MCP tools (Web3, optional)
Optional stdio MCP tools for signing and introspection — keys never exposed.
By default Warden uses no MCP server: the agent signs by running warden sign
directly, with the warrant token read from its environment ($WARDEN_TOKEN, set by
warden run). Nothing is persisted to disk.
warden mcp is an advanced, manual alternative for MCP clients that prefer a structured signing
tool over the CLI (e.g. a client with no shell). warden run does not register it — you wire it into
the client's config yourself. It's a Model Context Protocol server
over stdio exposing the warrant's Web3 capabilities:
| Tool | |
|---|---|
warden_scope | What this warrant grants — wallets, policy, mode, expiry. Read-only. |
warden_sign | Authorize + sign a transaction with a scoped wallet. Within policy it signs; over the threshold it holds for the owner's approval. Returns the signature, never the key. |
Point it at the token with --token-file (a 0600 file) so the token isn't inlined in the (often
committed) MCP config.
Web2 is never here
There is no HTTP/warden_fetch tool. Authenticated Web2 calls always go through the
gateway proxy: the agent makes a normal request with a placeholder credential
and Warden injects the real one at the edge. So Web2 = proxy, Web3 = warden sign — both scoped by one
warrant token.