{"slug": "show-hn-wardline-a-go-proxy-that-auto-blocks-compromised-ai-agents", "title": "Show HN: Wardline, a Go proxy that auto-blocks compromised AI agents", "summary": "Wardline, an open-source Go proxy released by developer Kabir Narang, automatically blocks compromised AI agents in real time by enforcing identity, policy, budget, and audit with statistical anomaly detection, requiring no rule writing or human intervention. The single static binary supports multiple policy backends (YAML, OPA/Rego, AWS Cedar), short-lived JWT issuance, RBAC, SCIM 2.0, and rate limiting, and is available on GitHub and GHCR for Linux, Darwin, and Windows on amd64 and arm64.", "body_md": "**Wardline** is an open-source proxy that sits between your AI agents and everything they call (MCP servers, tools, gRPC upstreams) and enforces **identity, policy, budget, and audit** — with statistical anomaly detection that **blocks a compromised agent in real time**, no rule written for the attack and no human in the loop. One static Go binary; no database, IdP, or sidecar to start.\n\n```\nmake demo   # spins up a mock MCP server + Wardline and runs the scenario above\n```\n\nThe same run in the built-in read-only dashboard — the block, the anomaly that triggered it, and the policy behind it:\n\nAny caller — an AI agent, a CLI/IDE, or an app — reaches its MCP/gRPC upstreams only through Wardline, which applies identity, policy, budget, and anomaly detection in-process and writes every decision to the audit trail.\n\nFull design: [Architecture](https://kabirnarang39.github.io/wardline/docs/concepts/architecture/).\n\n-\n**Real-time anomaly auto-block**\n\nFour self-baselining heuristics (rate spike, novel tool, deny-rate spike, and a combined`ml_score`\n\nz-score via Welford's algorithm — no training data, no external model) that don't just alert:`auto_block`\n\n*rejects*a flagged identity's calls for a bounded TTL. Enforcement, not a log line. -\n**Three policy backends, one binary**\n\nStatic YAML, embedded OPA/Rego, and embedded AWS Cedar — switched by a single`policy_backend`\n\nconfig key, with no external process and no network hop. -\n**Identity & access**\n\nShort-lived RS256 JWT issuance with refresh tokens and JWKS rotation, OIDC / mTLS-SPIFFE bootstrap, Kubernetes-style RBAC, SCIM 2.0 provisioning, and end-to-end tenant isolation. -\n**Budget & rate control**\n\nTwo-tier per-identity**and** per-tenant rate limits — both must clear for a call to proceed. -\n**Compliance & audit**\n\nStructured JSON audit trail,`wardline export-evidence`\n\n(checksummed, RSA-signable bundle for an auditor), configurable retention, and`wardline infer-policy`\n\nto generate a starter allow-list from observed traffic. -\n**Federation & observability**\n\nCross-instance correlation over signed, pseudonymized anomaly summaries; OpenTelemetry tracing; a live web dashboard; and HA multi-replica deployment with shared state over Postgres.\n\n```\n# From source (always works)\ngo build -o wardline ./cmd/wardline\n\n# Or pull the published multi-arch image (built for each tagged release)\ndocker pull ghcr.io/kabirnarang39/wardline:latest\n./wardline validate-policy --file policy.yaml.example\n./wardline validate-config --config wardline.yaml.example\n./wardline serve --config wardline.yaml.example\n```\n\nPoint `upstream`\n\nat a real MCP server (a proxied call 502s until you do — for a quick test, `python3 -m http.server 9000`\n\n). Every request carries an `X-Wardline-Identity`\n\nheader; policy matches on that value plus the MCP tool name:\n\n```\ncurl -X POST http://localhost:8080 \\\n  -H \"X-Wardline-Identity: agent-abc123\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"params\":{\"name\":\"read_file\"}}'\n```\n\nPrebuilt binaries (linux/darwin/windows · amd64/arm64) and multi-arch images ship on every `v*`\n\ntag via [Releases](https://github.com/kabirnarang39/wardline/releases) and [GHCR](https://github.com/kabirnarang39/wardline/pkgs/container/wardline).\n\nFull docs, per-feature design notes, and honest known-limitations live on the docs site:\n\n[Getting Started](https://kabirnarang39.github.io/wardline/docs/getting-started/)— install, quickstart, configuration[Concepts](https://kabirnarang39.github.io/wardline/docs/concepts/)— architecture, policy backends, identity, audit[Features](https://kabirnarang39.github.io/wardline/docs/features/)— every capability in depth[Deployment](https://kabirnarang39.github.io/wardline/docs/deployment/)— Docker, Helm, HA, observability[Framework integrations](/kabirnarang39/wardline/blob/main/docs/integrations)— LangChain, LlamaIndex, OpenAI Agents SDK, CrewAI, raw MCP\n\nEverything below is shipped and testable under [ internal/features/](/kabirnarang39/wardline/blob/main/internal/features). The v0.1 baseline (proxy + policy + audit) is always on; everything else is gated by a config flag.\n\n| Capability | Docs |\n|---|---|\n| Policy backends — YAML · OPA/Rego · AWS Cedar |\n|\n\n[Anomaly detection](https://kabirnarang39.github.io/wardline/docs/features/anomaly-detection/)[Budget](https://kabirnarang39.github.io/wardline/docs/features/budget-enforcement/)[Credentials](https://kabirnarang39.github.io/wardline/docs/features/credential-issuance/)[SSO](https://kabirnarang39.github.io/wardline/docs/features/sso/)·[mTLS](https://kabirnarang39.github.io/wardline/docs/features/mtls-bootstrap/)[RBAC](https://kabirnarang39.github.io/wardline/docs/features/rbac/)·[SCIM](https://kabirnarang39.github.io/wardline/docs/features/scim/)[Federation](https://kabirnarang39.github.io/wardline/docs/features/federation/)[Compliance](https://kabirnarang39.github.io/wardline/docs/features/compliance-evidence-export/)[infer-policy](https://kabirnarang39.github.io/wardline/docs/features/auto-generated-policy/)`-packs-dir`\n\n)[Policy packs](https://kabirnarang39.github.io/wardline/docs/features/policy-pack-marketplace/)[gRPC](https://kabirnarang39.github.io/wardline/docs/features/grpc-transport/)[HA](https://kabirnarang39.github.io/wardline/docs/deployment/high-availability/)[Dashboard](https://kabirnarang39.github.io/wardline/docs/features/web-dashboard/)[Observability](https://kabirnarang39.github.io/wardline/docs/deployment/observability/)Reproducible with `go test -bench`\n\n, not marketing numbers. `BenchmarkDecider_Decide`\n\n(default YAML backend, Apple Silicon): **~33 ns / 0 allocations** at 10 rules, ~2.4 µs at 1000 rules. The `ml_score`\n\nfalse-positive claim is regression-guarded by `TestDetector_MLScore_FalsePositiveRateOnSteadyTraffic`\n\n(asserts **0% false positives** on steady traffic, budget < 2%).\n\nThe dashboard and the `X-Wardline-Identity`\n\nheader are **unauthenticated by default** — pair with `credential_issuance`\n\nand/or `rbac`\n\nfor real security value. Every optional capability ships off by default and fails closed. On startup Wardline logs a `WARN`\n\nfor each insecure default still in effect, so the posture is never silent. Report vulnerabilities per [SECURITY.md](/kabirnarang39/wardline/blob/main/SECURITY.md).\n\nOut of the box the proxy fails closed on *policy*, but identity and the dashboard are open. For any real deployment, turn on:\n\n```\nfeatures:\n  credential_issuance: true   # verify a signed bearer token instead of trusting X-Wardline-Identity\n  rbac: true                  # gate the dashboard and admin actions on real permissions\n```\n\nWith `credential_issuance`\n\non, the spoofable header is replaced by RS256 bearer-token verification; with `rbac`\n\non, dashboard read views and mutations require an authorized identity. Anomaly detection catches *abrupt* abuse but not *low-and-slow* ramps (see [its known limitations](https://kabirnarang39.github.io/wardline/docs/features/anomaly-detection/)), so keep explicit policy + budget limits as the hard floor.\n\nWardline is young and moving fast. Every feature's docs page is deliberately blunt about what it does and doesn't do. Feedback, issues, and contributions are welcome — especially on the anomaly-detection approach and threat model.\n\nSee [CONTRIBUTING.md](/kabirnarang39/wardline/blob/main/CONTRIBUTING.md) and [CODE_OF_CONDUCT.md](/kabirnarang39/wardline/blob/main/CODE_OF_CONDUCT.md). Architecture and engineering conventions are documented in [CLAUDE.md](/kabirnarang39/wardline/blob/main/CLAUDE.md); the roadmap lives in the [docs](https://kabirnarang39.github.io/wardline/docs/advanced/roadmap/).", "url": "https://wpnews.pro/news/show-hn-wardline-a-go-proxy-that-auto-blocks-compromised-ai-agents", "canonical_source": "https://github.com/kabirnarang39/wardline", "published_at": "2026-08-09 21:03:50+00:00", "updated_at": "2026-08-09 21:35:01.312616+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-tools", "ai-agents"], "entities": ["Wardline", "Kabir Narang", "GitHub", "GHCR", "OPA", "AWS Cedar", "OpenTelemetry", "Postgres"], "alternates": {"html": "https://wpnews.pro/news/show-hn-wardline-a-go-proxy-that-auto-blocks-compromised-ai-agents", "markdown": "https://wpnews.pro/news/show-hn-wardline-a-go-proxy-that-auto-blocks-compromised-ai-agents.md", "text": "https://wpnews.pro/news/show-hn-wardline-a-go-proxy-that-auto-blocks-compromised-ai-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-wardline-a-go-proxy-that-auto-blocks-compromised-ai-agents.jsonld"}}