The coding agent that does what you asked - and nothing you didn't.
Warden runs your coding agent inside a policy engine. Every action is checked against your rules by the ZSGuard engine before it runs - a verdict in microseconds, so it can't go rogue however the model is talked around. And it holds the agent to the spec you set: your assumptions enforced, with a proof of what each run actually verified.
For developers running agents on code they can't afford to break - client work, production repos, regulated stacks.
Free to run - no credit card, no per-seat pricing. A free developer preview you install on your own machine. Apple Silicon Mac (M1 or later).
Policy-governed by default
Write your guardrails once in plain YAML. Warden enforces them on every tool call your agent makes, across every project.
Verified in microseconds
Decisions come from the ZSGuard engine, not an LLM guessing whether an LLM is safe. Deterministic, auditable, and fast enough to sit in the hot path.
Blocks what hurts
Leaked secrets, git push --force, rm -rf, and destructive commands are stopped with a proof of exactly which rule fired.
One agent, every model
Bring every subscription and key you already pay for.
Warden is model-agnostic. Sign in with the AI subscriptions you already have, plug in cloud and open-source APIs, or run models fully offline on your own machine - and switch between any of them mid-conversation. No lock-in, no second set of bills.
Your subscriptions, via their CLI
Sign in once in each tool's own CLI; Warden drives it over ACP. No API keys, no metered billing.
Cloud & open-source APIs
Bring your own keys for hosted frontier and open-weight models.
Local models
Run open-weight models on your own hardware. Nothing leaves your machine.
Multiple accounts per provider - switch in one click
Keep a work and a personal OpenAI signed in at the same time, a separate Claude account for each client, and flip between them without ever signing out. Warden keeps every account and every model one click away.
Built for people who check the work
An agent and a code editor, in one window.
Warden is not a black box that runs off and merges on your behalf. The coding agent and a full file editor sit side by side, so you see every change, read every diff, and decide what ships. Enforcement on the machine's side, your judgment on yours. Enforcement, not vibes.
Agent
You Add rate limiting to the login endpoint.
Agent Edited auth/login.ts, added a limiter, and ran the tests. 14 passed.
✓ Verified by Warden no blocked actions
Files changed
Review, not just write
It reviews the pull request. You decide what stands.
Point Warden at a pull request and it reviews the diff like a principal engineer - on a model you pick, guided by a review style you set per project. The findings come back as line-anchored comments right on the diff, not a wall of chat. Edit them, delete them, add your own, then post to GitHub as yourself - a comment, an approval, or a request for changes - or hand the whole review back to the agent to make the fixes.
parent_run_id crosses a tenant, this leaks prior-run data. Validate the owner and company scope, or query with those predicates.
Edit · Remove · or add your own on any line
Confidence, not claims
Every run tells you what it proved - and what it didn't.
“Done” from an agent usually just means it stopped. Warden grades each run on a confidence ladder built from checks that actually ran - it typechecks, lints and tests, then verifies the tests aren't vacuous - and shows the evidence next to an equally prominent list of what is not verified. The review is run by a different model than the one that wrote the code, so it's a second opinion, not a self-assessment.
Your rules, in plain YAML
Say exactly what the agent may and may not do.
Policies are short, readable, and as fine-grained as you need. Allow a tool everywhere but carve out the one thing that must never happen - like touching a production instance - and Warden enforces it on every command, returning a proof of exactly which rule fired.
default: allow rules: - block: "git push --force" - block: { touches: dotenv } # never read or write .env secrets - block: rm when: { path: "*/prod/*" } - ask: aws when: { flag.profile: prod } # pause for human approval
default: allow rules: # Redis is fine on dev and staging caches - allow: redis-cli # ...but the production cache is off-limits, # except read-only inspection. - block: redis-cli when: { flag.h: "prod-*" } unless: { subcommand: [GET, MGET, SCAN] }
It can't be talked around
A blocked command stays blocked - however it's disguised.
Guardrails that match on text lose the instant an agent chains, wraps, or path-qualifies a command - or just obfuscates it. Warden decomposes every command to its real effect and checks each piece against your rules. And when a command can't be proven safe ahead of time - a dynamic eval, a piped subshell - it doesn't guess. It fails closed: ask, or block. Prove it, or refuse it.
Choose how strict to be
Three postures - set per project.
Pick a posture for each project: how much Warden blocks or pauses out of the box. Loosen a weekend side project, tighten a client's repo - same agent, different rules, chosen by which project you are in.
Open
The agent runs freely. Only the always-on basics stay enforced - like keeping file access inside the project.
default: allow
Guarded
RecommendedBlocks the dangerous few - secrets, force-pushes, destructive commands - and pauses for approval on risky ones. The agent works freely otherwise.
default: allow · block risky
Hardened
Maximum enforcement: the widest set of protections set to block, the rest to ask. Still a deny-list - a command you haven't named will run.
default: allow · block most
All three are deny-lists - by design
Anything you don't explicitly block runs, Hardened included. Pick a posture, then add the rules you need. ZSGuard's core engine defaults the other way - deny-all - for the production, unattended deployments where nothing should run unless it is named.
Runs you can leave alone
Let it run unattended - with tighter rules for when you're not watching.
Some work should run without you at the keyboard - an overnight refactor, a scheduled cleanup, a batch of fixes. Warden gives an automated run its own, stricter set of permissions, separate from interactive work, so “fine while I'm watching” and “fine on its own” are not the same thing. When an unattended run hits something outside its rules, it stops and holds for you instead of guessing.
context: automated # these rules apply when no human is watching default: allow rules: - block: "git push" # never publish from an unattended run - block: { touches: dotenv } - on-block: hold # stop and wait for a human, don't improvise
Every run is a restore point
Warden snapshots your working tree before each run - stored as lightweight git objects, never committed. If a change isn't what you wanted, put your files back in one click. A restore saves your current state first, so it's always undoable.
Do it once, replay it forever
Chain your skills and checks into one repeatable workflow.
The multi-step things you do again and again - a pre-PR gate, cutting a release, onboarding a new service - become an ordered chain of your own skills and shell commands. Build it by picking steps, run it from chat with a slash command, or bind it to run automatically after the agent edits files. Deterministic, versioned, and stored with the repo - every step still checked by policy, so a repeatable workflow is a governed one.
/pre-pr-checks in chat, or press Run in the project - each step streams its result.
It remembers how you work
Personal memory - private to you, never in the repo.
Shared conventions belong in your repo's AGENTS.md, where the whole team gets them. But how you like to work shouldn't be committed for everyone. Warden captures your preferences as personal memory - kept on your machine, global or per-project - and loads them into context so you stop repeating yourself. Everything it remembers is in one place, for you to read and edit.
# AGENTS.md - versioned with your code - Build: just build - Migrations: never edit applied ones - API errors: return typed Result, never throw
You never start from a blank page
Turn one on, or just describe it.
Enable a ready-made pack in one click, or write a rule in plain English and let Warden generate and test the policy for you - so guardrails take seconds, not an afternoon of hand-written YAML.
rules: - allow: redis-cli - block: redis-cli when: { flag.h: "prod-*" } unless: { subcommand: [GET, MGET, SCAN] }
Get Warden for macOS (Apple Silicon)
Tell us who you are and we'll email you a signed license and the download link. Your license key is delivered by email only - it is never shown on this page - so please use a valid email you can access. Requires an Apple Silicon Mac (M1 or later).
Requesting a license and downloading Warden constitutes acceptance of the Terms & Disclaimer below. Free while in preview. No credit card. Your license key is sent only to this email address - it is not displayed here - so make sure it's one you can receive mail at.
Check your email for your license
We sent your Warden license and install steps to your inbox. Download the app below to get started.
- Download and open Warden.dmg, then drag Warden to Applications.
- Open Warden.
- Go to Policies and paste your license key when prompted.
Terms & Disclaimer
Warden is a free developer preview, provided "as is" and "as available", without warranty of any kind, whether express or implied, including but not limited to merchantability, fitness for a particular purpose, and non-infringement. You use it entirely at your own risk.
Warden runs and governs coding-agent actions on your own machine. While it is designed to block dangerous operations, no software is perfect. You remain solely responsible for reviewing what the agent does, for keeping your own backups, and for the systems, data, and credentials the agent can reach.
To the maximum extent permitted by law, Pluto Coach Ltd and its officers, directors, and employees accept no responsibility or liability for any direct, indirect, incidental, or consequential loss or damage - including lost data, lost revenue, downtime, or security incidents - arising from your use of, or inability to use, Warden. Because Warden is provided free of charge, no refund or other remedy is offered.
By submitting your email, requesting a license, or downloading and using Warden, you confirm that you have read, understood, and agree to these terms.