Heuristics, contextual judging, arbitration, kill switch, and graduated enforcement.
Product map
Control the action. Preserve the evidence. Operate the system.
A local proxy that combines tool-call safety, provider operations, audit evidence, and incident response across five clear deployment profiles.
Live audit, logs, provider health, alerts, cost views, and operational monitors.
Tracing, session replay, tamper-evident checkpoints, and searchable evidence.
Routing, failover, remote wrappers, anomaly detection, SCM, and issue workflows.
Core protection
Safety & control
Stop dangerous actions without turning routine development into a wall of prompts.
01
Heuristic Rule Engine
Blocks known destructive commands, credential exfiltration patterns, and unsafe operations before they reach a judge.
02
Command Normalizer
Reveals encoded commands, invisible characters, homoglyphs, and common shell obfuscation before policy evaluation.
03
LLM Judge
Adds contextual risk review for ambiguous tool calls. Bring your own judge on Free, Professional, and Enterprise BYOK.
04
Self-Consistency Check
Repeats high-risk evaluations and flags inconsistent judge results before arbitration.
Explore all safety & control features
05
Arbitration Engine
Combines deterministic and contextual signals into allow, ask, or deny decisions.
06
Tool Definition Inspector
Scans tool descriptions and schemas for instructions designed to manipulate the agent.
07
Per-Tool Stream Buffering
Streams assistant text immediately while holding tool calls until the safety pipeline returns a verdict.
08
Circuit Breaker
Detects repeated calls, error cascades, and runaway sessions, then halts execution at configurable limits.
09
Tool Chain Detection
Recognizes dangerous multi-call sequences even when each individual action appears harmless.
10
Kill Switch
Activates deny-all through config, SIGUSR1, a sentinel file, or the local dashboard; SIGUSR2 clears the signal state.
11
Danger Tiers & Graduated Enforcement
Apply different review and enforcement levels to low-, medium-, and high-risk operations.
Operational visibility
Observability & incident response
See what agents attempted, why ModelWarden decided, and what changed around an incident.
01
Local Operations Dashboard
Inspect live audit events, provider health, configuration, licenses, and system status from the proxy.
02
Error Monitoring & Log Search
Search proxy errors and operational logs without shipping local agent traffic to a third party.
03
Distributed Tracing
Follow requests across routing, safety stages, providers, and downstream decisions.
04
Session Replay
Reconstruct an agent session from recorded requests, tool calls, decisions, and timing.
Explore all observability & incident response features
05
Advanced Observability & Cost
Adds detailed latency, token, provider, and cost views for operational analysis.
06
Alerting & Notifications
Send threshold alerts through baseline email/webhooks or connect team channels on Professional and Enterprise.
07
Automatic Anomaly Detection
Models normal proxy behavior and identifies unusual activity without requiring a hand-written threshold for every signal.
08
Release Health
Track version adoption, crash-free operation, and regressions across managed deployments.
Model routing
Providers & routing
Keep the safety layer stable while models, vendors, and endpoints change underneath it.
01
Multi-Provider Protocol Support
Understands OpenAI, Anthropic, Gemini, Bedrock, Ollama, MCP, and OpenAI-compatible request and stream formats.
02
OpenAI Responses HTTP/SSE
Supports custom-provider OpenAI Responses requests over HTTP and server-sent events, including tool-call inspection.
03
Provider Health Monitoring
Surfaces provider availability, failures, and latency in the local dashboard.
04
Priority Routing & Failover
Routes by configured priority and moves to the next provider when an upstream is unavailable.
Explore all providers & routing features
05
Managed Provider Credentials
Refreshes encrypted upstream credentials from the portal for managed Enterprise contracts.
06
Managed Judge Provider
Provides a preconfigured judge service for managed Enterprise contracts; every other profile remains BYO.
Configurable policy
Policy & configuration
Start with safe defaults, then make policy specific to your tools, paths, and operating model.
01
Config Hot-Reload
Validates and applies JSON configuration changes atomically without restarting the proxy.
02
Config Init & TUI
Generate a starter config with --init or use the interactive terminal editor with --tui.
03
Policy Profiles
Switch among strict, balanced, permissive, and custom policy profiles.
04
Custom Judge Instructions
Add organization-specific constraints and review guidance to contextual judge requests.
Explore all policy & configuration features
05
Tool Allowlist & Denylist
Bypass known-safe tools and hard-block prohibited tools, with deny rules taking precedence.
06
Safe Commands & Trusted Directories
Reduce unnecessary reviews for approved read-only commands and explicitly trusted paths.
07
Path Policy Resolution
Resolve path-aware stage exclusions, policy overrides, and enforcement levels consistently.
08
Request & Judge Rate Limits
Applies separate request and judge-call budgets, with higher defaults on Professional and contract-defined Enterprise limits.
09
Concurrent Judge Capacity
Limits simultaneous judge-backed operations independently from general request throughput.
Evidence trail
Audit & evidence
Keep an explainable record of agent actions without pretending every log line is independently signed.
01
Tamper-Evident Audit Chain
Hash-links audit records and adds Ed25519-signed checkpoints so retroactive changes can be detected.
02
Live Audit Stream
Shows tool calls, routing, policy stages, and verdicts in real time.
03
Secret Redaction
Masks configured keys, tokens, and credential-shaped values before audit and operational output.
04
TimeGuard
Uses signed portal time to detect suspicious clock movement during license and audit operations.
Explore all audit & evidence features
05
Persistent JSONL Audit
Writes redacted audit history to rotating local files for investigations and retention workflows.
06
Log Drains
Forwards operational output to file, HTTP, or syslog destinations.
Enterprise operations
Deployment & enterprise operations
Move from one workstation to managed fleets while keeping the same enforcement and evidence model.
01
Built-in TLS & API Authentication
Protects proxy access with TLS plus Bearer or x-api-key client authentication.
02
Non-Loopback Network Bind
Serve trusted team clients beyond localhost when TLS or an explicit remote-HTTP override is configured.
03
Remote Wrapper
Lets a centralized proxy inspect context for agents running on other machines.
04
Contract-Authorized Offline Operation
Removes the periodic portal heartbeat dependency for entitled contracts while token validity and upstream network requirements still apply.
Explore all deployment & enterprise operations features
05
Uptime Monitoring
Checks configured endpoints and raises availability alerts from the local operations surface.
06
Cron Monitoring
Detects missed or delayed background jobs and records their operational state.
07
Profiling
Captures CPU profiles for diagnosing proxy hot paths and performance regressions.
08
Source Code Management Integrations
Links operational events and configuration context to GitHub or GitLab commits.
09
Issue Tracking Integrations
Turns selected alerts into Jira or Linear issues for team follow-up.
Exact profile differences