mcp-warden
access level: configurable✔ Source-reviewed Oct 2026
We read this project's source code and tool definitions (Oct 2026). This is a code review, not a live test against real systems. Re-check after upgrades.
| Repository | https://github.com/ermoluk/mcp-warden |
|---|---|
| Category | MCP infra |
| Systems touched | Any HTTP API, SSH hosts, SFTP, databases/Redis, reached through credential presets |
| Access (as described) | configurable |
| License / price | Apache-2.0 / free |
| GitHub stars | 10 |
| Read tools | list_presets; proxy_http on GET-only presets; db_query with named read queries |
| Write / delete / exec tools | proxy_http (any method a preset allows), ssh_exec (anchored regex allow-list, shell syntax refused), sftp_transfer, db_query (named queries only), get_secret_for_env (always prompts) |
| Read-only mode | Partial: per-preset allow-lists (methods, paths, commands, named queries); default approval = prompt and auto needs --confirm-auto; mcp-warden lock kill switch; config read once at startup |
| Safety notes | Allow-lists are checked before any credential is injected, and every call (including refused ones) goes to an append-only SQLite audit log. Watch for time-boxed approval windows, which let follow-up calls run without asking. get_secret_for_env still hands a key to a project file. |
| Verified | yes (source review 2026-10-31) |
| Notes | Local credential broker: secrets stay in the OS keychain and the agent only calls presets. Single Rust binary, in the official MCP Registry. Shared on Reddit 26 Oct 2026. Added 2026-10-31. |
📬 SysAdmin Agents
The SysAdmin Agents newsletter: new MCP servers, agent skills and safety notes for sysadmins. One email a week.