MCP Warden — AI skill for Claude Code
Local-first credential broker for MCP.
How to install MCP Warden
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open ermoluk/mcp-warden and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What MCP Warden does
Local-first credential broker for MCP. AI coding agents (Claude Code, Cursor, Codex…) call APIs, SSH and databases through scoped presets; secrets stay in your OS keychain and never enter the agent's context.
Alternatives in AI
- Graphjin — GraphJin - An Automagical Compiler to Connect AI to Your Databases 3034 44 1 3k ★
- Maestro Companion — Quick execution for small tasks — minimal run lifecycle (start + done) with evidence recording 530 ★
- Registry Broker Skills — AI agent skills for the Universal Registry - search, chat, and register 72,000+ agents across 14+ protocols 410 ★
README
mcp-warden
A local-first credential broker for the Model Context Protocol — lets any AI coding agent (Claude Code, Cursor, Cline, Codex, Continue, Zed) take real actions without ever seeing your secrets.
The agent calls high-level tools (`proxy_http`); `mcp-warden` injects the secret server-side, executes the action, and returns only the result. Your context window stays clean. A leaked transcript leaks nothing useful.
[](https://github.com/ermoluk/mcp-warden/actions/workflows/ci.yml) [](https://crates.io/crates/mcp-warden) [](https://opensource.org/licenses/Apache-2.0)
How it works
- You store a credential once in the OS keychain via the
mcp-wardenCLI. - You define presets — named, scoped actions (e.g.
github-read,stripe-charges). - The AI agent connects to
mcp-wardenas an MCP server (stdio). - When the agent wants to act, it calls
proxy_httpwith a preset name and a path/method. mcp-wardenvalidates the request against the preset's allow-list, injects the credential, executes, and returns only the response.- Sensitive presets trigger an approval prompt (desktop notification on Linux, TUI prompt on macOS/Windows). Opt in to time-boxed approvals per preset so one OK can cover a short burst of follow-up calls without re-prompt spam.
- Every action lands in a local SQLite audit log — including a
windoweddecision for calls authorised by an active approval window.
The agent's context window contains zero secrets.
Install
cargo install mcp-warden # from crates.io
carRelated Skills
Homelabhero
Turn a fresh LXC into an AI homelab command center. One command installs Claude Code + a web UI, preloaded wit
Multi Account Tool
Switch between multiple AI CLI accounts (Claude Code, Codex, Gemini/Antigravity) from one TUI — Keychain-backe
Claude Code Blueprint
Battle-tested reference architecture for Claude Code power users. Specialized agents with model tiering, nat
Agent World
A local, vendor-agnostic voxel-world control room for coding-agent CLIs (Claude Code, Codex, Gemini, opencode,
LLM Secret Manager
The secret manager for LLM agents: create, rotate, and use secrets they can never read. OS-native keyvault (ma
Herdr Agent Usage
Credential-scoped AI quota, context, and cache in Herdr for Claude, Codex, Grok, Agy, OpenCode, Pi, omp, Devin
Related Agents
Byok Token Security Expert
BYOK (Bring-Your-Own-Key) and OAuth token security expert. Deep on cross-platform OS keychain integration (mac
Storage Crypto Auditor
Static (and, if a device is connected, dynamic-assisted) auditor for insecure local storage and weak or misuse
Hardcoded Secret Scanner
Scan a trading codebase for credentials that live in code, config committed to git, logs, tests, or documentat
