Wardline is an open-source proxy that sits between your AI agents and everything they call (MCP servers, tools, gRPC upstreams) and enforces identity, policy, budget, and audit — with statistical anomaly detection that blocks a compromised agent in real time, no rule written for the attack and no human in the loop. One static Go binary; no database, IdP, or sidecar to start.
make demo # spins up a mock MCP server + Wardline and runs the scenario above
The same run in the built-in read-only dashboard — the block, the anomaly that triggered it, and the policy behind it:
Any caller — an AI agent, a CLI/IDE, or an app — reaches its MCP/gRPC upstreams only through Wardline, which applies identity, policy, budget, and anomaly detection in-process and writes every decision to the audit trail.
Full design: Architecture.
Real-time anomaly auto-block
Four self-baselining heuristics (rate spike, novel tool, deny-rate spike, and a combinedml_score
z-score via Welford's algorithm — no training data, no external model) that don't just alert:auto_block
rejectsa flagged identity's calls for a bounded TTL. Enforcement, not a log line. - Three policy backends, one binary
Static YAML, embedded OPA/Rego, and embedded AWS Cedar — switched by a singlepolicy_backend
config key, with no external process and no network hop. - Identity & access
Short-lived RS256 JWT issuance with refresh tokens and JWKS rotation, OIDC / mTLS-SPIFFE bootstrap, Kubernetes-style RBAC, SCIM 2.0 provisioning, and end-to-end tenant isolation. - Budget & rate control
Two-tier per-identityand per-tenant rate limits — both must clear for a call to proceed. - Compliance & audit
Structured JSON audit trail,wardline export-evidence
(checksummed, RSA-signable bundle for an auditor), configurable retention, andwardline infer-policy
to generate a starter allow-list from observed traffic. - Federation & observability
Cross-instance correlation over signed, pseudonymized anomaly summaries; OpenTelemetry tracing; a live web dashboard; and HA multi-replica deployment with shared state over Postgres.
go build -o wardline ./cmd/wardline
docker pull ghcr.io/kabirnarang39/wardline:latest
./wardline validate-policy --file policy.yaml.example
./wardline validate-config --config wardline.yaml.example
./wardline serve --config wardline.yaml.example
Point upstream
at a real MCP server (a proxied call 502s until you do — for a quick test, python3 -m http.server 9000
). Every request carries an X-Wardline-Identity
header; policy matches on that value plus the MCP tool name:
curl -X POST http://localhost:8080 \
-H "X-Wardline-Identity: agent-abc123" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"read_file"}}'
Prebuilt binaries (linux/darwin/windows · amd64/arm64) and multi-arch images ship on every v*
Full docs, per-feature design notes, and honest known-limitations live on the docs site:
Getting Started— install, quickstart, configurationConcepts— architecture, policy backends, identity, auditFeatures— every capability in depthDeployment— Docker, Helm, HA, observabilityFramework integrations— LangChain, LlamaIndex, OpenAI Agents SDK, CrewAI, raw MCP
Everything below is shipped and testable under internal/features/. The v0.1 baseline (proxy + policy + audit) is always on; everything else is gated by a config flag.
| Capability | Docs |
|---|---|
| Policy backends — YAML · OPA/Rego · AWS Cedar | |
Anomaly detectionBudgetCredentialsSSO·mTLSRBAC·SCIMFederationComplianceinfer-policy-packs-dir
)Policy packsgRPCHADashboardObservabilityReproducible with go test -bench
, not marketing numbers. BenchmarkDecider_Decide
(default YAML backend, Apple Silicon): ~33 ns / 0 allocations at 10 rules, ~2.4 µs at 1000 rules. The ml_score
false-positive claim is regression-guarded by TestDetector_MLScore_FalsePositiveRateOnSteadyTraffic
(asserts 0% false positives on steady traffic, budget < 2%).
The dashboard and the X-Wardline-Identity
header are unauthenticated by default — pair with credential_issuance
and/or rbac
for real security value. Every optional capability ships off by default and fails closed. On startup Wardline logs a WARN
for each insecure default still in effect, so the posture is never silent. Report vulnerabilities per SECURITY.md.
Out of the box the proxy fails closed on policy, but identity and the dashboard are open. For any real deployment, turn on:
features:
credential_issuance: true # verify a signed bearer token instead of trusting X-Wardline-Identity
rbac: true # gate the dashboard and admin actions on real permissions
With credential_issuance
on, the spoofable header is replaced by RS256 bearer-token verification; with rbac
on, dashboard read views and mutations require an authorized identity. Anomaly detection catches abrupt abuse but not low-and-slow ramps (see its known limitations), so keep explicit policy + budget limits as the hard floor.
Wardline is young and moving fast. Every feature's docs page is deliberately blunt about what it does and doesn't do. Feedback, issues, and contributions are welcome — especially on the anomaly-detection approach and threat model.
See CONTRIBUTING.md and CODE_OF_CONDUCT.md. Architecture and engineering conventions are documented in CLAUDE.md; the roadmap lives in the docs.