Warden sandboxed 18 MCP servers, fixed the top two compatibility gaps (grant overlap coalescing and bare-executable resolution), added a full compatibility matrix with regression fixtures, and reworke
View on GitHub ↗Homepage ↗A lightweight sandbox runtime for MCP servers.
MCP servers routinely run as a plain Node or Python process on your machine with full filesystem and network access — even ones you just cloned from GitHub five minutes ago. Warden runs them in a restricted sandbox instead, so a server only ever gets the files, network hosts, and environment variables you explicitly grant it.
Status: early development / pre-alpha. See ROADMAP.md for what's built and what's next. Not ready for production use yet — this repo is currently a design skeleton to build from.
MCP's spec doesn't require any process isolation. The default install path for most servers is "run this script with your user's full permissions." That means a malicious or buggy MCP server can read your SSH keys, exfiltrate data over the network, or write anywhere on disk — and nothing in the protocol stops it.
Warden spawns the server inside a sandbox that:
- Filesystem: only sees the paths you list, read-only or read-write as you specify. Everything else is invisible, not just "permission denied." - Network: can only reach the hostnames you allowlist. Everything else is blocked at the sandbox boundary, before DNS even resolves. - Environment: only receives the environment variables you pass through — no automatic inheritance of your full shell environment. - Stdio: passed through transparently, so the MCP client (Claude, an IDE, etc.) talks to the sandboxed process exactly like it would an unsandboxed one. Sandboxing is invisible to the protocol. - Audit log: records every file access attempt and network connection attemp
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/Prof-bilal--Warden.html)
Git-native persistent memory for AI coding agents. Implements Google OKF v0.2 with sub-300µs in-memory BM25 search, embedded MCP server, and progressive disclosure. Slashes token bloat by 80% with zer
vshulcz/deja-vuYour agents already solved this. deja finds it — retroactive search and MCP recall over the session logs your coding agents already wrote. Cross-agent, SSH-portable, one zero-dep binary, fully local.
olucurious/watchtowerSelf-hosted error tracking. A drop-in for Sentry and AppSignal SDKs: one Go binary and Postgres, with Slack, Linear, email and an MCP server for coding agents.
KnifeLemon/DroidlineAndroid automation from code. Test your apps on real phones, script the tasks you repeat, run a shelf of phones, or let an AI agent use one, from Python, Node.js, the CLI, HTTP or Appium clients. No A
enowdev/succubusCross-agent coordination for AI coding agents. One daemon, one database — so multiple agents in one repo can see each other's plan, tasks, and file claims.
AsWali/CallBoardA shared to-do list for you and your AI coding agents
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.