Your AI agent burns tokens on noise. Warden stops that in one command.
For developers using Claude, Cursor, Copilot, Windsurf, Codex, or any of 35+ AI coding agents. Install once, restart your IDE, and Warden runs automatically — pruning tool output, compressing responses, indexing your code, and remembering decisions across sessions. Every cut is verified verbatim by a trust guard you can read in 40 lines. 100% local. Free. Source-available.
one MCP server · works with any MCP-compatible agent
one MCP server · registers in Cursor, Claude Code, Windsurf, Devin & any MCP client
works with every MCP-compatible agent — one config, 30+ platforms
One command. Every agent.
warden init detects all 30+ MCP-compatible agents on your machine and registers itself in each. No per-agent setup. No manual JSON editing.
npm install -g warden-ai && warden initcurl -fsSL https://raw.githubusercontent.com/rynald0cst0ltziam/Warden-AI/main/install.sh | bash{"mcpServers": {"Warden": {"command": "warden","args": ["serve"]}}}
Cut aggressively. Prove it's safe.
Anyone can compress context. Warden is the only layer that verifies the compression didn't cost you — with confidence scores, shadow-mode evals, and auto-revert on regression.
▸ confidence climbs, rule promotes
Every pruning rule starts in shadow mode. Warden runs it in parallel with the raw output, scores parity, and only promotes once confidence is proven. No blind trust.
▸ regression caught, auto-reverted
A continuous watchdog re-runs canary tasks. If a model update, caching bug, or over-aggressive prune rule causes a regression, Warden auto-reverts to the last known-good config. Safety first, always.
Never rewrites code
Pruning only removes irrelevant content. Code, commands, and error text are included-or-excluded wholesale — enforced at the framework level, not per-module.
Confidence, not vibes
Every active rule shows a live confidence percentage — 'quality-neutral across 214 sessions' — not just an on/off toggle.
Auto-revert on regression
If anything degrades — model update, caching bug, aggressive prune — Warden falls back to the last known-good config automatically.
Eight layers, one verification
Warden cuts tokens across eight layers — structural queries, context selection, tool pruning, memory, responses, memory files, tool description compression, and session handoffs — and verifies every cut is safe with a shadow-mode eval gate.
Context governance
Code intelligence
Warden indexes your project's code structure — functions, classes, imports, call sites — using tree-sitter WASM for structural parsing. 30+ languages including TypeScript, JavaScript, Python, Go, Rust, Java, C, C++, C#, Ruby, PHP, Swift, Kotlin, and more. Incremental: only changed files are re-parsed. One call replaces dozens of grep/read cycles: who calls a function, what's affected by a change, where the entry points are, what's dead code. The agent asks one structural question and gets the answer — no reading 20 files to understand the codebase.
warden_index({ repoRoot: "." })
57 files, 251 symbols, 2061 calls
warden_call_graph({ function: "auth" })
Callers: login(), UserService.isValid()
Callees: checkToken(), generateToken()
warden_impact({ filePath: "src/auth.ts" })
Risk: HIGH — 5 dependents, 12 callers
warden_architecture({})
TypeScript: 57 files
Entry points: main(), UserService, auth
warden_dead_code({})
3 functions with zero callers:
oldValidateToken() — src/auth.ts:142
deprecatedFormat() — src/utils.ts:88
unusedHelper() — src/helpers.ts:12
warden_search_symbols({ pattern: "auth" })
8 matches across 4 files
authMiddleware — src/middleware.ts:15
authenticate — src/auth.ts:42
authConfig — src/config.ts:8Input context extraction
Given a task, Warden scans the project, reads the top-ranked files, and extracts the sections relevant to your task. Works on code (function/class blocks), markdown (sections), JSON/YAML (key context windows), and text (paragraph matching). The agent gets verbatim content plus structural outlines of the rest — not a file list, but the cut content itself. Typically 80%+ smaller than reading full files.
warden_context_select({
task: "fix null pointer in auth.ts"
})
5 files, 87% smaller than full reads
full: ~11744 tokens → compact: ~1471
── src/auth/login.ts (180 lines, showing 22)
[lines 45-67] block contains "auth":
export function login(user: string) {
const token = signJWT(user);
...
}
… outline (12 more blocks not shown):
L12: export interface LoginResult
L80: export function refreshTokenTool output pruning
Every tool call goes through Warden's wrapper tools. Content-aware routing auto-detects JSON, grep output, test logs, and source code — routing each to its optimal pruning module. Grep returns only relevant matches (with duplicate deduplication), file reads return slices + outlines, test runs keep failures + context. Code is never rewritten — only included or excluded. And every cut is reversible: the original is cached in SQLite with a hash key, so the agent can call warden_retrieve to get the full output back if it needs more context.
warden_grep({ pattern: "function auth" })
200 matches → 12 relevant
‹warden› removed 50 duplicates
‹warden› collapsed 138 low-signal
‹warden› routed: generic → grep (0.90)
guard: every line verbatim ✓
saved: 4295 → 883 tokens (-79%)
‹warden› retrieve full output:
warden_retrieve("a1b2c3d4e5f6")Agent memory
When the agent makes a durable decision (use Stripe, use PostgreSQL, JWT auth), Warden stores it. On future tasks, relevant memories are recalled automatically — so decisions persist across sessions. Memories auto-surface in warden_status output at session start — no separate recall call needed. Failed tasks auto-save as memory patterns so the agent doesn't repeat mistakes.
warden_memory_save({
category: "decision",
title: "Use Stripe for payments",
tags: ["payments","billing"]
})
warden_memory_recall({ query: "payments" })
→ #1 [decision] Use Stripe for paymentsResponse compression
Warden's rules files tell the agent to drop filler, pleasantries, and self-narration from its responses. Code, commands, errors, and technical terms stay verbatim. The agent states the fix, not the reasoning process. Max compression, always on — no config, no levels. Includes auto-clarity — switches to full prose for security warnings, irreversible actions, and confused users. No preamble/postamble, no echo, no narration, drop filler words, sentence fragments, never invent abbreviations (tokenizer splits them — zero savings), code/commands/errors always verbatim. Just install and save tokens.
warden rules → writes compression rules to agent config → automatic, no config needed Normal (69 tokens): "The reason your component is re-rendering is likely because you're creating a new object reference on each render cycle..." Warden (19 tokens): "New object ref each render. Inline object prop = new ref = re-render. Wrap in useMemo."
File compression
Memory files (CLAUDE.md, AGENTS.md) load into context every session. Verbose ones waste tokens forever. warden compress strips filler deterministically — no LLM call, free, instant, offline. Code blocks, paths, commands preserved byte-for-byte. Sentence scoring drops low-value prose, keeps technical content. Original backed up automatically. Up to 32% reduction. No config needed.
warden compress CLAUDE.md 807 → 549 tokens (32% reduction) 28 segments preserved verbatim validation: ✓ backup: CLAUDE.md.original
MCP tool description compression
Warden compresses its own tool descriptions before sending them to the agent. Tool descriptions sit in context for the entire session, so compressing them saves input tokens on every turn. Equivalent to caveman-shrink, but built in. No proxy, no middleware, no extra package.
warden serve 24 tool descriptions auto-compressed 3120 → 1847 tokens (-41%) descriptions active for entire session savings compound every turn
Verification
Trust guard
Every pruned output is verified: every non-annotation line must appear verbatim in the raw output, or the raw is shipped instead. No silent rewrites, ever.
[guard] code preserved ✓ [guard] commands preserved ✓ [guard] errors preserved ✓ [guard] parity vs raw 0.98
Eval gate
Every pruning rule runs through shadow → canary → active. Confidence is measured against real tasks before a rule ships live. Zero-confidence start, earned trust.
rule: grep.relevance-collapse.v1 shadow [░░░░░░░░░░] 0.00 → start canary [██████░░░░] 0.67 → promote active [█████████░] 0.94 → live
Task outcome tracking
After each task, the agent reports success/failure. Warden correlates this with whether pruning was active. If pruned success rate drops below raw, that's a regression — auto-reverted.
warden_record_outcome({
task: "fix null pointer",
success: true,
pruned: true,
tokensSaved: 500
})
11 tasks tracked
pruned: 83% success | raw: 80%
no regression detectedBuilt for developers who ship.
24 MCP tools. 25 CLI commands. 10 layers of context governance — from tree-sitter code intelligence to session handoffs. Not just token savings — observability, auditability, and safety.
Code intelligence
Tree-sitter indexing across 30+ languages. Call graph queries, impact analysis, architecture overview, symbol search, dead code detection. One structural query replaces dozens of grep/read cycles. The single biggest token saver.
warden index → warden graph auth → 5 callers, 3 callees
Tool output pruning
Every tool call goes through Warden's wrappers. Content-aware routing auto-detects JSON, grep, test logs, source code — routes each to its optimal pruner. 50-90% reduction. Code is never rewritten, only included or excluded. Every cut is reversible.
warden_grep → 200 matches → 12 relevant (-79%)
Reversible pruning (CCR)
slice retrievalEvery pruned output is cached in SQLite with a hash key. Retrieve the full original — or a slice of it — at any time. Slice-based retrieval: get the 10 lines around a symbol, not the 903 lines you don't need.
warden_retrieve("abc123", around="login") → 21 lines
Durable memory (FTS5)
Decisions persist across sessions in local SQLite with FTS5 full-text search. Conflict detection warns when new decisions contradict old ones. Auto-surfaces at session start. The agent recalls relevant past decisions — no re-deriving context every time.
warden memory save / recall / list / forget
Session handoff
newSessions end. Context windows fill up. The rules file tells the agent to read the previous handoff at session start and generate a new one at session end. Compact document: decisions, tasks, files, savings. The next session picks up where the last left off — automatically.
warden_handoff({ read: true }) at start · warden_handoff({}) at end
Trust guard + eval gate
Every pruned output is verified: every non-annotation line must appear verbatim in the raw, or the raw ships instead. Rules run through shadow → canary → active with confidence scoring. Regression watchdog auto-reverts broken rules. Outcome tracking proves pruning didn't degrade results.
guard: every line verbatim ✓ · eval: 0.94 confidence → live
Context selection + 2-hop expansion
2-hop expansionBefore work starts, Warden scans the project and extracts relevant code — not file lists, the actual content. When the code index is available, it auto-includes dependency signatures so the agent sees imported function signatures without reading the files.
warden_context_select("fix auth") → 6 files + dependency signatures
Response & file compression
Warden writes rules that drop filler, pleasantries, and self-narration automatically. Code, commands, and errors stay verbatim. Max compression, always on. File compression strips memory files (CLAUDE.md, AGENTS.md) — verbose ones waste tokens forever.
warden rules → automatic · warden compress CLAUDE.md → -32%
Dashboard + audit trail
Live terminal HUD, web dashboard at localhost:7878, and full audit trail in SQLite. Every pruning decision logged with timestamp, rule ID, and tokens saved. Export to JSON or CSV. Run real-file benchmarks to see exact savings per module.
warden hud · warden dashboard · warden export --format csv
How Warden compares
Compression tools cut and hope. Dashboards watch after the fact. Warden closes the loop — cut, verify, and roll back if anything degrades.
| capability | Warden | Compression tools | Cost dashboards |
|---|---|---|---|
| Tool output pruning (50-90%) | ✓all output types | ✓truncation only | ✗ |
| Agent reply compression | ✓always max | ~prompt-only | ✗ |
| Code intelligence (call graph, impact, dead code) | ✓tree-sitter, 30+ langs | ✗ | ✗ |
| Agent memory (cross-session) | ✓auto-surface + auto-save | ✗ | ✗ |
| Trust guard (verbatim line verification) | ✓every prune | ✗ | ✗ |
| Shadow mode + eval gate | ✓auto-activate built-ins | ✗ | ✗ |
| Task outcome tracking + auto-revert | ✓ | ✗ | ~tracking only |
| CCR (reversible pruning) | ✓7-day TTL | ✗ | ✗ |
| MCP tool description compression | ✓built-in | ✗ | ✗ |
| Per-project isolation | ✓ | ✗ | ~ |
| Works across 30+ agents | ✓ | ~limited | ✗ |
| File compression (deterministic) | ✓always max | ✗ | ✗ |
| Free + source-available | ✓ | ~some paid tiers | ~freemium |
| Local-first (no cloud) | ✓ | ✓ | ~cloud-hosted |
| No proxy required | ✓ | ✗proxy-based | ✓ |
Warden is the only tool that compresses input AND output, indexes your codebase for structural queries, remembers decisions across sessions, and proves every cut is safe — all in one MCP server. No proxy required.
The numbers
Not vibes. Measured token savings with a trust guard that verifies every single line.
100% local — no cloud, no telemetry
Warden is an MCP server that runs on your machine via stdio. It has no cloud, no API server, no analytics, no phone-home. Your code, tool outputs, and pruning decisions stay in a local SQLite file you control. No paywall, no subscription, no license key. It works on a plane.
Audit it yourself — full source public. The trust guard is 40 lines in src/pruner/guard.ts.
works with
One MCP server, 35+ agents. Run warden init and it auto-registers in every MCP-compatible client it finds on your machine.