WardenClaw
GitHub
Menu
Documentation menu
On this page

Documentation

WardenClaw puts the risky commands of an AI agent on a Linux server behind a signature. wardend runs the agent under a seccomp filter, stops every exec that trips a rule right in the kernel, and lets it run only with an Ed25519 signature from a device you paired: the phone app or wardenctl on your laptop. The signing key never lives on the server.

Status: prototype. Flags and formats can still change.

Two ways in

Try it in 5 minutes

No root, no phone, no agent. Install wardend for your own user, run one command under it and approve it from a second terminal with a test key. You see what the kernel stops, what a signed decision does and what lands in the journal. With the app on your phone it is one command, wardend wrap -- <command>: it pairs the phone on the first run and asks it before the risky commands. wardend then runs as the same user as the command, which cannot bypass the gate but can read wardend’s files and edit its config between runs; the real separation is the install below.

Try it in 5 minutes

Put it on a server for real

The hardened install: wardend as a root system service, the agent under its own user, so the model cannot turn the gate off. Every launch is a card on the phone; until a phone is paired nothing the agent launches will run. Observe (sign everything, watch), delegate (a judge decides) or decide by hand is the phone’s choice.

  1. Install wardend: the hardened install, steps 1 to 4.
  2. Get the app: Android, iPhone or wardenctl on a laptop.
  3. Connect the phone: an address the phone can reach, pairing and a check.
  4. Watch the cards and set the phone’s mode: the app’s observe mode signs every card while you see what the agent asks for.

I want to…