Who is calling
A short-lived bearer credential or preshared identity header — never an anonymous connection.
01 / ENFORCE THE CALL
Every agent call is a trust decision you're not making.
Wardline is the open-source control-plane proxy that sits between your AI agents and everything they call — MCP servers, LLM providers, other agents.
It enforces who's allowed to do what, how much they can spend, and writes a structured record of every decision — before the call ever reaches your upstream server.
Get started
View source on GitHub
go install github.com/kabirnarang39/wardline/cmd/wardline@latest
wardline · localhost:8080
$ ./wardline serve --config wardline.yaml.example wardline proxy listening on :8080, policy=deny-by-default $ curl -X POST localhost:8080 \ -H "X-Wardline-Identity: agent-abc123" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"read_file"}}' identity agent-abc123 tool read_file decision allow rule matched: policy.yaml:4 audit written → audit.jsonl
02 / THE CONTRACT
Every call carries the same three things.
No exceptions, no bypass path — identity, policy, and audit are evaluated on every single request Wardline proxies, regardless of feature flags.
What they're allowed to do
Matched against an explicit allow/deny rule set — YAML, OPA/Rego, or Cedar — deny by default.
What actually happened
A structured, tamper-evident record of the decision — written before the call reaches upstream.
03 / WHAT'S INSIDE
One baseline, everything else opt-in.
The proxy + policy + audit baseline is always on. Everything else ships behind a feature flag, so new capability lands without destabilizing what's already running.
| FEATURE | WHAT IT DOES | DOCS | STATUS |
|---|---|---|---|
| Baseline | Proxy + policy + audit | baseline | always on |
| Credential issuance | Short-lived RS256 JWT bearer tokens | credentials | shipped |
| RBAC | Kubernetes-shaped Role/RoleBinding tenant isolation | rbac | shipped |
| Budget enforcement | Per-identity spend limits | budget | shipped |
| Anomaly detection | Rate-spike, novel-tool, deny-rate, ML z-score heuristics + auto-block | anomaly | shipped |
| SSO | OIDC-bootstrapped identity | credentials | shipped |
| mTLS/SPIFFE bootstrap | Identity from a verified SPIFFE ID, both inbound and as Wardline's own outbound workload identity | credentials | shipped |
| SCIM | IdP-provisioned RBAC bindings | scim | shipped |
| Approval workflow | A third policy outcome — hold a write for a human, then let one approved retry through | approval_workflow | shipped |
| Taint tracking | Marks a session as untrusted after an unverified read, gating the write that follows | taint_tracking | shipped |
| Job budget | Per-job request ceiling, independent of the per-identity budget above | job_budget | shipped |
| Cost budget | Per-job cost/token ceiling with per-tool cost weighting | job_cost_budget | shipped |
| Web dashboard | In-browser ops console — policy editor, RBAC, budgets, audit, anomalies | web_ui | shipped |
| Federation | Cross-instance anomaly correlation over signed peers | federation | shipped |
| gRPC transport | Same control plane on a gRPC listener | grpc_transport | shipped |
| Tracing & metrics | OpenTelemetry OTLP spans, and a Prometheus /metrics endpoint | otel_tracing, prometheus_metrics | shipped |
| Compliance export | Checksum-verified, optionally signed evidence bundle — on demand or on a schedule, plus automatic log retention | export-evidence | shipped |
| Policy-pack marketplace | Embedded starter policy templates | policy-pack | shipped |
| Auto-generated policy | Infer a starter policy.yaml from real observed audit traffic | infer-policy | shipped |
| HA deployment | Shared signing key, Postgres revocation, PDB | ha | shipped |
04 / PRODUCTION-READY
Built for a cluster, not a demo.
Real /healthz and /readyz endpoints, a PodDisruptionBudget, pod anti-affinity, Postgres-backed shared revocation, and a persistent signing key so credential issuance is correct across replicas — not just possible.
05 / FAQ
Questions
Anything not answered here is answered in the full docs.
01Does Wardline replace my MCP server?
No. Wardline is a reverse proxy that sits in front of it — your MCP server, LLM provider, or agent endpoint is unchanged. Point clients at Wardline instead of the upstream directly.
02What happens if the policy backend errors?
Every policy backend fails closed. An evaluation error is treated as a deny, never a silent allow — this is enforced at the usecase layer regardless of which backend (YAML, OPA, Cedar) is configured.
03Is credential issuance required?
No — it's an optional feature flag. Without it, identity is carried via a preshared X-Wardline-Identity header. With it, agents exchange a preshared secret for a short-lived signed bearer token.
04How is Wardline licensed?
Apache 2.0, fully open source. Read the license.
READY TO ENFORCE