warden run

Launch an agent wired for governed credentials and signing.

warden run --warrant warden2_… -- claude

One command wires an agent for governed access:

  • Web2 — it starts the warden-gateway against your vault and routes the agent's HTTP through it, so credentials are injected at the edge.
  • Web3 — it exports $WARDEN_TOKEN / $WARDEN_VAULT into the agent's environment, so the agent signs by running warden sign … directly (the token is read from the env, never the command line).
  • It drops a short skill into ./AGENTS.md and launches the agent.

Nothing is persisted to disk — Web2 lives in the proxy, Web3 in the runtime env.

Flag
--warrantBearer token the agent acts under (else $WARDEN_TOKEN).
--no-proxyDon't start or route through the gateway. Web2 calls won't be credentialed — for Web3-only agents that just sign.
--no-skillDon't append the AGENTS.md skill.
-- <agent…>The agent command to launch, after -- (e.g. -- claude).

The agent makes its normal HTTP requests with a placeholder credential; Warden swaps in the real scoped one at the edge and enforces policy — destructive routes can be held for approval. The gateway runs on a per-vault loopback port (auto-chosen; bound to 127.0.0.1).

Prefer a structured warden_sign tool over the warden sign command (e.g. an MCP client with no shell)? Register the warden mcp server in the agent's config yourself — warden run doesn't, to keep one clear signing path.

Agent notes

warden run is agent-agnostic — any command works, and governance applies as long as the agent honors HTTPS_PROXY (almost all do: Claude Code, Cursor, OpenCode, Codex, curl/SDKs, git…).

Two CLIs validate their provider auth before making any request, so they'd refuse to start under a broker that injects at the edge. warden run shims them with a placeholder — but only when the warrant scopes that provider's secret, so the gateway has a real key to inject (otherwise the agent's own auth, e.g. a Claude subscription, is left intact):

AgentShim (only if the secret is scoped)
claude (Claude Code)ANTHROPIC_API_KEY=placeholder (scope an api.anthropic.com secret)
codex (Codex)OPENAI_API_KEY=placeholder (scope an api.openai.com secret)

Use API-key provider secrets. ChatGPT-login (Codex OAuth) / Claude OAuth tokens aren't shimmed yet.