Questions

Warden is a context governance layer for AI coding agents. It sits between your agent and its tools, prunes irrelevant output automatically, and proves every cut is safe. It works with any MCP-compatible agent — Claude Code, Cursor, Windsurf, Cline, Codex, Zed, JetBrains, Antigravity, Gemini CLI, Aider, Goose, OpenHands, Continue, VS Code Copilot, Amazon Q, and 15+ more. 24 MCP tools across 8 layers: code intelligence, context selection, tool pruning, agent memory, response compression, file compression, MCP tool description compression, and session continuity.

AI coding agents burn tokens on noise. A grep returns 200 matches when you need 12. A test run spits 500 lines when you need the 3 failures. A file read loads 2000 lines when you need 20. Agents burn through token windows reading irrelevant output, then lose context mid-task. Warden cuts 50-90% of that noise automatically — and proves the cuts didn't break anything.

Compression alone is a commodity. Anyone can truncate output. Warden does four things no competitor does: (1) Every cut is verified — the trust guard checks every pruned line appears verbatim in the raw, or the raw ships instead. (2) Every cut is reversible — CCR caches the original in SQLite, the agent calls warden_retrieve to get it back. (3) Every rule is eval-gated — rules start in shadow mode and must prove quality parity before going live. (4) Every outcome is tracked — if pruning causes a regression, the watchdog auto-reverts the rule.

Warden is source-available and free to use for everyone, including commercial use. The codebase is TypeScript and the full source is public. You can read every line, including the trust guard (src/pruner/guard.ts) which is 40 lines you can verify in 2 minutes. Warden is free — donate if you find it useful.

Free. No subscription, no license key, no paywall. All features, all layers, all updates — free. If Warden saves you tokens, consider a donation via PayPal or Bitcoin to support development. If it doesn't, don't. That's the honor system.

Because subscriptions suck and paywalls create friction. Warden is a local tool that runs on your machine — there's no server cost, no API cost, no ongoing infrastructure. Development is funded by donations from people who find it useful. No lock-in, no recurring charge, no 'cancel anytime' dance.

No. There's no license key, no activation step, no online verification. Install via npm, run warden init, restart your agent. Done.

Visit the GitHub repo at github.com/rynald0cst0ltziam/Warden-AI. You can donate via PayPal or Bitcoin. Suggested amounts: $5 (buys a coffee), $10 (covers development time), $15 (supports ongoing development and updates). No amount is required — donate what feels right.

No. Warden is fully functional for everyone. No 'pro' version, no donor-only features, no private repo. The npm package works identically whether you donated $0 or $100. The honor system means we trust you to support development if the tool helps you.

Yes — and after donating too. Warden runs in shadow mode by default — it observes what would be pruned and shows you the token savings, but doesn't modify any output. When you're ready to prune live, run warden promote <rule-id> --force. No donation required, ever.

Not yet. Warden is local-first and per-developer — free for everyone. Team features (shared rules, shared memory, team dashboards) are on the roadmap. Enterprise support contracts are available on request.

No. Run `warden init` once to install globally. Warden registers as an MCP server in all your agents (user-level config). After that, when you open a NEW project or space in any agent, Warden auto-initializes on first serve — it writes rules files (CLAUDE.md, AGENTS.md, .cursorrules, .devin/rules, etc.) and creates the .warden/ database automatically. You never need to run `warden init` again for new projects. Each project gets its own .warden/warden.db with its own rules, memory, and savings tracking.

Yes. Warden registers at the user level (~/.config/devin/config.json on macOS/Linux, %APPDATA%/devin/config.json on Windows), so it's available in every space. When you open a new space, `warden serve` auto-detects the new project and writes rules files automatically. Each space gets its own .warden/ database — memory and savings are tracked per-project, not shared across spaces.

No. Warden is an MCP server that runs locally via stdio. It has no cloud, no API server, no telemetry, no analytics, no phone-home, no webhooks. Your code, tool outputs, memories, and pruning decisions stay in a local SQLite file on your machine. The only network code is a localhost-only dashboard bound to 127.0.0.1, which never sends your code, file contents, or prompts anywhere. You can audit this yourself — the full source is public.

No. Warden is not a proxy. Your agent talks directly to its provider (OpenAI, Anthropic, Google, etc.) — Warden is not in that path. Warden only sees tool outputs (grep results, file reads, test logs) that the agent produces locally, and it prunes those before they go into the agent's context window.

In a local SQLite database at ~/.warden/warden.db (or %USERPROFILE%/.warden/warden.db on Windows). You can read it with any SQLite client, back it up, copy it, or delete it. It's your file.

Read the source. It's TypeScript, source-available, and the trust guard (src/pruner/guard.ts) is 40 lines you can verify in 2 minutes. Every pruning decision is logged with the raw input, pruned output, rule applied, and guard result. Run warden report to see the full audit trail. Export it with warden export --format csv.

Yes — the codebase has been reviewed for privacy and security. Findings: (1) No telemetry, analytics, or phone-home code anywhere. (2) MCP server communicates via stdio only — no network ports. (3) SQLite database is local-only with no replication or sync. (4) No eval(), Function(), or dynamic code execution. (5) No hardcoded secrets or credentials. (6) Trust guard is intact and enforced on every prune. (7) The only network code is a localhost-only dashboard (127.0.0.1). (8) .env files are excluded from indexing, .warden directory is excluded from search. (9) No webhooks, no external API calls, no network requests to third parties.

30+ MCP-compatible agents: Claude Code, Claude Desktop, Cursor, Windsurf/Devin, Codex CLI, Cline, Roo Code, Continue, VS Code Copilot, Zed, JetBrains, Amazon Q Developer, Gemini CLI, Antigravity, Aider, Goose, OpenHands, opencode, Augment Code, Warp, Cody, Tabnine, Replit AI, and more. Run warden init to auto-detect and register in each one. If your agent supports MCP, Warden works with it.

Yes. Warden is a Node.js application that runs on any platform supporting Node 22.5+. warden init detects agent configs on both Windows and macOS — it checks the correct paths for each OS (e.g., %APPDATA% on Windows, ~/Library on macOS).

Yes. Warden prunes tool outputs (code, logs, grep results, test output) — these are language-neutral. Code doesn't change based on whether you speak Portuguese, Spanish, French, or Chinese. The trust guard verifies every line byte-for-byte regardless of language, including accented characters and CJK. Your agent's response language is completely unaffected.

The code intelligence layer (call graph, impact analysis, symbol search) uses tree-sitter for parsing, supporting 30+ languages including TypeScript, JavaScript, Python, Go, Rust, Java, C, C++, C#, Ruby, PHP, Swift, Kotlin, Scala, and more. The pruning engine works on any language's output — it's text-based, not language-specific.

If it supports MCP, you can manually add Warden to its config. See the platform docs for the config format. If it doesn't support MCP yet, it won't work — MCP is the protocol Warden uses to intercept tool calls.

Warden is LLM-agnostic. It doesn't talk to your LLM — it talks to your agent's tool layer via MCP. Whether you use OpenAI, Anthropic, Google, Mistral, or a local model, Warden works the same. It prunes tool outputs before they enter the context window, regardless of which LLM reads them.

Every tool call goes through Warden's wrapper tools (warden_grep, warden_file_read, warden_run_tests, warden_run_command). Grep returns only relevant matches with duplicate deduplication. File reads return slices + structural outlines for large files. Test runs keep failures + context. Shell commands keep errors and relevant content. Code is never rewritten — only included or excluded. The trust guard verifies every line byte-for-byte.

When the agent passes generic output to warden_prune, Warden auto-detects the content type — JSON, grep results, test logs, or source code — using heuristic detectors and routes to the optimal pruning module. Mixed content (e.g., a test log followed by grep results) is split on blank-line boundaries and each section routed independently. The agent doesn't need to know what type of output it's dealing with.

CCR (Compress-Cache-Retrieve) caches every pruned original in SQLite with a SHA-256 hash key. A retrieval marker is appended to the pruned output: ‹warden› retrieve full output: warden_retrieve("abc123def456"). If the agent needs the full output, it calls warden_retrieve with the hash and gets the original back instantly. No re-running tools, no guesswork. Entries auto-expire after 7 days. This eliminates the core risk of pruning: 'what if we cut something important?'

Warden indexes your project's code structure — functions, classes, imports, call sites — using a tree-sitter parser. One call replaces dozens of grep/read cycles: who calls a function (warden_call_graph), what's affected by a change (warden_impact), the project's architecture in one shot (warden_architecture), find symbols by name (warden_search_symbols), find dead code (warden_dead_code). This is the single biggest token saver — instead of reading 20 files to understand structure, the agent asks one question.

When the agent makes a durable decision (use Stripe, use PostgreSQL, JWT auth), Warden stores it in SQLite. On future tasks, relevant memories are recalled automatically — so decisions persist across sessions. Categories: decision, finding, pattern, constraint, preference. Save with warden_memory_save, recall with warden_memory_recall, list with warden_memory_list, delete with warden_memory_forget.

Warden writes rules to the agent's config files (CLAUDE.md, .cursorrules, AGENTS.md, etc.) that tell the agent to drop filler words, pleasantries, hedging, and self-narration from its responses. Code, commands, errors, and technical terms stay verbatim. The agent states the fix, not the reasoning process. Max compression is always on — no config, no levels, no tuning. Includes auto-clarity for safety warnings. Just install and the agent's responses get tighter.

Memory files (CLAUDE.md, AGENTS.md) load into context every session. Verbose ones waste tokens forever. warden compress strips filler deterministically — no LLM call, free, instant, offline. Sentence scoring drops low-value prose, keeps technical content. Up to 32% reduction. No config needed. Original backed up to <file>.original automatically.

Before the agent starts a task, warden_context_select scans the project, reads the top-ranked files, and extracts the sections relevant to your task. Works on code (function/class blocks), markdown (sections), JSON/YAML (key context windows), and text (paragraph matching). The agent gets verbatim content plus structural outlines of the rest — not a file list, but the cut content itself. Typically 80%+ smaller than reading full files.

Three layers of protection. First, the trust guard verifies every pruned line byte-for-byte — if even one line doesn't match the raw output, the raw ships instead. Second, CCR (Compress-Cache-Retrieve) caches every pruned original in SQLite with a hash key — if the agent needs the full output, it calls warden_retrieve with the hash and gets it back instantly. Third, the regression watchdog tracks task outcomes — if a rule's success rate drops below baseline, it auto-reverts to shadow mode. You're protected at the line level, the retrieval level, and the task level.

No. This is enforced at the framework level. The trust guard in src/pruner/guard.ts checks that every non-annotation line in the pruned output appears verbatim in the raw output. Annotations are prefixed with ‹warden› so the guard recognizes them as added, not altered. If any line doesn't match, the raw output ships instead. There is no bypass path.

Every new pruning rule starts at 0% confidence in shadow mode. It prunes output internally but ships the raw to the agent. Both versions are compared for quality. After 50+ shadow runs at 0.9+ quality, the rule can be promoted to live. You can force-promote sooner with warden promote <rule-id> --force.

Run warden status. It shows total tokens saved, percentage reduction, per-rule statistics (saved tokens, percentage, call count), and total tokens processed. Every pruned tool output also includes a ‹warden› annotation showing the exact savings for that call. The numbers are measured, not estimated.

The regression watchdog runs continuously. If a rule's task success rate drops below the baseline (raw output success rate), the rule auto-reverts to shadow mode. You get notified but don't have to do anything — Warden catches and fixes it before you notice. Run warden watchdog to check all rules manually.

Every pruning rule goes through four stages: (1) Observe — shadow mode, prunes internally but ships raw. (2) Score — confidence calculated with exponential decay, 50+ runs at 0.9+ quality needed. (3) Promote — rule goes live, pruned output ships to agent. (4) Watch — task outcomes tracked, auto-revert if success rate drops. No rule skips a step.

Two options: (1) npm: run `npm install -g warden-ai && warden init` — one command does everything. (2) curl: run `curl -fsSL https://raw.githubusercontent.com/rynald0cst0ltziam/Warden-AI/main/install.sh | bash` — downloads, installs, and runs init automatically. Then restart your agent. warden init auto-detects every MCP-compatible agent on your machine and registers Warden in each one. It also writes rules files (CLAUDE.md, .cursorrules, AGENTS.md, etc.) that tell your agent to use Warden's wrapper tools.

Four things: (1) Registers Warden as an MCP server in every agent config it finds — checks 30+ config paths (Claude Code, Claude Desktop, Cursor, Windsurf/Devin, Codex, Cline, Roo Code, Continue, VS Code Copilot, Zed, JetBrains, Amazon Q, Gemini CLI, Antigravity, Aider, Goose, OpenHands, opencode, Augment Code, Warp, Cody, Tabnine, Replit AI, and more) and writes the correct JSON or TOML for each. (2) Writes rules files that tell the agent to use Warden's wrapper tools instead of built-in ones. (3) Builds the code index (call graph, impact analysis, architecture). (4) Compresses memory files to save tokens every future session. Idempotent — safe to re-run.

No. Warden is plug and play. No config files, no settings, no levels, no tuning. Install, init, restart, done. Everything works automatically — pruning, content-aware routing, CCR, response compression, memory. You can optionally run warden rules to re-write the agent rules files, or warden compress to compress memory files, but neither is required.

Run warden status. It shows: rules registered, their stages (shadow/active), confidence scores, total tokens saved, percentage reduction, and calls processed. You should see this at the start of every agent session — the rules file tells the agent to call warden_status automatically.

Run: npm update -g warden. Updates are free, forever — no subscription, no renewal. Then restart your agent to pick up any changes.

Run: npm uninstall -g warden. Then remove the Warden entry from your agent's MCP config (or re-run warden init which will detect it's uninstalled and skip). Your SQLite database at ~/.warden/warden.db stays — delete it manually if you want to remove all data.

24 tools: warden_prune, warden_retrieve, warden_ccr_status, warden_grep, warden_file_read, warden_run_tests, warden_run_command, warden_status, warden_report, warden_context_select, warden_memory_save, warden_memory_recall, warden_memory_list, warden_memory_forget, warden_record_outcome, warden_outcome_stats, warden_index, warden_call_graph, warden_impact, warden_architecture, warden_search_symbols, warden_dead_code, warden_compress, warden_handoff.

Four ways: (1) In your agent — every tool call shows ‹warden› saved X tokens (Y%) inline, plus cumulative savings. The agent calls warden_status at session start and prints: "Warden active — X tokens saved (Y% reduction), Z rules live." (2) Terminal HUD — run `warden hud` in a separate terminal to see a live, real-time display of token savings, rule status, and confidence bars. Updates as the agent works. Ctrl+C to exit. (3) Web dashboard — run `warden dashboard` to open a browser UI at http://localhost:7878. Shows rule status, confidence bars, token savings, and recent pruning decisions. Auto-refreshes every 3 seconds. (4) CLI — run `warden status` anytime for a detailed breakdown of every rule, its stage, confidence, tokens saved, and call count.

25 commands: init, serve, status, hud, rules, doctor, promote, revert, prune, benchmark, report, dashboard, compress, watchdog, memory, context, outcomes, index, graph, impact, architecture, ccr, export, budget, handoff. Run warden --help to see all.

Run `warden dashboard` in a terminal to open a web UI at http://localhost:7878 in your browser. Shows real-time rule status, confidence bars, token savings, and recent pruning decisions. Auto-refreshes every 3 seconds. Useful for monitoring Warden during long sessions. No cloud — runs locally on your machine.

Every pruning decision is logged in SQLite — timestamp, rule, tokens saved, guard result. Run warden export --format csv -o audit.csv to export the full history. Useful for compliance review or analyzing pruning patterns over time.

Run `warden hud` in a separate terminal (not in your IDE) to see a real-time, live-updating display of token savings, rule status, and confidence bars. Updates as the agent works. Less detailed than the web dashboard but doesn't require a browser. Press Ctrl+C to exit. Keep it running in a side terminal while you work to watch savings accumulate in real time.

Yes. Run warden budget set <scope> <tokens> to set a daily token budget. Warden tracks spend and alerts you when you approach the limit. Run warden budget list to see all caps, warden budget remove <scope> to remove one.