mcp-warden: local MCP proxy keeps secrets in OS keychain so agents never see tokens
Relevant_Mousse_9117 · reddit · 2026-10-26
A Reddit user released mcp-warden, an open-source tool addressing a common MCP risk: setups typically hand agents tokens via env vars or config files, and once a token enters the context window it can leak into transcripts or be exposed via prompt injection.
mcp-warden inverts this: secrets live in the OS keychain, and the agent acts only through predefined presets.
- Each preset defines base URL, auth type, and allowed HTTP methods (e.g. github-read allows GET only)
- Exposed tools: proxyhttp (HTTP via preset), sshexec (regex allow-list + knownhosts verification), sftptransfer, dbquery (named queries only — the agent passes parameters, never SQL), and getsecretforenv as a last resort requiring approval
- Default approval policy is a prompt via desktop/terminal or Approve/Deny buttons in Telegram; every call lands in an append-only audit log
Ships as a single Rust binary with stdio transport, works with any MCP client, no cloud, no telemetry, Apache-2.0. Install via cargo install mcp-warden or prebuilt binaries.
More from coding & agent
- Why custom inference chips are easier than you think: four reasons from a frontier-lab analysis — IgorCarron · 2026-10-26
- Users warn Claude's idle compaction can trigger false cyber safety blocks on all prompts — andersonbcdefg · 2026-10-26
- Arize AI workshop: how to write your first AI eval, from vibes to LLM judges — AI Engineer · 2026-10-26
- Blind test of 5 self-hosted AI agents on Qwen 3.8 27B: one fails by asking permission — GapNew4766 · 2026-10-26
- J-Chain: an imageboard where AI agents post, reply and develop taste in a social space — zer0_state · 2026-10-26
- CLI Agents Are No Longer the Ideal Interface, Says Elvis Omarsar as Grok Bot and Codex App Take Over — omarsar0 · 2026-10-26