What is Warden?

Runtime governance for AI coding agents. — Changelog

Warden is the runtime governance layer for coding agents. It intercepts tool calls before they reach your environment, enforces safety policy deterministically, compresses noisy output, and provides bounded session guidance to keep long runs productive.

Warden works with Claude Code, Gemini CLI, and Codex CLI. It installs in one command, requires zero configuration, and runs silently in the background. When a session is healthy, you won’t know it’s there. When things start degrading, Warden intervenes.

Privacy & Locality

Every safety decision, every session signal, every output compression happens on your machine.

• No telemetry. No analytics, no usage tracking, no phone-home.
• No cloud dependencies. All rules are compiled into the binary. No downloads, no external services during operation.
• Your code stays on your machine. Warden reads tool call metadata (command names, file paths, exit codes). It does not read, copy, or transmit your source code.
• Free to use. No subscription, no premium tier.

The update and install commands fetch releases from GitHub. No other network calls are made.

What Warden Does

Warden makes four kinds of interventions:

• Blocks dangerous actions. Destructive commands, credential leaks, hallucinated flags, and unsafe patterns are denied before they execute. The agent receives an explanation and a safe alternative.
• Compresses noisy output. Recognised verbose commands — build logs, test suites, install output — are piped through a filter that keeps errors, warnings, and summaries and drops the rest.
• Teaches better tool choices. When the agent reaches for a legacy tool, Warden redirects it to a faster modern alternative (grep → rg, find → fd). The agent learns the substitution and uses it for the rest of the session.
• Guides struggling sessions. Warden monitors focus, detects loops, tracks verification debt, and injects targeted corrections when a session drifts. Healthy sessions run silently.

How It Works

Your assistant’s hooks fire on every tool call. Warden registers itself there, checks the call against its compiled patterns in a single pass, and returns one of five verdicts — pass, deny, teach, apply, or require structure. Almost every call gets the first one, silently.

The evaluation is deterministic for safety rules and heuristic for session guidance; the two are documented separately. The full flow is in How It Works.

What Warden Is Not

• Not a harness framework. Warden doesn’t orchestrate multi-agent workflows or coordinate planner/generator/evaluator loops. It governs individual agent sessions from the inside. Harnesses and Warden are complementary — a harness coordinates the work, Warden makes each agent’s session safer.
• Not a memory platform. Warden tracks session state and carries forward a compact resume between sessions. It doesn’t store long-term knowledge graphs or semantic memories.
• Not a hosted service. Everything runs locally. No cloud, no SaaS, no API keys.
• Not a replacement for the agent. Warden doesn’t generate code, write tests, or make architectural decisions. It makes the agent better at doing those things by keeping it safe, focused, and efficient.

Supported Agents

The rule engine is the same on all three: safety, substitution, output compression, and prompt-time context run behind the pre-tool, post-tool, prompt, and session hooks that every host provides.

Coverage past that point follows what each host exposes. Codex CLI carries nearly the full surface — permission observation, compaction memory, and subagent tracking included. Gemini CLI adds pre-compaction memory and MCP output handling, but its hook API has no permission, post-compaction, subagent, or task-completion events. Post-tool failure guidance and task completion remain Claude Code only.

The per-capability breakdown is in Assistant Boundary.

What’s Next

• Installation — install and connect to your AI assistant
• How It Works — the hook flow, end to end
• Runtime Policy — how Warden evaluates tool calls and the five decision types
• Rule Engine — compiled safety and quality patterns
• Session Intelligence — how Warden tracks session health
• Commands — warden init, warden watch, warden uninstall, and the debug tools
• config.toml — customizing Warden’s behavior