SkillFoxx

Warden CLI

A secure gateway between AI agents and enterprise systems: identity, policy and audit instead of long-lived keys in the agent.

  • 185 ★ on the repository
  • Last commit
  • MPL-2.0
CLI

Broad access

Why this level

  • The gateway holds or obtains real enterprise credentials and sits in the path of every agent call.
  • A policy mistake gives an agent excess access to production systems.
All reasons and checks

stephnangue/wardenAuthor:stephnangue

Install

Manual install

curl -sL https://wardengateway.com/install.sh | bash

The first README option: a static binary that is both client and server. A container image and Helm chart exist.

Access and checks

How we review

Broad accessThe tool can change data, run commands or handle secrets.

  • The gateway holds or obtains real enterprise credentials and sits in the path of every agent call.
  • A policy mistake gives an agent excess access to production systems.

This is third-party code. Review the repository files before installing.

What it does

Warden is a single Go binary that is both the command-line client and the server: a gateway between AI agents and the systems they must work in (clouds, code hosts, observability, databases, ITSM, secret stores, MCP servers). The agent presents its own identity, a JWT, TLS client certificate, SPIFFE SVID or Kubernetes service-account token, and addresses Warden as if it were the service itself. For each request the gateway authenticates the identity, checks the call against policy at request time, injects the real upstream credential and proxies the call, streaming the response back unchanged. The agent holds no secrets and gets exactly the access it is allowed. Warden may hold no standing secret at all: it proves to the upstream who is calling and lets it mint the credential, or fetches a secret from an external vault per request. Agents discover which roles and systems are open to them and read a per-system connection recipe at runtime. A `docker run` playground, a Helm chart for a three-replica cluster on Kubernetes 1.27+ and end-to-end audit are provided.

Who it is for. Platform and security teams that give agents access to production systems and want one place for identity, policy and audit instead of a scatter of keys.

Good fit when

  • An agent needs access to a cloud and repositories without being given a long-lived secret.
  • A dozen MCP servers hold a dozen static keys and the team wants them gone.
  • Every agent call must land in one audit trail tied to an identity.
  • A team tries the scheme in a sandbox with a ready identity provider.

Not a fit when

  • A simple skill for a personal computer is needed, while the gateway targets an enterprise setting.
  • There are no resources for Postgres, TLS and a Kubernetes cluster for the high-availability mode.
  • The agent has no identity of its own.

Example request

Start the Warden playground and show an agent reaching the demo system through its own identity without holding a key.

Limitations

This is an infrastructure component for organizations, not a five-minute plugin. High-availability mode needs your own Postgres, your own TLS certificate and either Vault Transit or another auto-unseal method, and the Helm chart targets Kubernetes 1.27 or newer. The `-dev-playground` sandbox with the `root` token is for a first look, not production. Installing through `curl | bash` runs a downloaded script. Warden receives the systems' real credentials, so its protection and access are critical. The description was checked against the README.

How to disable. Stop the container or uninstall the Helm release. Delete the `warden` binary, the Postgres database and the credentials issued to the gateway in upstream systems.

FAQ

How does an agent authenticate?

With its own identity: a JWT, TLS client certificate, SPIFFE SVID or Kubernetes service-account token. Real secrets are never handed to the agent.

What does the gateway do with a request?

It authenticates the identity, evaluates the call against policy, injects the real upstream credential and proxies the request, returning the response unchanged.

Which agents and clients fit?

The getting-started guide covers Claude Code, Codex, Cursor, Gemini CLI, opencode, VS Code and any MCP client, with steps for each.

How do I deploy to a cluster?

Through the first-party Helm chart: a three-replica HA cluster on Kubernetes 1.27+ with your own Postgres and TLS certificate and auto-unseal through Vault Transit.

Can Warden avoid storing secrets?

Yes. It proves to the upstream service who is calling and lets it mint the credential, or fetches a secret from an external vault on each request.

Discussion

No questions or reviews yet.

CLI tools

agent-secrets lends keys to an AI agent for a limited time: age encryption, TTL leases, an access log and an emergency revoke.

CLIBroad access114

A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail

CLIExtended access523

An open protocol, the aac CLI and an SDK from Bitwarden: an agent gets only the credentials it needs from a password manager.

CLIBroad access225

A utility keeps keys in the system keychain and injects them at the transport layer, so the agent never sees a value.

CLIBroad access197

Container-free sandbox for AI agents on Linux and macOS: files, network and syscalls stay closed until you open them explicitly

CLIExtended access315

README in short

The agent gets access by identity and policy, while real keys stay with the gateway or are never stored.

README badge

Report a problem