Stop approving every command your coding agent runs.
Let it run. Your rules decide what it can do, not an LLM.
Run your own Claude Code or Codex (or Copilot, Devin, Kimi) in Warden, on the subscription you already pay for. Every command, file read, edit and MCP call is checked against a few lines of YAML: deny blocks it, ask waits for your yes, the rest just runs. Opt-in assurance checks show you what you're merging.
sudo, sh -c and ../ paths before it checksHow this demo works ↓
Bash(cat .env), misses sudo cat .env, sh -c 'cat .env' and the ../ path. Warden unwraps first, then your rule file decides, not another model. This demo runs only the lines shown, in your browser. The real Open, Guarded and Hardened rule sets add more rules (Guarded also blocks sudo and asks before rm -rf and package installs). The rule-set buttons only change what happens to eval and $(...); the example lines stay the same.- A long refactor without a yes for every
npm test - Blocking the agent's reads of
.envfiles - Repos where production is one command away
- Runs you're not watching (automations, the Factory), with rules that can only be tighter
Already skipping permissions? Keep the speed, and add back only the stops that matter.
Write down the few things that must never happen and the few that need a person. Everything else just runs, and every decision on the agent's actions shows up in the chat as it happens.
- 1Get WardenIt drives the Claude Code or Codex CLI you already have signed in, so no API keys are needed.
- 2Pick a starting rule setOpen (keeps the agent's file access inside the project), Guarded (recommended: blocks secrets, force-pushes and destructive commands, and asks before risky ones) or Hardened (the most blocks). All editable.
- 3Give the agent a taskIt works in Warden's chat, with a full editor and the diff in the same window.
Bring what you already pay for.
Mix and match, switch models mid-conversation, keep several ChatGPT accounts signed in.An agent and a code editor, in one window.
Built for people who check the work.From ticket to shipped, with a person at the gates that matter.
Pull work in from Linear, Jira, GitHub or Sentry. Your agent plans it and builds it in its own worktree, and a different model can review it against the original ask. You choose where a person signs off.
One board shows where everything is and what's waiting on you. Each lane below it is how much sign-off a ticket gets. Small fixes can go from idea to merged with no clicks, unless a rule holds them, and a rule can hold anything that touches migrations/.
Your agent writes code faster than anyone can review it.
So Warden makes review the fast part. The riskiest changes come first with the reason why, boilerplate folds away, and a second model can check the work against what you actually asked for.
Open one of the project's pull requests and get this walkthrough, plus a line-by-line review on a model you pick. Edit the findings, then post them to GitHub as yourself or hand them to the agent to fix.
Rules you can read at a glance.
Your rule file is a few lines of YAML. Start from a rule set, switch on ready-made protections, or describe the rule in plain English: Warden writes the YAML and tests it on example commands before you save.
Runs you're not watching (automations and Factory items) can have their own rule file, which can only tighten your everyday rules. In those runs, when an action needs your yes, Warden holds it for your review and tells the agent not to work around it; the run carries on without waiting for you. In a sandboxed run, an action that would need your yes goes ahead if its effect stays inside the sandbox.
Know what you're merging without reading every line.
Set an assurance level on a chat. Each time the agent changes files, Warden runs your lint, type-check and tests (L0); from L1 it also checks that the tests the agent added or changed fail on the old code. Press Verify for L2 to L4. Each graded run is labelled with the highest level it reached, and what that still doesn't prove.
L0 · Built
Runs automatically on each change, once a level is setOnce a level is set for the chat, as soon as the agent's run changes files, Warden runs the checks your project already has: lint, type-check and tests. There's nothing new to write. If something fails, the agent is told what broke so it can fix it.
The other things that slow you down, handled in the same app.
Pick the one that costs you most. Anything here the agent runs goes through the same rules.
Every run is a restore point.
Before each run, Warden snapshots your working tree (tracked and untracked files) as git objects kept off your branches, so your history stays clean. Put your files back in one click. A restore saves your current state first, so it can be undone too.
Absolute maximum ratings
Free for every developer. Team for the whole company.
The free edition is yours to use anywhere, commercial work included: your job, your clients, your own company. Team is for when a company wants one place to set rules, skills and model access for every developer.
For any project, personal or commercial. The full app and policy engine.
- Everything on this page except the Team features: company-wide rules, shared skills, the AI gateway, seats, and plan and spec backup
- Bring your own subscriptions, keys or local models
For when a company wants one set of rules on every laptop. Set rules, skills and model access once, and every developer's Warden picks them up.
- Everything in Developer, plus:
- Company-wide rules: every developer's Warden enforces them, and nobody can loosen them
- Shared skills, kept in sync on every seat
- Optional AI gateway (OpenRouter and more), hosted by us or pointed at your own proxy: every seat connected automatically, no provider keys on laptops, per-seat budgets and allowed models
- Seats and roles, plus backup and sharing of the agent's plans and specs
- Priority support
- An MSA your procurement team can review and sign
- Optional hands-on rollout: rules, workflows and checks fitted to how your team ships
Per-seat licence plus a one-time setup fee, under a commercial licence and MSA. We quote after the walkthrough, once we know your team and stack.
The free edition is licensed for commercial work. We'd value feedback on what to fix: warden-support@zsguard.com. When more of your team picks it up, Team gives you company-wide rules, shared skills and an AI gateway, and we'll help you move over.
Your employer's own rules on new tools still apply. That part is between you and them.
Known limitations
// we'd rather you heard it from us- Only agents you run inside Warden are checked. The CLI in your own terminal isn't.
- Claude Code is checked before every action. With Codex, Copilot, Devin and Kimi, anything the agent asks permission for is checked before it runs, but a tool it runs without asking is only checked as it starts: it may already have run, though a blocked result is thrown away before the agent sees it.
- Workflow shell steps run from a button or an automation aren't policy-checked yet. Run from chat, they are.
- Rules check each command before it runs, not what a running program does: an allowed
python script.pycan still read.env. - Wrappers are unwrapped and force-push is recognised in every form, but other flags aren't normalised:
deny: "rm -rf"won't catchrm -frtoday, so add a line per spelling. - On the Open rule set, commands Warden can't read in advance (
eval,$(...)) run without asking. - Apple Silicon Macs only. No Windows, Linux or Intel builds yet.
- L2 plants up to five bugs per change: a useful signal, not a full mutation-testing run.
- Restore points skip git-ignored files, so they won't bring back a deleted
.env. - It's a developer preview, provided as is.
The questions engineers ask first.
- Do I give up Claude Code (or Codex)?
- No. Same agent, same subscription, same sign-in.
- You sign in once in its own CLI, as today, then work with it in Warden's window, beside an editor, instead of the terminal.
- Why not just use Claude Code's settings.json?
- Its rules match command text, not what the command does.
- Claude Code's permission rules match tool names, file paths and command patterns, so psql -c "..." is just a string to them. Warden parses the SQL passed with -c or -e, so production can block UPDATE, DELETE and schema changes, including a DELETE tucked inside a WITH ... SELECT, and allow inserts into one table, say bug_reports, while reads still run. You could build that with a PreToolUse hook; Warden ships it as one rule file that every agent you run in it is checked against.
- Can I make it deny-by-default?
- Yes.
- Set default: deny and Warden becomes a strict allow-list: a tool call runs only if one of your rules allows it. The starting rule sets use default: allow with a deny list instead, because a strict allow-list blocks even reading a README until you add a rule for it.
- How does it hook into the agent?
- Warden drives Claude Code, Codex, Copilot, Devin and Kimi over ACP, the Agent Client Protocol.
- With Claude Code, and with API-key or local models, every tool call is checked before it runs. With Codex, Copilot, Devin and Kimi, anything the agent asks permission for is checked before it runs; a tool it runs without asking is checked as it starts, so it may already have run, but a blocked result is thrown away before the agent sees it. A CLI that only runs headless with every tool pre-approved can't be checked first, so Warden won't run it while policy is on.
- Can the agent use my MCP servers and skills?
- Yes, once you connect them in Warden. They're handed to the agent.
- Your own skills and workflows run from Warden's chat as slash commands.
- Does it check Claude Code in my terminal too?
- No, only agents you run in Warden.
- Run them in Warden to get your rules; the CLI on its own isn't checked.
- My agent already has allow lists. Why this?
- Warden unwraps a command before it checks it.
- sudo, sh -c and ../ paths are resolved first, so cat .env is caught through all of them, and commands it cannot read in advance are asked about on Guarded. One rule file covers every agent you run in Warden.
- What if it can't tell what a command does?
- On Open it runs; on Guarded it asks you; on Hardened it blocks it.
- eval, $(...), backticks and inline python -c count as unreadable.
- Where does my code go?
- Only to the model you choose.
- Never to us on the Developer plan. On Team, it passes through Pluto only if your company uses our hosted AI gateway. Point the gateway at your own proxy and it never does.
- On Team, what does Pluto hold?
- Your rules, skills, plans and specs (and anything you write into them). Never your repository.
- Rules and skills sync down to every laptop; plans and specs are backed up. If your company uses our hosted AI gateway, model traffic passes through it.
- Windows, Linux or Intel Macs?
- Not yet.
- Apple Silicon Macs (M1 or later) only, for now.
- Can I use the free edition at work?
- Yes.
- It is licensed for commercial work, for your employer, your clients or your own company. Team adds rules nobody can loosen, shared skills, and an AI gateway so developers never hold provider keys. Your employer's own rules on new tools still apply.
- What does it cost?
- Developer is free, including at work. Team is custom-priced.
- Team is priced per seat plus a one-time setup fee, under a commercial licence and MSA. You can add our rollout service: we set Warden up around how your team ships, aimed at shipping faster without losing control. We quote after a walkthrough.