ModelWarden pricing

Checks tool calls for known destructive-command and credential-exfiltration patterns. Matching rules can block or flag calls according to the configured enforcement mode.

Reveals encoded commands, invisible characters, homoglyphs, and common shell obfuscation before policy evaluation.

Adds contextual risk review for ambiguous tool calls. Bring your own judge on Free, Professional, and Enterprise BYOK.

Repeats high-risk evaluations and flags inconsistent judge results before arbitration.

Every tool call gets one of three answers: allow, ask, or deny. On Professional and Enterprise, an ask waits for your approval in the dashboard.

Scans tool descriptions and schemas for instructions designed to manipulate the agent.

Streams assistant text immediately while holding tool calls until the safety pipeline returns a verdict.

Blocks repeated identical tool-and-argument calls within a session when the configured limit is reached. This loop-prevention block also applies in audit-only mode.

Matches configured multi-call patterns against a bounded session history, including sequences whose individual calls may appear harmless.

Activate deny-all through configuration, a sentinel file, or the local dashboard. Unix builds also support SIGUSR1 to activate the signal source and SIGUSR2 to clear that source.

Apply different review and enforcement levels to low-, medium-, and high-risk operations.

Scans supported outgoing request text for credential and prompt-injection patterns. Category actions and scan limits are configurable; metadata exclusions and truncated scans mean this is not complete data-loss prevention.

Rewrites matched secrets in forwarded request bodies and extends scanning into tool results.

Holds borderline tool calls behind a one-time approval URL and a dashboard decision queue rather than silently allowing or denying them.

A Claude Code plugin sends each tool call to the local proxy before it runs and returns the verdict as Claude Code's own permission result. Claude Code keeps its own sign-in, and its model traffic is never routed through the proxy; only the hook payloads reach ModelWarden.

Allocations apply a saved allow, ask, or deny decision to matching tool calls and are managed by hand on every tier. Professional and Enterprise can also learn them automatically from real Judge decisions.

Gives the judge workspace, git, and redacted environment context, and lets it read files and list directories through the local read-only wrapper, with blocked path prefixes and a capped number of tool turns.

Inspect live audit events, provider health, configuration, licenses, and system status from the proxy.

Search proxy errors and operational logs without shipping local agent traffic to a third party.

Inspect proxy-side traces and safety-stage timing in the local dashboard. This is not a complete trace of execution inside an upstream model provider or your agent's tools.

Inspect bounded, redacted records of proxy requests, tool-call decisions, response capture and timing. Replay is not a recording of your screen or proof that a tool executed successfully.

Adds detailed latency, token, provider, and cost views for operational analysis.

Send threshold alerts through baseline email/webhooks or connect team channels on Professional and Enterprise.

Models normal proxy behavior and identifies unusual activity without requiring a hand-written threshold for every signal.

Re-judges previously allowed tool calls after the fact and reports disagreement rates for policy tuning.

Paste a tool call and step it through the heuristic and judge pipeline in the local dashboard, with the verdict, final action, risk score, and judge diagnostics.

Understands OpenAI, Anthropic, Gemini, Bedrock, Ollama, MCP, and OpenAI-compatible request and stream formats.

Inspect supported text and tool-call traffic on OpenAI Responses over HTTP, server-sent events, and WebSocket. This does not imply OpenAI Realtime or audio support.

Surfaces provider availability, failures, and latency in the local dashboard.

Routes by configured priority and moves to the next provider when an upstream is unavailable. Single-provider forwarding is available on every tier.

Refreshes encrypted upstream credentials from the portal for managed Enterprise contracts.

Provides a preconfigured judge service for managed Enterprise contracts; every other profile remains BYO.

Wraps compatible MCP stdio servers with mw-proxy mcp to inspect tool calls before forwarding them. Tools used outside that gateway are not protected by it.

Retries eligible upstream failures within configured time and attempt limits, with backoff and quota cooldowns. Requests can still fail when providers remain unavailable or the retry budget is exhausted.

Keeps requests that carry images away from provider bindings that cannot accept them, on every tier.

Set each route's context and output limits and the reasoning efforts it offers to clients such as Codex; every provider binding translates the selected effort into the value its upstream expects.

Time-window provider schedules and route aliases already in the config run on every tier. Adding or changing them from the dashboard, the API, or a live config reload requires Professional or Enterprise.

Ready-made plugins for OpenCode, pi, ZCode, Claude Code, and Codex, downloaded from the local dashboard, set up each coding host for the proxy. The Claude Code plugin uses the hook gateway, so only tool-call hooks reach the proxy.

Validates supported JSON configuration changes before applying them. Invalid changes retain the last valid configuration; some listener and startup settings require a restart.

Generate a starter config with --init or use the interactive terminal editor with --tui.

Switch among strict, balanced, permissive, and custom policy profiles.

Add organization-specific constraints and review guidance to contextual judge requests.

Bypass known-safe tools and hard-block prohibited tools, with deny rules taking precedence.

Reduce unnecessary reviews for approved read-only commands and explicitly trusted paths.

Longest-prefix path matching resolves path-scoped policy consistently on every tier. Professional and Enterprise add per-stage exclusions, path-based policy overrides, and graduated enforcement levels.

Applies separate request and judge-call budgets, with higher defaults on Professional and contract-defined Enterprise limits.

Limits simultaneous judge-backed operations independently from general request throughput.

Run as a transparent pass-through, in audit-only mode (evaluate and record everything, block nothing except the circuit breaker), or in heuristics-only mode (no judge calls).

Turn on the audit chain and every audit record is linked to the one before it in a SHA-256 hash chain, sealed by Ed25519-signed checkpoints. If anyone edits the history later, the Audit page's integrity check flags it.

Shows tool calls, routing, policy stages, and verdicts in real time.

Passwords, API keys and tokens are hidden from the logs automatically (see exactly what). You can add your own field names to hide more.

Checks clock movement against trusted portal-time state during license validation. Token validity and heartbeat requirements remain separate from lifetime ownership.

Writes redacted audit history to rotating local files for investigations and retention workflows.

Forwards operational output to file, HTTP, or syslog destinations.

Protects proxy access with TLS plus Bearer or x-api-key client authentication.

Serve trusted team clients beyond localhost when TLS or an explicit remote-HTTP override is configured.

Lets a centralized proxy inspect context for agents running on other machines.

Removes the periodic portal heartbeat dependency for entitled contracts while token validity and upstream network requirements still apply.

Checks proxy health endpoints and raises availability alerts. Professional monitors this proxy; Enterprise also monitors other instances.

Detects missed or delayed background jobs and records their operational state.

Capture proxy CPU profiles on supported Unix builds. The Windows profiling backend is not yet available; A license entitlement does not remove that platform limitation.

Links operational events and configuration context to GitHub or GitLab commits.

Turns selected alerts into Jira or Linear issues for team follow-up.