, no config files beyond the policy, no changes to your existing MCP setup.

Quick Start

Step 1 of 4

Install Warden

Install the CLI globally via npm. Works on Linux, macOS, and Windows.

Step 2 of 4

Create a policy

Run the interactive wizard. It asks what the server needs and drafts a deny-by-default YAML policy.

Step 3 of 4

Run the server sandboxed

Point Warden at the policy and the server command. The sandbox enforces every grant.

Step 4 of 4

Inspect what was blocked

The audit log records every allow and deny decision. Tail it live or review after the session.

01/04

01020304

Quick Start01

Install Wardennpm install -g warden-sandbox-cli

02

Create a policywarden init

03

Run the server sandboxedwarden run --policy policy.yaml -- ...

04

Inspect what was blockedwarden logs --tail

Step 1 of 4

Install Warden

Install the CLI globally via npm. Works on Linux, macOS, and Windows.

What's supported.

Every item below ships in the CLI today and is covered by the test suite. Nothing on this page is a roadmap promisethat list lives separately, labeled as roadmap.

Capabilities

Step 1 of 8

Filesystem

Deny-by-default read/write grants. Anything unlisted is invisiblenot merely unreadable.

Step 2 of 8

Network

Egress hostname allowlist with DNS blocked before resolution. No grant, no connection.

Step 3 of 8

Environment

Only named variables pass through. Empty allowlist means an empty environment.

Step 4 of 8

Limits

Wall-clock timeout and memory caps enforced by the kernel, with process-tree termination.

Step 5 of 8

Audit

Every allow/deny decision lands in a JSONL log you can tail with `warden logs`.

Step 6 of 8

Policy tooling

`warden trace` records real access, `warden init` drafts the policy, `warden doctor` verifies readiness.

Step 7 of 8

MCP client proxy

`warden proxy` filters JSON-RPC in both directionstool allowlists, secret deny patterns, payload capsfor local stdio and remote HTTPS upstreams.

Step 8 of 8

CI and deployment

A GitHub Action wraps CI jobs in the same policy; `warden k8s render` emits hardened Deployment + NetworkPolicy manifests.

01/08

0102030405060708

Capabilities01

FilesystemDeny-by-default read/write.

02

NetworkHostname allowlist.

03

EnvironmentNamed variables only.

04

LimitsTimeout + memory caps.

05

AuditJSONL decision log.

06

Policy toolinginit → trace → doctor.

07

MCP client proxyJSON-RPC filtering.

08

CI and deploymentGitHub Action + K8s.

Step 1 of 8

Filesystem

Deny-by-default read/write grants. Anything unlisted is invisiblenot merely unreadable.

The Windows backend stacks four OS-native primitives so each sandboxed MCP server gets exactly the access its policy allows — no more, no fallback, no silent escalation.

Windows Layers

Step 1 of 4

AppContainer Token

Every sandboxed process runs under a LowBox token that denies all filesystem, network, and environment access by default. The token is the hard boundaryno syscall can cross it.

Step 2 of 4

WFP Egress Filters

Windows Filtering Platform rules permit only the loopback proxy bridge and block every other outbound connection. DNS is denied by the token; TCP is denied by the filters.

Step 3 of 4

Job Object Limits

Wall-clock timeout, memory cap, and kill-on-close are enforced by the kernel. A runaway process is terminated with its entire treeno orphaned children.

Step 4 of 4

ETW Audit Trail

A private real-time trace session captures kernel file I/O events scoped to the sandbox tree. Every file access is logged, not guessedthe audit is the product.

01/04

01020304

Windows Layers01

AppContainer TokenLowBox token denies all.

02

WFP Egress FiltersTCP + DNS blocked.

03

Job Object LimitsTimeout + memory + kill.

04

ETW Audit TrailKernel file I/O trace.

Step 1 of 4

AppContainer Token

Every sandboxed process runs under a LowBox token that denies all filesystem, network, and environment access by default. The token is the hard boundaryno syscall can cross it.

• AI Tried to Escape My Sandbox. It Couldn't.

  I built Warden to sandbox MCP servers, then gave AI a scenario to break out. On Linux 8/8 proof-harness steps held; on Windows 5/5 attack scenarios were blocked. Here's the evidence.

  Read article →

• Deny-by-Default: Why 'Permission Denied' Isn't Enough

  Warden makes ungranted paths invisible instead of unreadable — bind mounts, not permission bits. Why invisibility is the stronger boundary, and how it's tested.

  Read article →

• I Tested 18 MCP Servers Against a Sandbox. Here's What Happened.

  14 pass, 2 conditional, 2 fail — the full compatibility matrix for running real-world MCP servers under Warden, with pinned policies and honest failure classifications.

  Read article →