wardline

The control-plane proxy that auto-blocks compromised AI agents — in one static Go binary.

Wardline is an open-source proxy that sits between your AI agents and everything they call (MCP servers, tools, gRPC upstreams) and enforces identity, policy, budget, and audit — with statistical anomaly detection that blocks a compromised agent in real time, no rule written for the attack and no human in the loop. One static Go binary; no database, IdP, or sidecar to start.

make demo   # spins up a mock MCP server + Wardline and runs the scenario above

The same run in the built-in read-only dashboard — the block, the anomaly that triggered it, and the policy behind it:

How it works

Any caller — an AI agent, a CLI/IDE, or an app — reaches its MCP/gRPC upstreams only through Wardline, which applies identity, policy, budget, and anomaly detection in-process and writes every decision to the audit trail.

Full design: Architecture.

Key Features

• Real-time anomaly auto-block
  
  Four self-baselining heuristics (rate spike, novel tool, deny-rate spike, and a combined ml_score z-score via Welford's algorithm — no training data, no external model) that don't just alert: auto_block rejects a flagged identity's calls for a bounded TTL. Enforcement, not a log line.

• Three policy backends, one binary
  
  Static YAML, embedded OPA/Rego, and embedded AWS Cedar — switched by a single policy_backend config key, with no external process and no network hop.

• Identity & access
  
  Short-lived RS256 JWT issuance with refresh tokens and JWKS rotation, OIDC / mTLS-SPIFFE bootstrap, Kubernetes-style RBAC, SCIM 2.0 provisioning, and end-to-end tenant isolation.

• Budget & rate control
  
  Two-tier per-identity and per-tenant rate limits — both must clear for a call to proceed.

• Compliance & audit
  
  Structured JSON audit trail, wardline export-evidence (checksummed, RSA-signable bundle for an auditor), configurable retention, and wardline infer-policy to generate a starter allow-list from observed traffic.

• Federation & observability
  
  Cross-instance correlation over signed, pseudonymized anomaly summaries; OpenTelemetry tracing; a live web dashboard; and HA multi-replica deployment with shared state over Postgres.

Getting Started

# From source (always works)
go build -o wardline ./cmd/wardline

# Or pull the published multi-arch image (built for each tagged release)
docker pull ghcr.io/kabirnarang39/wardline:latest

./wardline validate-policy --file policy.yaml.example
./wardline validate-config --config wardline.yaml.example
./wardline serve --config wardline.yaml.example

Point upstream at a real MCP server (a proxied call 502s until you do — for a quick test, python3 -m http.server 9000). Every request carries an X-Wardline-Identity header; policy matches on that value plus the MCP tool name:

curl -X POST http://localhost:8080 \
  -H "X-Wardline-Identity: agent-abc123" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"read_file"}}'

Prebuilt binaries (linux/darwin/windows · amd64/arm64) and multi-arch images ship on every v* tag via Releases and GHCR.

Documentation

Full docs, per-feature design notes, and honest known-limitations live on the docs site:

• Getting Started — install, quickstart, configuration
• Concepts — architecture, policy backends, identity, audit
• Features — every capability in depth
• Deployment — Docker, Helm, HA, observability
• Framework integrations — LangChain, LlamaIndex, OpenAI Agents SDK, CrewAI, raw MCP

Full capability list

Everything below is shipped and testable under internal/features/. The v0.1 baseline (proxy + policy + audit) is always on; everything else is gated by a config flag.

Performance

Reproducible with go test -bench, not marketing numbers. BenchmarkDecider_Decide (default YAML backend, Apple Silicon): ~33 ns / 0 allocations at 10 rules, ~2.4 µs at 1000 rules. The ml_score false-positive claim is regression-guarded by TestDetector_MLScore_FalsePositiveRateOnSteadyTraffic (asserts 0% false positives on steady traffic, budget < 2%).

Security

The dashboard and the X-Wardline-Identity header are unauthenticated by default — pair with credential_issuance and/or rbac for real security value. Every optional capability ships off by default and fails closed. On startup Wardline logs a WARN for each insecure default still in effect, so the posture is never silent. Report vulnerabilities per SECURITY.md.

Hardening

Out of the box the proxy fails closed on policy, but identity and the dashboard are open. For any real deployment, turn on:

features:
  credential_issuance: true   # verify a signed bearer token instead of trusting X-Wardline-Identity
  rbac: true                  # gate the dashboard and admin actions on real permissions

With credential_issuance on, the spoofable header is replaced by RS256 bearer-token verification; with rbac on, dashboard read views and mutations require an authorized identity. Anomaly detection catches abrupt abuse but not low-and-slow ramps (see its known limitations), so keep explicit policy + budget limits as the hard floor.

Project status

Wardline is young and moving fast. Every feature's docs page is deliberately blunt about what it does and doesn't do. Feedback, issues, and contributions are welcome — especially on the anomaly-detection approach and threat model.

Contributing

See CONTRIBUTING.md and CODE_OF_CONDUCT.md. Architecture and engineering conventions are documented in CLAUDE.md; the roadmap lives in the docs.

License

Apache 2.0.