Safety, routing & observability

ModelWarden features

Review AI tool calls before they reach your agent. Route model requests, apply your policies, and investigate decisions from the proxy's local dashboard.

Set up ModelWarden Compare plans

A policy layer, not an OS sandbox. Protection covers supported traffic routed through ModelWarden. It cannot undo an action that already ran. Enforcement depends on your configuration; audit-only mode records decisions without ordinary blocking.

01Review

Inspect supported tool calls with rules and an optional contextual judge.

02Route

Connect your providers and configure how model requests are forwarded.

03Investigate

Follow decisions through local audit evidence and entitled tracing tools.

04Operate

Manage the proxy from its local dashboard, separate from this customer portal.

Free, Professional and Enterprise are license tiers. Professional annual and lifetime share the feature set; ownership and update rights differ. Bring your own model and judge providers unless an Enterprise contract explicitly includes managed services. Availability also depends on the installed release and enabled configuration.

Core protection

Safety & control

Stop dangerous actions without turning routine development into a wall of prompts.

01 All tiers

Heuristic Rule Engine

Checks tool calls for known destructive-command and credential-exfiltration patterns. Matching rules can block or flag calls according to the configured enforcement mode.

02 All tiers

Command Normalizer

Reveals encoded commands, invisible characters, homoglyphs, and common shell obfuscation before policy evaluation.

03 All tiers

LLM Judge

Adds contextual risk review for ambiguous tool calls. Bring your own judge on Free, Professional, and Enterprise BYOK.

04 Professional & Enterprise

Self-Consistency Check

Repeats high-risk evaluations and flags inconsistent judge results before arbitration.

Explore all safety & control features

Arbitration Engine

All tiers

Every tool call gets one of three answers: allow, ask, or deny. On Professional and Enterprise, an ask waits for your approval in the dashboard.

Tool Definition Inspector

All tiers

Scans tool descriptions and schemas for instructions designed to manipulate the agent.

Per-Tool Stream Buffering

All tiers

Streams assistant text immediately while holding tool calls until the safety pipeline returns a verdict.

Circuit Breaker

All tiers

Blocks repeated identical tool-and-argument calls within a session when the configured limit is reached. This loop-prevention block also applies in audit-only mode.

Tool Chain Detection

All tiers

Matches configured multi-call patterns against a bounded session history, including sequences whose individual calls may appear harmless.

Kill Switch

All tiers

Activate deny-all through configuration, a sentinel file, or the local dashboard. Unix builds also support SIGUSR1 to activate the signal source and SIGUSR2 to clear that source.

Danger Tiers & Graduated Enforcement

Professional & Enterprise

Apply different review and enforcement levels to low-, medium-, and high-risk operations.

Request DLP Scanning

All tiers

Scans supported outgoing request text for credential and prompt-injection patterns. Category actions and scan limits are configurable; metadata exclusions and truncated scans mean this is not complete data-loss prevention.

DLP Redaction & Tool-Result Scanning

Professional & Enterprise

Rewrites matched secrets in forwarded request bodies and extends scanning into tool results.

Human Approval Flow

Professional & Enterprise

Holds borderline tool calls behind a one-time approval URL and a dashboard decision queue rather than silently allowing or denying them.

Claude Code Hook Gateway

All tiers

A Claude Code plugin sends each tool call to the local proxy before it runs and returns the verdict as Claude Code's own permission result. Claude Code keeps its own sign-in, and its model traffic is never routed through the proxy; only the hook payloads reach ModelWarden.

Smart Judge Learning & Allocations

All tiers

Allocations apply a saved allow, ask, or deny decision to matching tool calls and are managed by hand on every tier. Professional and Enterprise can also learn them automatically from real Judge decisions.

Judge Context & Read-Only Tools

All tiers

Gives the judge workspace, git, and redacted environment context, and lets it read files and list directories through the local read-only wrapper, with blocked path prefixes and a capped number of tool turns.

Operational visibility

Observability & incident response

See what agents attempted, why ModelWarden decided, and what changed around an incident.

01 All tiers

Local Operations Dashboard

Inspect live audit events, provider health, configuration, licenses, and system status from the proxy.

02 All tiers

Error Monitoring & Log Search

Search proxy errors and operational logs without shipping local agent traffic to a third party.

03 Professional & Enterprise

Distributed Tracing

Inspect proxy-side traces and safety-stage timing in the local dashboard. This is not a complete trace of execution inside an upstream model provider or your agent's tools.

04 Professional & Enterprise

Session Replay

Inspect bounded, redacted records of proxy requests, tool-call decisions, response capture and timing. Replay is not a recording of your screen or proof that a tool executed successfully.

Explore all observability & incident response features

Advanced Observability & Cost

Professional & Enterprise

Adds detailed latency, token, provider, and cost views for operational analysis.

Alerting & Notifications

All tiers

Send threshold alerts through baseline email/webhooks or connect team channels on Professional and Enterprise.

Automatic Anomaly Detection

Enterprise

Models normal proxy behavior and identifies unusual activity without requiring a hand-written threshold for every signal.

Release Health

Enterprise

Customer view not yet available. Enterprise release telemetry exists, but the owner-scoped customer view for adoption and regressions still needs portal support.

Audit Replay

Professional & Enterprise

Re-judges previously allowed tool calls after the fact and reports disagreement rates for policy tuning.

Advanced Debug Tool

Professional & Enterprise

Paste a tool call and step it through the heuristic and judge pipeline in the local dashboard, with the verdict, final action, risk score, and judge diagnostics.

Model routing

Providers & routing

Keep the safety layer stable while models, vendors, and endpoints change underneath it.

01 All tiers

Multi-Provider Protocol Support

Understands OpenAI, Anthropic, Gemini, Bedrock, Ollama, MCP, and OpenAI-compatible request and stream formats.

02 All tiers

OpenAI Responses HTTP, SSE & WebSocket

Inspect supported text and tool-call traffic on OpenAI Responses over HTTP, server-sent events, and WebSocket. This does not imply OpenAI Realtime or audio support.

03 All tiers

Provider Health Monitoring

Surfaces provider availability, failures, and latency in the local dashboard.

04 Professional & Enterprise

Priority Routing & Failover

Routes by configured priority and moves to the next provider when an upstream is unavailable. Single-provider forwarding is available on every tier.

Explore all providers & routing features

Managed Provider Credentials

Enterprise

Refreshes encrypted upstream credentials from the portal for managed Enterprise contracts.

Managed Judge Provider

Enterprise

Provides a preconfigured judge service for managed Enterprise contracts; every other profile remains BYO.

MCP stdio Gateway

All tiers

Wraps compatible MCP stdio servers with mw-proxy mcp to inspect tool calls before forwarding them. Tools used outside that gateway are not protected by it.

Resilient Provider Retry & Failover

All tiers

Retries eligible upstream failures within configured time and attempt limits, with backoff and quota cooldowns. Requests can still fail when providers remain unavailable or the retry budget is exhausted.

Image-Aware Routing

All tiers

Keeps requests that carry images away from provider bindings that cannot accept them, on every tier.

Route Model Limits & Reasoning Efforts

All tiers

Set each route's context and output limits and the reasoning efforts it offers to clients such as Codex; every provider binding translates the selected effort into the value its upstream expects.

Provider Schedules & Route Aliases

All tiers

Time-window provider schedules and route aliases already in the config run on every tier. Adding or changing them from the dashboard, the API, or a live config reload requires Professional or Enterprise.

Host Plugins

All tiers

Ready-made plugins for OpenCode, pi, ZCode, Claude Code, and Codex, downloaded from the local dashboard, set up each coding host for the proxy. The Claude Code plugin uses the hook gateway, so only tool-call hooks reach the proxy.

Configurable policy

Policy & configuration

Start with safe defaults, then make policy specific to your tools, paths, and operating model.

01 All tiers

Config Hot-Reload

Validates supported JSON configuration changes before applying them. Invalid changes retain the last valid configuration; some listener and startup settings require a restart.

02 All tiers

Config Init & TUI

Generate a starter config with --init or use the interactive terminal editor with --tui.

03 Professional & Enterprise

Policy Profiles

Switch among strict, balanced, permissive, and custom policy profiles.

04 Professional & Enterprise

Custom Judge Instructions

Add organization-specific constraints and review guidance to contextual judge requests.

Explore all policy & configuration features

Tool Allowlist & Denylist

Professional & Enterprise

Bypass known-safe tools and hard-block prohibited tools, with deny rules taking precedence.

Safe Commands & Trusted Directories

Professional & Enterprise

Reduce unnecessary reviews for approved read-only commands and explicitly trusted paths.

Path Policy Resolution

All tiers

Longest-prefix path matching resolves path-scoped policy consistently on every tier. Professional and Enterprise add per-stage exclusions, path-based policy overrides, and graduated enforcement levels.

Request & Judge Rate Limits

All tiers

Applies separate request and judge-call budgets, with higher defaults on Professional and contract-defined Enterprise limits.

Concurrent Judge Capacity

All tiers

Limits simultaneous judge-backed operations independently from general request throughput.

Operating Modes

All tiers

Run as a transparent pass-through, in audit-only mode (evaluate and record everything, block nothing except the circuit breaker), or in heuristics-only mode (no judge calls).

Evidence trail

Audit & evidence

Keep an explainable record of agent actions without pretending every log line is independently signed.

01 All tiers

Tamper-Evident Audit Chain

Turn on the audit chain and every audit record is linked to the one before it in a SHA-256 hash chain, sealed by Ed25519-signed checkpoints. If anyone edits the history later, the Audit page's integrity check flags it.

02 All tiers

Live Audit Stream

Shows tool calls, routing, policy stages, and verdicts in real time.

03 All tiers

Secret Redaction

Passwords, API keys and tokens are hidden from the logs automatically (see exactly what). You can add your own field names to hide more.

04 All tiers

TimeGuard

Checks clock movement against trusted portal-time state during license validation. Token validity and heartbeat requirements remain separate from lifetime ownership.

Explore all audit & evidence features

Persistent JSONL Audit

Professional & Enterprise

Writes redacted audit history to rotating local files for investigations and retention workflows.

Log Drains

Professional & Enterprise

Forwards operational output to file, HTTP, or syslog destinations.

Enterprise operations

Deployment & enterprise operations

Move from one workstation to managed fleets while keeping the same enforcement and evidence model.

01 All tiers

Built-in TLS & API Authentication

Protects proxy access with TLS plus Bearer or x-api-key client authentication.

02 Professional & Enterprise

Non-Loopback Network Bind

Serve trusted team clients beyond localhost when TLS or an explicit remote-HTTP override is configured.

03 Enterprise

Remote Wrapper

Lets a centralized proxy inspect context for agents running on other machines.

04 Enterprise

Contract-Authorized Offline Operation

Removes the periodic portal heartbeat dependency for entitled contracts while token validity and upstream network requirements still apply.

Explore all deployment & enterprise operations features

Uptime Monitoring

Professional & Enterprise

Checks proxy health endpoints and raises availability alerts. Professional monitors this proxy; Enterprise also monitors other instances.

Cron Monitoring

Professional & Enterprise

Detects missed or delayed background jobs and records their operational state.

Profiling

Professional & Enterprise

Capture proxy CPU profiles on supported Unix builds. The Windows profiling backend is not yet available; A license entitlement does not remove that platform limitation.

Source Code Management Integrations

Enterprise

Links operational events and configuration context to GitHub or GitLab commits.

Issue Tracking Integrations

Enterprise

Turns selected alerts into Jira or Linear issues for team follow-up.

Exact profile differences

Compare all ModelWarden profiles side by side.

Compare profiles