Warden is featured on Product Hunt
Vote for us
About
Sandbox every server by default.
Modern AI tooling runs third-party code with first-party trust. MCP servers install with a one-liner and inherit everything you can do. Warden exists to make the safe path the easy pathwith a policy file small enough to read in one sitting.
100%
open source · MIT
3
OS-native backends
18
servers tested
7/7
escape tests contained
The problem
Third-party code, first-party trust.
Every MCP server you install runs with your full permissionsyour SSH keys, your cloud credentials, your entire filesystem. One malicious or compromised package is all it takes.
Why not just Docker?
Too heavy for one script.
Docker worksWarden uses it as a fallback. But slow cold starts, a daemon dependency, and a far bigger trust boundary than a namespace sandbox needs. Warden is a single static binary over OS-native primitives, so sandboxing costs almost nothing.
Principles
Four rules, no exceptions.
01
Deny by default
Unlisted paths, hosts, and env vars are invisiblenot merely blocked.
02
Fail closed
No valid backend means no run. Warden never falls back silently.
03
Everything logged
Every allow and deny lands in a JSONL audit log you can grep.
04
OS-native
Bubblewrap, Seatbelt, AppContainerone static binary, near-zero cost.
Team
Built by people who run agents.
Status: beta
v0.1.17- Linux sandbox (bubblewrap)Filesystem, network proxy, audit, limits
- macOS sandbox (Seatbelt)With Docker fallback
- Windows sandboxAppContainer + WFP + ETW audit, fail-closed
- trace / init / logsObserve, generate, inspect
- Approval modePrompt instead of hard-fail
- Gateway integrationWrap gateway-registered servers
- Compatibility matrix18 servers, 14 pass
Security posture
Deny-by-default on filesystem, network, and environment. No silent fallback to unsandboxed runsa missing backend fails loudly. Every blocked access is logged. Known limitations (no CPU throttling, no unix-socket grants) are documented, not buried.
warden · MIT licensed