OPEN-SOURCE MCP GATEWAY

A control plane for AI tool access.

Warden sits between your MCP clients and your MCP servers. It puts many servers behind one endpoint, screens every tool for poisoning and injection, and traces every call. The detection numbers come from a benchmark you can run yourself, and the measured overhead is under a millisecond.

View on GitHub

93.5% F1 detection
~0.6ms overhead
MIT · v0.1.0

warden-gateway

$ warden-gateway --http

▲ warden v0.1.0 · streamable http
✓ federated 3 servers · 41 tools
⚠ quarantined 1 tool: px__get_weather (tool-poisoning)
→ listening on http://127.0.0.1:3000/mcp

THE THREAT MODEL

Individual MCP servers can't protect you.

MCP lets your agent call tools, but no single server can see across the others. Warden is the one place every call goes through.

Tool poisoning

A poisoned tool description can hijack your model before a single call is made.

Every description is screened

Prompt injection

A prompt-injected tool result can exfiltrate secrets right past your agent.

Outputs are scanned in flight

No unified control

Ten servers means ten endpoints, ten auth stories, and no shared audit trail.

One gate, one audit log

CORE FEATURES

What Warden does.

Security

Tool-poisoning & prompt-injection detection, per-client and per-tool policy, rate limiting, and approval gates for dangerous tools. Malicious tools are quarantined out of the catalog before your agent ever sees them.

poisoning & injection detection
per-client / per-tool policy
rate limiting
approval gates

Observability

An OpenTelemetry trace for every tool call, structured JSONL audit logs, and a/metrics endpoint. It adds no overhead when turned off.

Federation

Put many MCP servers behind one endpoint. The tool catalog is unified and namespaced per server, and tools/call routes to the server that owns the tool. Your client connects to one gateway instead of many.

HOW IT WORKS

How a tool call flows through Warden.

Your client connects to one endpoint. Warden screens, routes, and records every call. Clean calls pass through. Poisoned tools are quarantined.

MCP client

Claude, Cursor, any MCP client

Warden

policydetectorrate limitaudittraces

MCP servers

filesystem, github, internal tools, …

Example: a poisoned tool, blocked

terminal

$ inspector --cli warden-gateway --method tools/call \
    --tool-name px__get_weather --tool-arg city=Berlin
MCP error -32600: [warden] tool "px__get_weather" is quarantined

flagged:concealmenthidden-tagsensitive-filetool-shadowing

Benchmark results you can reproduce.

Warden ships a security benchmark and a performance harness. Both run against a committed corpus, and you can run them yourself.

Detection

0.0%

F1 score, default llm tier

93.9% precision, 93.0% recall, and a 98.0% detection rate on a labeled corpus of 193 tool definitions (100 malicious, 93 benign). Offline heuristic rules screen first. A gemini-3.1-flash-litejudge then reviews anything the rules don't settle, which costs about 7 cents per 1,000 tools. Results are cached per tool, and if the API fails the scan falls back to the heuristic verdict.

Reproduce with pnpm eval --tier llm

Overhead

~0.0ms

median added latency

The full security layer adds about 0.1ms on top of passthrough. Judge latency (about 674ms per tool) is paid once on tools/list, not on every call.

scenario	p50
direct	0.513ms
warden passthrough	1.115ms
warden full-security	1.208ms

Reproduce with pnpm bench

Why the judge earns its keep

The corpus doubled and no detector rule was changed. The 100 new entries cover attack families the rules were never written for: rug pulls, schema injection, and destructive persistence. Keyword matching blocks zero of the 51. The judge catches 86.3% of them. The rules only match attacks someone already wrote a pattern for. The judge catches ones nobody wrote a rule for.

metric	heuristic	llm
Precision	87.8%	93.9%
Recall	43.0%	93.0%
F1	57.7%	93.5%
Detection rate	51.0%	98.0%
Cost / 1k tools	$0	~$0.072

heuristicllmrecall by attack category

tool-poisoning (26)61.5% → 92.3%

data-exfiltration (21)61.9% → 95.2%

prompt-injection (18)38.9% → 94.4%

obfuscation (12)33.3% → 91.7%

credential-theft (10)30.0% → 90.0%

destructive (5)0.0% → 100.0%

rug-pull (4)0.0% → 100.0%

schema-injection (4)0.0% → 75.0%

Running in 60 seconds.

Works with Claude, Cursor, and any MCP client, over stdio or Streamable HTTP.

npm

# install from npm, no clone needed
npm install -g warden-gateway

# point warden.config.yaml at your MCP servers, then run:
warden-gateway --http  # serves http://127.0.0.1:3000/mcp

warden.config.yaml

# warden.config.yaml: point warden at your MCP servers
servers:
  - name: filesystem
    command: npx
    args: ["-y", "@modelcontextprotocol/server-filesystem", "."]
  - name: github
    command: npx
    args: ["-y", "@modelcontextprotocol/server-github"]

security:
  detector:
    tier: llm # "heuristic" runs offline with no API key
    provider: gemini # or "anthropic"
    scanDescriptions: true
    scanOutputs: true
    mode: block

HTTP mode supports Bearer API-key auth via http.auth.apiKeys or the WARDEN_API_KEYS env var. /healthz stays open for probes; /mcp and /metrics require the key.

The llm detector tier reads GEMINI_API_KEYfrom the environment. If it's missing, Warden logs a warning and runs the heuristic tier only.

Who it's for.

Wiring an agent to many tools

Federate them behind one namespaced endpoint.

Running untrusted MCP servers

Screen every third-party tool definition and output.

Shipping AI features to production

Auth, timeouts, retries, metrics, health probes, Cloud Run deploy.

Debugging & compliance

An OTel trace and audit line for every single tool call.

IN ONE SENTENCE

Warden is one endpoint in front of all your MCP servers. It checks every tool before your agent can use it, routes each call to the right server, and records what happened.

ABOUT THE CREATOR

Parvesh

Creator of Warden

Warden is designed and built by Parvesh.

GitHub npm

Get started with Warden.

Install it, point it at your servers, and every tool call goes through one place.

GitHub npm