Verified context optimization.

Indexes every function, class, import, and call site using tree-sitter WASM parsers. Incremental — only changed files are re-parsed. One index, six query types.

Find every caller or callee of any function. See the full call chain — who calls it, what it calls, where each is defined. One structural query replaces reading 10 files.

Change a file, see the blast radius. Direct dependents, transitive dependents (2 hops), affected callers, and risk assessment (low/medium/high) — all in one call.

Project structure in one call: languages, packages, entry points, hotspots, total counts. Understand a codebase without reading 20 files first.

Search for functions, classes, and types by name pattern across the indexed project. Faster and more structured than grep — returns signatures, not just matches.

Find functions with zero callers — potential dead code. Exports are excluded (they're API surface). Clean up safely with structural evidence.

Searches via ripgrep, respects .gitignore, and prunes results to matches relevant to the current task. Duplicate matches across files are deduplicated. 200 matches become 12.

Large files get a relevant slice (the function or block matching the task) plus a structural outline of the rest. Code is never rewritten — only included or excluded. The agent sees the relevant code and knows what else is in the file.

Five read modes beyond auto-pruning: signatures (symbol declarations only, 80-90% savings), symbol (one function by name), outline (structural headers), imports (import lines only), full (no pruning). Powered by tree-sitter. Every line verbatim — guard verified.

Runs tests and keeps failures with context, collapses passing noise. Stack traces stay verbatim. 5000 lines of test output become the 3 failures and their context.

Runs any shell command and strips low-signal lines, keeping errors, warnings, and relevant content. ANSI codes stripped, paths shortened, JSON cleaned up.

For tools Warden doesn't wrap. Pass any output and Warden auto-detects the content type (JSON, grep, test log, source code) and routes to the optimal pruner.

Wrap any upstream MCP server and compress its tool descriptions. Warden spawns the upstream, intercepts tools/list responses, and compresses description fields. Uniquely, --prune-responses also prunes tools/call response content behind the trust guard: removal-only, every retained line byte-for-byte verbatim from the raw. Description-only compressors deliberately never touch responses because rewriting is unsafe — Warden's guard makes it safe. Opt-in. Works with any MCP client.

--lazy replaces the full tool catalog with 3 meta-tools (warden_list_tools, warden_get_tool_schema, warden_invoke_tool). The client sees a tiny surface and loads schemas on demand. Measured 97.9% catalog token reduction on a 50-tool server (14105 → 297 tokens). Enabled by default. --compress-schema strips cosmetic JSON-Schema fields (title, default, examples) and compresses property descriptions — 21.5% additional reduction. Never touches validation constraints. Also enabled by default.

When the agent makes a durable decision — architecture choice, library selection, convention, constraint — it persists to local SQLite. Categories: decision, finding, pattern, constraint, preference. Tagged for recall.

Recall uses two strategies merged via Reciprocal Rank Fusion (RRF): FTS5 keyword search (porter-stemmed) for exact term matching, and vector semantic search (all-MiniLM-L6-v2, 384-dim, local ONNX) for intent matching. 'login' finds 'authentication' — 'credit card' finds 'Stripe' — even with zero keyword overlap. Falls back to FTS5-only if the model is unavailable.

When saving a new decision, Warden checks for conflicts with existing memories. 'Use PayPal' after 'Use Stripe' triggers a warning — the agent resolves the contradiction before it causes problems.

warden_status automatically surfaces recent memories at session start. The agent sees what Warden remembers without an explicit recall call.

Decisions aren't static. Reaffirm boosts confidence when a decision is confirmed again. Supersede links an old decision to its replacement. Archive marks decisions as no longer relevant. Mark contested flags disagreement. Reject kills bad ideas. Full lifecycle, tracked in schema.

When something doesn't work, Warden remembers. Save a failed_approach memory with outcome='failure' and evidence. Later, when starting a similar task, warden_memory_failed_approaches surfaces warnings — don't repeat past mistakes.

Every memory carries sourceType (documentation, commit, experiment, observation), evidence (array of citations), scope (e.g. 'order-service'), and outcome. Decisions are traceable — not just 'someone decided X' but 'decided X because of Y, confirmed by Z'.

warden_sufficient_context wraps context selection with memory recall, failed approach warnings, git churn metrics, and file categorization (direct, dependency, test, config, doc). One call replaces four. The agent gets the full picture before starting work.

Set a token budget and Warden trims the package to fit — keeping the highest-relevance files first. Reports tokensUsed, tokensBudget, and whether trimming occurred. No more oversized context windows.

Files with more than 5 commits are flagged as volatile. The agent sees a warning: 'auth.ts: 8 commits — volatile, expect recent changes'. Know which files are actively churned before you start editing.

Warden writes rules to the agent's config (CLAUDE.md, AGENTS.md, .cursorrules, .devin/rules) that drop filler, pleasantries, and self-narration automatically. Code, commands, and errors stay verbatim. Max compression, always on — no config, no levels.

Memory files (CLAUDE.md, AGENTS.md) load into context every session. Verbose ones waste tokens forever. warden compress strips filler deterministically — no LLM call, free, instant, offline. Original backed up. Up to 32% reduction.

When the situation is high-risk — security warnings, irreversible actions, breaking changes — compression automatically switches to full, clear sentences. Safety beats token savings. Built into the rules, not optional.

Every pruned output is verified: every non-annotation line must appear verbatim in the raw output, or the raw ships instead. No silent rewrites, ever. If a pruning module has a bug, the guard catches it and falls back to raw.

Every pruning rule starts in shadow mode. Warden runs it in parallel with raw output, scores parity, and only promotes once confidence is proven. Built-in rules are active by default — savings from first install. Enterprise mode starts in shadow.

A continuous watchdog re-runs canary tasks. If a model update, caching bug, or over-aggressive prune rule causes a regression, Warden auto-reverts to the last known-good config. You don't notice — Warden already fixed it.

warden doctor runs 10 checks: MCP registration, rules files, pruning engine, memory system, FTS5 index, code index, CCR cache, outcome tracking, budget tracker, and database integrity. Clear pass/fail report.