Warden Ai

Verified context for AI coding agents.

Your AI agent burns tokens on noise. Warden stops that.

Less context. More signal. Verified.

Every token your agent spends on noise is a token it didn't spend on your actual problem. Warden fixes this.

Warden is a local context layer for AI coding agents. It drops into Claude Code, Cursor, Codex, Windsurf, Cline, Gemini, and other MCP-compatible agents it detects on your machine. Install once. Warden removes unnecessary tool-output noise while preserving the lines the agent actually needs to see.

Large per-call reductions on noisy tool output. Zero config. Zero cloud. Zero lock-in.

Benchmarked. 25-task suite. 71.4% tool-output reduction. 100% guard pass rate. ~24ms avg overhead. Full methodology and caveats in benchmarks/HONEST-NUMBERS.md.

Why Warden?

Most context optimizers simply remove or summarize information. Warden verifies the reduction.

Raw agent output → Warden → Intelligent reduction → Verification → Agent

This is the differentiator: not just compression, but verified compression. You don't have to trust that Warden got it right — the trust guard proves it on every call.

Warden AI is a local context layer for AI coding agents. It is not a security firewall, authentication system, agent framework, or infrastructure management tool.

Install

All platforms (macOS, Linux, Windows, WSL):

npm install -g warden-ai && warden init

macOS / Linux / WSL (curl one-liner):

curl -fsSL https://raw.githubusercontent.com/rynald0cst0ltziam/Warden-AI/main/install.sh | bash

Windows (PowerShell one-liner):

irm https://raw.githubusercontent.com/rynald0cst0ltziam/Warden-AI/main/install.ps1 | iex

Windows users: do NOT use the curl command in CMD or PowerShell — bash triggers WSL on Windows. Use the PowerShell or npm command above.

~10 seconds · Node >= 22.5 · only configures agents you actually have · safe to re-run · reversible with warden uninit

warden init sets up only the agents detected on your machine:

warden init never rewrites your instruction files, only configures agents it detects (use --all to override), and can be fully undone with warden uninit. Optional, explicit prose compression lives in warden compress (dry-run by default).

Usage

Quick start

npm install -g warden-ai   # install (does NOT change any config on its own)
warden detect              # see which agents Warden found on your machine
warden init                # configure just those agents (safe, reversible)
# restart your agent — Warden now runs automatically

That's the whole setup. From here your agent's tool output is pruned automatically and you don't run any further commands.

warden init flags:

Undo everything Warden wrote (MCP entries, rules blocks, hooks, proxy wrapping):

warden uninit

Everyday commands

warden detect        # which agents are installed (+ the evidence)
warden status        # tokens saved, live rules, recent memories
warden doctor        # health check with actionable fixes
warden hud           # live terminal HUD
warden dashboard     # web UI at http://localhost:7878

Boost — compress at the API level (the deepest cut)

The MCP proxy only sees MCP-server output. warden boost goes a layer deeper: it sits between your agent and the model provider and compresses the whole outgoing request — every tool_result in it, whether it came from a built-in tool (Read/Grep/Bash) or an MCP server, plus accumulated history — behind the trust guard (removal-only, verbatim-verified). The provider's response is streamed back untouched.

Two ways to use it, both zero-config:

Wrap any agent (works for everything that honors provider env vars — Claude Code, Codex, Aider, …):

warden boost -- claude      # or:  warden boost -- codex

This launches the agent with the proxy's base URLs set in its environment, runs it, and tears everything down when the agent exits. No config files are touched.

Or run it bare and let it auto-configure your detected agent:

warden boost                # proxy + auto-configures Claude Code, reverts on stop

Either way, every request your agent sends has its bulky tool output pruned before it reaches the provider — across all tool output (built-in and MCP) and history, not just MCP. One warden boost serves both Anthropic and OpenAI: each request is auto-routed to the right provider by shape.

Options: --port, --upstream <url> (force one provider), --min-block-chars, --no-configure, --no-record, --debug.

Your API key passes straight through to the provider and is never logged or stored. Warden modifies only the request's tool output (removal-only, behind the trust guard); the response is forwarded byte-for-byte. Everything is local. If a bare warden boost is ever killed abruptly, warden unboost restores the agent's configuration (and warden uninit does too).

Proxy one MCP server

warden init wraps your servers automatically, but you can also wrap one by hand. Put Warden in front of any stdio MCP server in your agent's config:

{
  "mcpServers": {
    "github": {
      "command": "warden",
      "args": ["proxy", "--prune-responses", "npx", "-y", "@modelcontextprotocol/server-github"]
    }
  }
}

warden proxy <command> [args...] options:

For a removal-only, nothing-rewritten profile (what warden init uses):

warden proxy --prune-responses --no-lazy --no-compress-schema --no-compress-descriptions <command> [args...]

Gateway — front many servers at once

One Warden process in front of your whole MCP fleet. Write a servers.json:

{
  "mcpServers": {
    "github": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"] },
    "fs": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path"] }
  }
}

Register the gateway as a single MCP server in your agent:

{
  "mcpServers": {
    "warden-gateway": { "command": "warden", "args": ["gateway", "/absolute/path/servers.json"] }
  }
}

The agent sees one merged catalog with tools namespaced github__search, fs__read_file, etc. Each call is routed to the right server and its response is pruned behind the trust guard. Options mirror the proxy (--no-prune, --compress-descriptions, --compress-schema, --level).

Expose all tools

Warden ships a focused 12-tool core surface. To expose all 32 tools, set WARDEN_TOOLS=full on the Warden MCP server entry:

{
  "mcpServers": {
    "Warden": { "command": "warden", "args": ["serve"], "env": { "WARDEN_TOOLS": "full" } }
  }
}

Compress a doc (optional, lossy)

warden compress CLAUDE.md            # dry-run preview only (default)
warden compress notes.md --write     # actually write (backs up to notes.md.original)

Prose compression is lossy, so warden compress previews by default and refuses agent rules files (CLAUDE.md, .cursorrules, …) unless you pass --force. It keeps code, paths, commands, and identifiers verbatim.

Licensing / premium (future)

All features are enabled for everyone today. A future premium tier is scaffolded behind WARDEN_ENFORCE_LICENSE=1; with enforcement off (the default) nothing is gated. Safety features (trust guard, CCR, backups) are never gated.

Trust guard

The trust guard is the non-negotiable rule:

Every non-annotation line in the pruned output must appear verbatim in the raw output. If it doesn't, the raw is shipped instead.

This means Warden removes lines, never rewrites them.

Safety net — always on

Privacy

No cloud. No API server. No telemetry. No analytics. No phone-home.
Your code, tool outputs, and pruning decisions stay in a local SQLite
file on your machine. It works on a plane.

Requirements

• Node.js >= 22.5 (uses built-in node:sqlite)
• Any MCP-compatible AI coding agent

Commands

Tool surface

Every MCP tool's schema sits in the agent's context for the whole session, so Warden exposes a focused core set of 12 tools by default (prune/retrieve, grep, file-read, run-tests, run-command, context-select, memory save/recall, record-outcome, status, handoff). The code-intelligence, memory-lifecycle, and extra reporting tools load on demand when the server runs with WARDEN_TOOLS=full (all 32). A context optimizer shouldn't start by spending your context on its own catalog.

Supported agents

Warden detects and configures the agents it finds installed. Run warden detect to see what's on your machine.

Each has a verified MCP-config location. Detection uses non-circular signals (a binary on PATH, an installed editor extension, or an app bundle) — never a config directory Warden itself writes, so it won't mistake its own leftovers for an installed agent. Missing one that you have? warden init --all configures every known agent regardless.

License

PolyForm Shield 1.0.0 — source-available, free for everyone including commercial use. See LICENSE.

Install · Website · GitHub · npm

Made with ⚡ by Rynaldo Stoltz