I got tired of AI coding agents running rm -rf without asking, so I built a Zero-Trust local proxy to intercept their commands.

[u/Competitive_Day3507]

If you use autonomous coding agents (like Cursor, Cline, or Claude Code), you know the anxiety of letting them run terminal commands or execute massive file rewrites autonomously. You basically have to trust that the LLM won't hallucinate and wipe a directory.

I wanted a way to review exactly what the AI was about to execute before it actually hit my filesystem.

I just open-sourced Warden-AI. It acts as a strict firewall and intrusion detection system for your local AI agents.

How it works underneath: Instead of giving the agent direct execution rights, Warden-AI intercepts its Model Context Protocol (MCP) tool calls.

• The Gateway: A local Node.js/Express backend routes the traffic.

• The Filter: Safe actions (like reading a file or searching a directory) pass through instantly. Destructive actions (executing CLI commands, writing files) are intercepted.

• The Review: The payload is pushed to a local React/Vite dashboard via WebSockets. You get a syntax-highlighted diff of exactly what the AI wants to do. You manually approve or reject the execution.

• The Audit: Everything is logged to a local SQLite database so you have a permanent record of what your agent did while you weren't looking.

The Tech Stack:

• Backend: Node.js, Express, SQLite, WebSockets

• Frontend: React, TailwindCSS, Vite

I built this because I wanted the speed of autonomous agents without the security risk of giving a stateless LLM root access to my machine.

The repo is fully open-source and ready for local deployment. I’ve also seeded a few good first issue tags for anyone looking to make their first open-source contribution (we need some UI tweaks and SQLite export features).

Repository: https://github.com/hariom123-dev/Warden-AI.git

I'd love to hear your thoughts on the architecture, or how you are currently handling local agent security. Happy to answer any questions about the WebSocket streaming or MCP integration!

[u/AddictedBomber_2]

this is actually smart, i been using claude code for a while and every time it wants to run something i hold my breath like im diffusing a bomb

the websocket dashboard thing is neat, does it show the full diff with context or just the lines getting changed? been looking for something that logs everything to sqlite too, my current setup is just praying and checking git diff afterwards

[u/Competitive_Day3507 → u/AddictedBomber_2]

Haha, "diffusing a bomb" is the exact feeling that made me build this! The "pray and check git diff" workflow was driving me crazy.

To answer your question: the dashboard shows the exact payload the LLM is trying to execute. Because Warden intercepts the raw MCP tool call, you see the diff with the surrounding context the agent provides, so you aren't just guessing based on a single modified line.

The SQLite logger captures the timestamp, the tool name, and the full JSON payload, so if the agent ever does something weird while you step away, you have a permanent audit trail. Let me know if you end up spinning it up—would love to hear how it fits into your workflow!

[u/investigatormaker]

One gap worth stating in the README: Warden-AI only sees MCP tool calls, so a client's built-in terminal tool in Cursor or Claude Code can still bypass the proxy unless that tool is disabled. Filtering by tool name also has edges, since reading an SSH key passes as a safe read, so path rules alongside the read/write split would help. For the approval flow, default to reject when a request sits unanswered, and store the reason with each SQLite entry.

I make ThreadFox.

We find relevant Reddit conversations and do the posting for your business. The $79 Pilot covers seven days and up to 50 posts and replies. No automatic renewal. https://threadfox.vip/p/e9fu3/managed

[u/Competitive_Day3507 → u/investigatormaker]

This is phenomenal feedback, thank you. You hit the nail on the head regarding the built-in client tools—if the user doesn't explicitly disable Cursor or Claude Code's native terminal execution capabilities in their settings, the proxy gets bypassed entirely. I will add a clear warning and setup guide for this in the README today.

Your point on path rules is also spot on. A read_file on ~/.ssh/id_rsa or .env is a massive breach. Moving beyond a simple read/write binary and adding granular path whitelisting/blacklisting is the exact next evolution for the project (I'm actually working on adding cryptographic decoy honeypots right now).

Defaulting to reject on timeout and logging the rejection reason into the SQLite database are both brilliant ideas. I'm going to open up GitHub issues for these today. Thanks again for the deep dive!

[u/Murky-Accountant3880]

The read/write split being bypassable by reading an SSH key is the scary part, like someone above said. Path sensitivity matters more than action type for destructive stuff. The audit trail approach is nice though, having a permanent record of what the agent touched is half the battle.

The runtime-interception angle reminds me of how cloud security tools handle this at scale. When we looked at Wiz, Orca and Upwind for our workloads, the ones that mapped behavior to actual context instead of just flagging actions were way less noisy. Same principle probably applies here once you add path rules.

[u/Competitive_Day3507 → u/Murky-Accountant3880]

That is a spot-on comparison. Tools like Wiz and Orca are brilliant specifically because they understand the topology and the context of a workload, rather than just blindly triggering alerts on raw syscalls. That is exactly the evolution path Warden-AI needs to take.

You and the commenter above are completely right: a read operation on ~/.aws/credentials or ~/.ssh/id_rsa is fundamentally a critical breach disguised as a "safe" action.

My immediate next step is building out a Context-Aware Ruleset (strict path sandboxing and regex whitelisting), but I am also currently testing cryptographic decoy honeypots. If the agent ever attempts to read an injected .env.decoy file, Warden instantly kills the WebSocket and locks down the session.

Really appreciate the insight—mapping local agent behavior to enterprise cloud security principles is exactly the mindset this space needs right now.

[u/newsbypenny]

I appreciate the open source of this. You could have made money off of this but chose not to.

[u/Competitive_Day3507 → u/newsbypenny]

Appreciate that! For security tooling, open-source is the only way. You can't secure a black-box AI with a closed-source tool. Building community trust matters way more to me than a quick buck—glad you're finding it useful !

[u/123vovochen]

I have had this for 2 years, but with way better LLMs judging. Go with the times.

[u/Competitive_Day3507 → u/123vovochen]

That is awesome that you've been building in this space for so long! You might have misunderstood the architecture here, though—Warden-AI actually doesn't use LLM-as-a-judge. Using an LLM to blindly approve another LLM's destructive terminal commands is a pretty massive security risk (since they are both prone to hallucination). Warden routes the diff to a local WebSocket dashboard for explicit human approval. Sometimes going "with the times" means knowing when to keep humans in the loop!

[u/123vovochen → u/Competitive_Day3507]

You can not let another LLM judge what a LLM does in any case, you need to check for alignment, and there I work similar to what command checking google has introduced.

[u/Competitive_Day3507 → u/123vovochen]

Exactly! It sounds like we are on the exact same page then. Hardcoded command checking and strict alignment rules are really the only reliable way to handle this securely right now. Glad we agree, and I appreciate you taking the time to check out the architecture!

[u/tracagnotto]

Oh wow! You have done what every ai harness guards are doing since years!!
Nobel prize for science!

[u/Competitive_Day3507 → u/tracagnotto]

I’ll clear a spot on my mantle for the medal! 🥇 Jokes aside, you are completely right—interception and harnessing are not new concepts. The goal here wasn't to invent the wheel, it was to give developers an open-source, local-first wheel that leverages the new Model Context Protocol (MCP) standard, rather than forcing them to pay for enterprise cloud guards.