Warden is a local-first vault for wallets and secrets, with Sui guardrails — every high-risk action waits for the owner wallet's sign-off. Move anchors authority, Seal gates vault decryption, and Walrus holds a tamper-evident policy and audit trail.
Hand an agent a private key or an API token and you've handed it everything that key can do — at machine speed, with no second look. On-chain, there's no undo.
Warden keeps your wallets and secrets in a local, sealed vault. Agents never get the keys — only a scoped warrant carrying policy rules and approval gates, all backed by Sui.
2 surfaces: wallets or secrets
The in-process signer (warden sign) authorizes and signs transactions. Within policy → signed; over the threshold → held for owner sign-off. Keys never leave the vault.
The HTTP proxy (warden-gateway) injects the real credentials upstream. For routes and requests that require manual_approval → held for owner sign-off. Secrets never leave the vault.
Policy lives at the broker, not in a prompt — so a jailbreak or a bad plan can't talk its way past it.
Chain allowlists, spend thresholds, rate limits, and per-warrant scope + expiry. Routine calls pass through; risky ones don't.
High-risk actions are held until you approve from your wallet — on-chain tx, off-chain signature, or Telegram. Action-bound, and fail-closed on timeout.
Revoke a warrant or the whole vault from your wallet. Seal then refuses decryption — the agent is cut off network-wide, not by trusting a server.
Authority, sealing, and the audit trail are enforced by Sui primitives, not by Warden's own process.
A registry of vaults and warrants. Registering takes the vault key's signature; revoking and re-enabling take your owner wallet. Authority is on-chain, not a config flag.
The Warden vault is sealed with Seal's threshold encryption. Key servers release shares only while seal_approve_vault passes — so revoke is a real kill-switch, enforced by the network.
Policy blobs and the approval audit log live on Walrus — content-addressed and tamper-evident, off your machine and impossible to quietly rewrite.
Sign in as the owner with an identity you already have — no new keypair to generate, store, or lose. Access to Warden vault can be totally passwordless.
Let an agent move funds within limits; hold the big transfers for your wallet. Keys never leave the vault.
Agents call Stripe, GitHub, internal APIs — through the gateway, with credentials they never get to see.
Issue, scope, and revoke each agent's authority on-chain. One wallet, one source of truth.
Every action and approval lands in a hash-chained, Sui-anchored, Walrus-backed trail.
Warden governs at the mechanism level — an HTTP proxy and an in-process signer — so it wires into anything that runs a tool. One command for CLIs, one server for MCP clients. No SDK, no rewrite.
Drop warden run -- in front of any agent — its HTTP routes through the gateway, its signing through the vault. The agent never sees a key.
Prefer a structured tool? Point any MCP client at warden mcp — it exposes warden_sign and friends, every call policy-checked.