MCP tools (Web3, optional)

Optional stdio MCP tools for signing and introspection — keys never exposed.

By default Warden uses no MCP server: the agent signs by running warden sign directly, with the warrant token read from its environment ($WARDEN_TOKEN, set by warden run). Nothing is persisted to disk.

warden mcp is an advanced, manual alternative for MCP clients that prefer a structured signing tool over the CLI (e.g. a client with no shell). warden run does not register it — you wire it into the client's config yourself. It's a Model Context Protocol server over stdio exposing the warrant's Web3 capabilities:

Tool
warden_scopeWhat this warrant grants — wallets, policy, mode, expiry. Read-only.
warden_signAuthorize + sign a transaction with a scoped wallet. Within policy it signs; over the threshold it holds for the owner's approval. Returns the signature, never the key.

Point it at the token with --token-file (a 0600 file) so the token isn't inlined in the (often committed) MCP config.

Web2 is never here

There is no HTTP/warden_fetch tool. Authenticated Web2 calls always go through the gateway proxy: the agent makes a normal request with a placeholder credential and Warden injects the real one at the edge. So Web2 = proxy, Web3 = warden sign — both scoped by one warrant token.