Pre-1.0Permissions for local AI tools

Don't give AI agents your whole computer.

Warden gives AI tools and MCP servers access only to the files, secrets, and network hosts you approve. Everything else is blocked by default.

Set up Warden View on GitHub

install

$npm install -g warden-sandbox-cli

Linux · macOS · Windows · Docker fallback · MIT

Recorded terminal session · verify the boundary on your own host

The problem

AI tools run with your permissions.

A local agent or MCP server can inherit access to files, environment values, and network destinations available to the user who started it. Warden turns that implicit access into explicit policy.

Files

Keep project access separate from credentials and unrelated folders.

Secrets

Pass only the environment names a tool actually needs.

Network

Allow specific APIs and block undeclared destinations.

Interactive illustration

Same tool. Smaller boundary.

Local tools normally run with your user permissions. Choose a request and toggle Warden to explore an explicit allowlist. This illustration is not a live security test.

ENFORCING

AI agent

mcp client

fs.read

WARDEN

./workspace

granted

./workspace/data.json

● evaluating fs.read at the boundary…

Audit log

agent connecting…

allowed

denied

exposed

New · AI agent workspace

Let the agent edit code. Keep credentials out of sight.

Warden gives Claude, Codex, OpenCode, or another local coding tool a temporary sanitized project. The agent can work on the code it needs without receiving the values you declare as protected.

Hide selected values. Environment names and file fields become opaque placeholders.

Review before applying. Warden shows sanitized changes and waits for your approval.

Fail safely. Failed sessions, tampered placeholders, and rejected reviews leave the host unchanged.

Read the agent workspace guide

agent-policy.yaml review required

agent:
  workspace: ./project
  redaction:
    apply: review
    env: [OPENAI_API_KEY]
    files:
      - path: .env
        format: dotenv
        fields: [DATABASE_URL]

Agent sees

DATABASE_URL=<WARDEN_HIDDEN>

OPENAI_API_KEY=<WARDEN_HIDDEN>

Host changes

sanitized diff

human approval

One policy

Define what the tool needs.

Everything not listed stays outside the sandbox. Keep the first policy small, run it, then expand only when the audit shows a real need.

Explore the policy reference →

filesystem:
  read:
    - ./project

network:
  allow:
    - api.github.com

env:
  allow:
    - GITHUB_TOKEN

Proof, not promises

See how Warden is verified.

The project publishes compatibility fixtures, sandbox proof harnesses, and platform-specific limitations. Verification maturity differs by operating system.

MCP fixtures

pass

backend paths

Read the verification notes →

Start with one local tool.

Install Warden, define what your tool needs, and keep everything else outside the boundary.

npm install -g warden-sandbox-cli

Start setup View on GitHub