AbdullahBilal

I build things I wish existed.
Cuious • Developer • Open Source
Warden / CodeAtlas / ModelCheck

[AbdullahBilal @Abdullahbilal56]

The MCP servers you `npx` every week run as plain processes with your full user permissions.

Your SSH keys. Your .env. Every host you can reach.

Nothing in the protocol stops them.

This is the problem Warden exists for. 🧵

[AbdullahBilal @Abdullahbilal56]

@harleyfoote_ Yeah, that makes sense. Logging tells us what happened, but the policy should also make the maximum possible blast radius visible before execution. I’ll add that as a separate signal: what the tool actually touched vs. what it was capable of touching.

[AbdullahBilal @Abdullahbilal56]

When an AI agent calls a tool, you should be able to answer:
What ran?
When did it run?
What did it access?
What changed?
Warden turns invisible MCP activity into something developers can inspect, understand, and trust.

[AbdullahBilal @Abdullahbilal56]

The safest place for an untrusted MCP server is not your host system.
It is an isolated environment with controlled access and clear boundaries.
Warden is built to make tool execution safer without making the developer workflow painful.

[AbdullahBilal @Abdullahbilal56]

An AI agent should not receive unlimited access just because a tool is convenient.
Warden lets you define what MCP servers can access, what they can execute, and where they are allowed to operate.
Capabilities should be granted deliberately not inherited automatically.

[AbdullahBilal @Abdullahbilal56]

MCP servers run with real access to your machine.
That means your files, secrets, network, and shell may be within reach.
Warden adds the missing security layer:
Visibility. Isolation. Least privilege.
AI tools should be useful without being trusted blindly.

[AbdullahBilal @Abdullahbilal56]

@kerbelp Thanks, that makes sense. I’ll add source links for each inferred rule and a reviewed/approved status so the agent can tell observed patterns apart from intentional project conventions.

[AbdullahBilal @Abdullahbilal56]

AI coding agents don’t need more autocomplete.
They need better context.
RepoSpine scans, parses, indexes, and organizes a codebase so agents can find the right files, symbols, dependencies, and project rules before making changes.
#AI #DevTools #OpenSourceHiggsfield

[AbdullahBilal @Abdullahbilal56]

RepoSpine is here.
CodeAtlas has officially become RepoSpine a stronger name for the code-intelligence backbone we’re building for AI coding agents.
New home: https://t.co/oPK6pw7mdJ

#OpenSource #AI #DevTools

[AbdullahBilal @Abdullahbilal56]

A small milestone for ModelCheck:
165 automated tests passing, clean registry installation verified, CLI package published to npm, and v0.2.0 released on GitHub.
The goal is simple: make model changes measurable, reviewable, and backed by evidence.

[AbdullahBilal @Abdullahbilal56]

ModelCheck CLI v0.2.0 is now published.
Included:
YAML project configuration
JSONL regression cases
Offline fixture replay
PASS/WARN/FAIL CI exits
Private local run artifacts
Migration recommendations
GitHub release:
https://t.co/fxvYFG4npN

[AbdullahBilal @Abdullahbilal56]

Shipping a new model shouldn’t mean guessing whether capability changed.
ModelCheck compares current vs candidate behavior using JSONL cases, deterministic evaluators locked suite identity, and reproducible local evidence.
Built for teams want regression signals before deployment

[AbdullahBilal @Abdullahbilal56]

ModelCheck CLI v0.2.0 is live 🚀
Evaluate model changes with:
init → baseline → lock → verify
Get deterministic PASS/WARN/FAIL results and local evidence you can inspect.
Install:
npm i -g [email protected]
https://t.co/8QoJ0D2bn5

[AbdullahBilal @Abdullahbilal56]

@DataAnalyt2539 Not implemented yet. I’d canonicalize the schema first: stable key ordering and ignore formatting/whitespace, but include descriptions. So harmless reformatting won’t trigger re-review, while any semantic or description change will.

[AbdullahBilal @Abdullahbilal56]

Security claims are easy.
So I tested Warden against 18 real MCP servers.
14 pass.
2 conditional.
2 fail.
And I published the failures too.
I’d rather show exactly where Warden works and where it doesn’t than pretend every MCP server is magically supported
https://t.co/fqI9xlh20C

[AbdullahBilal @Abdullahbilal56]

@DataAnalyt2539 Agreed. I’d hash the full tool schema, including descriptions. A description-only change should still trigger re-review, especially for privileged exceptions, because that’s exactly where prompt/instruction drift can hide.

[AbdullahBilal @Abdullahbilal56]

@DataAnalyt2539 Exactly. If the server version, tool list, requested paths, or network destinations change, Warden should invalidate the old exception and require a fresh review.

[AbdullahBilal @Abdullahbilal56]

@DataAnalyt2539 Yes that’s the direction. Exceptions should be visible per server, with exactly what was loosened and why, so users never lose track of the sandbox boundary.

[AbdullahBilal @Abdullahbilal56]

@DataAnalyt2539 Per-server exceptions, but explicit and auditable. The goal is to let users loosen only what that server needs without weakening Warden globally.

[AbdullahBilal @Abdullahbilal56]

One thing I don’t want Warden to become:

A security tool that looks strict on paper but quietly asks users to allow everything when something breaks.

If a server needs dangerous access, Warden should say that clearly.

Not hide it.

[AbdullahBilal @Abdullahbilal56]

The biggest lesson from testing Warden on real MCP servers:

Security and compatibility fight each other fast.

The easy answer is “allow more.”

The harder answer is keeping deny-by-default while still making real tools usable.

That’s the problem I’m focused on.

[AbdullahBilal @Abdullahbilal56]

@DataAnalyt2539 A mix of both. That’s exactly the kind of edge Warden is built around: keep deny-by-default intact, expose the limitation clearly, and improve compatibility without weakening the sandbox.