# Wardline > Open source control-plane proxy for AI agents: identity, policy, budget, audit for MCP and beyond - **Type:** MCP server - **Install:** `agentstack add mcp-kabirnarang39-wardline` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [kabirnarang39](https://agentstack.voostack.com/s/kabirnarang39) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [kabirnarang39](https://github.com/kabirnarang39) - **Source:** https://github.com/kabirnarang39/wardline - **Website:** https://kabirnarang39.github.io/wardline/ ## Install ```sh agentstack add mcp-kabirnarang39-wardline ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About **The control-plane proxy that auto-blocks compromised AI agents — in one static Go binary.** [](https://github.com/kabirnarang39/wardline/actions/workflows/ci.yml) [](https://github.com/kabirnarang39/wardline/releases) [](go.mod) [](https://pkg.go.dev/github.com/kabirnarang39/wardline) [](https://kabirnarang39.github.io/wardline/docs/) [](https://deepwiki.com/kabirnarang39/wardline) [](LICENSE) [](CONTRIBUTING.md) [](https://github.com/kabirnarang39/wardline/stargazers) --- **Wardline** is an open-source proxy that sits between your AI agents and everything they call (MCP servers, tools, gRPC upstreams) and enforces **identity, policy, budget, and audit** — with statistical anomaly detection that **blocks a compromised agent in real time**, no rule written for the attack and no human in the loop. One static Go binary; no database, IdP, or sidecar to start. ```bash make demo # spins up a mock MCP server + Wardline and runs the scenario above ``` The same run in the built-in read-only dashboard — the block, the anomaly that triggered it, and the policy behind it: ## How it works Any caller — an AI agent, a CLI/IDE, or an app — reaches its MCP/gRPC upstreams only through Wardline, which applies identity, policy, budget, and anomaly detection in-process and writes every decision to the audit trail. Full design: [Architecture](https://kabirnarang39.github.io/wardline/docs/concepts/architecture/). ## Key Features - **Real-time anomaly auto-block** Four self-baselining heuristics (rate spike, novel tool, deny-rate spike, and a combined `ml_score` z-score via Welford's algorithm — no training data, no external model) that don't just alert: `auto_block` *rejects* a flagged identity's calls for a bounded TTL. Enforcement, not a log line. - **Three policy backends, one binary** Static YAML, embedded OPA/Rego, and embedded AWS Cedar — switched by a single `policy_backend` config key, with no external process and no network hop. - **Identity & access** Short-lived RS256 JWT issuance with refresh tokens and JWKS rotation, OIDC / mTLS-SPIFFE bootstrap, Kubernetes-style RBAC, SCIM 2.0 provisioning, and end-to-end tenant isolation. - **Budget & rate control** Two-tier per-identity **and** per-tenant rate limits — both must clear for a call to proceed. - **Compliance & audit** Structured JSON audit trail, `wardline export-evidence` (checksummed, RSA-signable bundle for an auditor), configurable retention, and `wardline infer-policy` to generate a starter allow-list from observed traffic. - **Federation & observability** Cross-instance correlation over signed, pseudonymized anomaly summaries; OpenTelemetry tracing; a live web dashboard; and HA multi-replica deployment with shared state over Postgres. ## Getting Started ```bash # From source (always works) go build -o wardline ./cmd/wardline # Or pull the published multi-arch image (built for each tagged release) docker pull ghcr.io/kabirnarang39/wardline:latest ``` ```bash ./wardline validate-policy --file policy.yaml.example ./wardline validate-config --config wardline.yaml.example ./wardline serve --config wardline.yaml.example ``` Point `upstream` at a real MCP server (a proxied call 502s until you do — for a quick test, `python3 -m http.server 9000`). Every request carries an `X-Wardline-Identity` header; policy matches on that value plus the MCP tool name: ```bash curl -X POST http://localhost:8080 \ -H "X-Wardline-Identity: agent-abc123" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"read_file"}}' ``` Prebuilt binaries (linux/darwin/windows · amd64/arm64) and multi-arch images ship on every `v*` tag via [Releases](https://github.com/kabirnarang39/wardline/releases) and [GHCR](https://github.com/kabirnarang39/wardline/pkgs/container/wardline). ## Documentation Full docs, per-feature design notes, and honest known-limitations live on the docs site: - [Getting Started](https://kabirnarang39.github.io/wardline/docs/getting-started/) — install, quickstart, configuration - [Concepts](https://kabirnarang39.github.io/wardline/docs/concepts/) — architecture, policy backends, identity, audit - [Features](https://kabirnarang39.github.io/wardline/docs/features/) — every capability in depth - [Deployment](https://kabirnarang39.github.io/wardline/docs/deployment/) — Docker, Helm, HA, observability - [Framework integrations](docs/integrations/) — LangChain, LlamaIndex, OpenAI Agents SDK, CrewAI, raw MCP ## Full capability list Everything below is shipped and testable under [`internal/features/`](internal/features/). The v0.1 baseline (proxy + policy + audit) is always on; everything else is gated by a config flag. | Capability | Docs | |---|---| | Policy backends — YAML · OPA/Rego · AWS Cedar | [Policy backends](https://kabirnarang39.github.io/wardline/docs/concepts/policy-backends/) | | Anomaly detection + auto-block | [Anomaly detection](https://kabirnarang39.github.io/wardline/docs/features/anomaly-detection/) | | Budget enforcement (per-identity + per-tenant) | [Budget](https://kabirnarang39.github.io/wardline/docs/features/budget-enforcement/) | | Credential issuance (JWT + refresh + JWKS) | [Credentials](https://kabirnarang39.github.io/wardline/docs/features/credential-issuance/) | | SSO (OIDC) / mTLS-SPIFFE bootstrap | [SSO](https://kabirnarang39.github.io/wardline/docs/features/sso/) · [mTLS](https://kabirnarang39.github.io/wardline/docs/features/mtls-bootstrap/) | | RBAC + SCIM + tenancy | [RBAC](https://kabirnarang39.github.io/wardline/docs/features/rbac/) · [SCIM](https://kabirnarang39.github.io/wardline/docs/features/scim/) | | Federation (cross-instance correlation) | [Federation](https://kabirnarang39.github.io/wardline/docs/features/federation/) | | Compliance evidence export + retention | [Compliance](https://kabirnarang39.github.io/wardline/docs/features/compliance-evidence-export/) | | Auto-generated sandbox policy | [infer-policy](https://kabirnarang39.github.io/wardline/docs/features/auto-generated-policy/) | | Policy packs (12 embedded + `-packs-dir`) | [Policy packs](https://kabirnarang39.github.io/wardline/docs/features/policy-pack-marketplace/) | | gRPC transport passthrough | [gRPC](https://kabirnarang39.github.io/wardline/docs/features/grpc-transport/) | | Postgres storage + HA deployment | [HA](https://kabirnarang39.github.io/wardline/docs/deployment/high-availability/) | | Web dashboard | [Dashboard](https://kabirnarang39.github.io/wardline/docs/features/web-dashboard/) | | OpenTelemetry tracing | [Observability](https://kabirnarang39.github.io/wardline/docs/deployment/observability/) | | Taint tracking (untrusted-read gating) | [Taint tracking](https://kabirnarang39.github.io/wardline/docs/features/taint-tracking/) | | Approval workflow (needs_approval + approve-and-retry) | [Approval workflow](https://kabirnarang39.github.io/wardline/docs/features/approval-workflow/) | | Per-job budget ceiling (hard cap per tenant/identity/session job) | [Per-job budget ceiling](https://kabirnarang39.github.io/wardline/docs/features/job-budget/) | ## Performance Reproducible with `go test -bench`, not marketing numbers. `BenchmarkDecider_Decide` (default YAML backend, Apple Silicon): **~33 ns / 0 allocations** at 10 rules, ~2.4 µs at 1000 rules. The `ml_score` false-positive claim is regression-guarded by `TestDetector_MLScore_FalsePositiveRateOnSteadyTraffic` (asserts **0% false positives** on steady traffic, budget ## License [Apache 2.0](LICENSE). ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [kabirnarang39](https://github.com/kabirnarang39) - **Source:** [kabirnarang39/wardline](https://github.com/kabirnarang39/wardline) - **License:** Apache-2.0 - **Homepage:** https://kabirnarang39.github.io/wardline/ Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-kabirnarang39-wardline - Seller: https://agentstack.voostack.com/s/kabirnarang39 - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.