Drop-in MCP security middleware: audit · policy · human-approval · injection defense
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"always-ready-allies-llc-warden-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# 🛡️ Warden [](https://pypi.org/project/warden-mcp/) [](https://pypi.org/project/warden-mcp/) [](LICENSE) **Drop-in security middleware for MCP.** Point your AI client at Warden instead of the raw tool-server — one line of config, zero code changes — and every tool call is logged tamper-evidently, allowed/denied/gated by policy, held for human approval when it's dangerous, and scanned for prompt-injection and secret/PII exfiltration. > Everyone's building agents. Warden makes them safe to run. ## How it works ``` AI client ──MCP──▶ WARDEN ──MCP──▶ downstream MCP servers policy · audit · approval · guard (filesystem, github, payments, …) ``` Warden is an MCP **server** to your client and an MCP **client** to each real server. It aggregates their tools (namespaced `server__tool`) and routes every `tools/call` through: **policy → audit(request) → guard(args) → [deny | approve | allow] → forward → guard(result) → audit(response)** ## Quickstart ```bash uvx warden-mcp init # write a starter warden.yaml uvx warden-mcp run --config warden.yaml uvx warden-mcp audit verify # prove the audit log wasn't altered ``` Rug-pull defense (TOFU tool-definition pinning) is **on by default** — a downstream tool whose definition changes after you first approved it is quarantined until you re-approve it. ### Optional: tamper-evidence against a hostile operator The plain audit log detects edits-without-rechain. To make tampering detectable even by someone with write access to the host, enable **forward-secure sealing** (stdlib, no extra deps): ```bash uvx warden-mcp audit setup-keys --out warden.seed # prints a VERIFICATION SEED — store it OFF-box uvx warden-mcp run --seal-state warden_seal_state.json --anchor heads.jsonl u…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.