Warden is featured on Product Hunt

Vote for us
warden
warden

Warden

Your MCP servers run with your keys to the kingdom. Warden takes them back.

Every MCP server you installthat filesystem helper, that Slack bot, that script you cloned five minutes agoruns as a plain process with your full permissions: your SSH keys, your tokens, your files, unrestricted network. Nothing in the MCP protocol stops a buggy or malicious server from reading ~/.ssh or exfiltrating data. Most installs are one npx command away from total access.

Warden runs each server in a restricted sandbox instead. A server only ever sees the files, network hosts, and environment variables you explicitly grant iteverything else is invisible. Sandboxing is invisible to the protocol: your MCP client talks to the sandboxed server exactly as before.

warden run --policy ./policy.yaml -- node ./my-mcp-server/index.js

How it works in 30 seconds

Write a policy describing what the server may touch:

# policy.yaml
command: ["/usr/bin/node", "server.js"]
filesystem:
  read: ["./data"]
  write: ["./output"]
network:
  allow: ["api.github.com"]
env:
  allow: ["GITHUB_TOKEN"]
limits:
  memory_mb: 512
  timeout_s: 300

Run it sandboxedor generate the policy automatically by watching the server once, unsandboxed:

warden run --policy policy.yaml
# or:
warden trace -- /usr/bin/node server.js && warden init

Why Warden

  • Filesystemonly granted paths exist inside the sandbox, read-only or read-write as you specify. The rest isn't "permission denied"it's gone.
  • Networkonly allowlisted hostnames resolve and connect. Everything else is blocked before DNS even resolves.
  • Environmentonly the variables you name are passed through. Your shell environment never leaks in by default.
  • Audit logevery access attempt, allowed and blocked, is recorded. See what a server tried to do with warden logs.
  • Single static binary, near-zero overheadsandboxing a server is no harder than running it. No daemon, no containers per run.

Proven against real servers

Warden is tested against **18 real-world MCP servers14 pass, 2 conditional, 2 fail (documented)**each with its exact policy pinned as a regression fixture, so updates can't silently break what used to work. Check whether your server works before installing:

→ Compatibility Matrix · → Beta Program

Get started

  1. **Install**Linux, macOS, Windows, Docker fallback, or build from source
  2. **Quickstart**your first sandboxed run in five minutes
  3. **Example Policies**copy-paste policies for filesystem, GitHub, Slack, Postgres, and Brave Search
  4. **Schema Reference**every policy.yaml field
  5. **CLI Reference**every command and flag
  6. **FAQ**common failures and fixes
  7. **Roadmap**what's built and what's next

Status: beta. Core sandboxing (Linux, macOS, Windows, Docker fallback), tracing, approval mode, and gateway integration are implemented and tested. Distribution is live: npm (warden-sandbox-cli) and GitHub Releases binaries; Homebrew tap is still pending. You can also build from source. See the Roadmap and About pages for details.

← How to use WardenInstallation →