The run-trust layer for agent skills

The trusted skill brain for open agents.

Connect your open-source agent to one endpoint, and it gains a curated, cryptographically-signed, sandboxed set of skills — without poisoning it.

Join the waitlist Star on GitHub

py -m warden serve · pure standard library · zero dependencies · nothing leaves your box

✓ Open source ✓ 75/75 self-test ✓ CI passing ✓ Zero dependencies ✓ Verifies on a fresh clone

warden — the magic moment

~20,000places to find agent skills

0trustworthy places to run them

We don't own directory size. We own trust + curation. Directory figures (mcp.so ~20k, Glama 6k+) are cited from the project plan's sources, not independently verified.

Skills are multiplying. So are the attacks on them. Watch Warden catch one.

Real CLI output, ~15 seconds — a curated skill passes, a poisoned one is rejected, a tampered one won't run. No mock-ups.

Warden in action: a curated skill scans clean; a poisoned skill is rejected with critical findings (tool-poisoning, unsafe-exec, SSRF, capability drift); a tampered, rug-pulled skill fails hash verification.

Try the live demo → Read every line

A verified badge is not a safe skill

The one finding the whole project turns on: verification of identity is not verification of behavior. A "verified author" badge can still turn malicious on its next update.

Tool poisoning

Hidden "ignore previous instructions," covert directives, and smuggled tags that hijack the agent from inside a skill's text.

Rug-pull

Ship a benign skill, earn trust, then quietly swap in malice on a later version. Identity stays "verified" the whole time.

Secret exfiltration

Read your environment or credentials and ship them out — often in the same breath, behind an innocent-looking task.

Capability drift the keystone

A manifest that declares "no network" wrapped around a skill that actually phones home. Warden reconciles the claim against the content.

Six pillars of trust — all real in the repo

Built to the OWASP Agentic Skills Top 10. Not a silver bullet — defense in depth, so one failure is contained and visible rather than silent.

Content-addressed + signed + pinned

You connect to a hash, not a name. Ed25519-signed (real RFC 8032). Change one byte and verification fails — no rug-pull.

Intake scanning

Tool-poisoning, unsafe-exec, SSRF, secret-exfil, obfuscation, and capability drift — caught at the door.

Deny-by-default capabilities

Each skill declares exactly what it may touch. "No network" means it cannot phone home. Anything undeclared is denied.

Sandboxed execution

Skills run inside a declared profile, never the agent's process. A poisoned skill is contained.

Behavioral trust score

Per-version and time-aware — re-publishing re-evaluates. A signed skill can lose trust. Not a static badge.

Public transparency log

Append-only, hash-linked, Merkle-rooted. Every publish and yank is permanent and auditable. Nothing changes silently.

Untrusted in, trusted out — and every version on a public, auditable log.

Run it in 60 seconds

Python 3.8+ (on Windows use the py launcher). No pip install — pure standard library, zero dependencies.

1 sign & verify the curated pack

git clone https://github.com/chadcorp/warden && cd warden
py -m warden keygen       # your curator key (root of trust)
py -m warden sign-all     # scan + sign + log every skill
py -m warden verify-all   # cold-verify: hash, sig, scan, score, log

2 point any MCP agent at the node

// claude_desktop_config.json — the one config line
{
  "mcpServers": {
    "warden": {
      "command": "py",
      "args": ["-m", "warden", "serve"],
      "cwd": "/path/to/warden"
    }
  }
}

…or drive it yourself with py examples/mcp_client_smoke.py, and sanity-check the whole stack with py -m warden selftest → 75/75. Full quickstart on GitHub →

See the trust controls work live

Real output from the reference scanner and verifier — not mock-ups. Toggle the scanner between a curated and a poisoned skill, then tamper the bundle and watch the rug-pull get caught.

Intake scanner

Pinned hash = no rug-pull

skillresearch-brain/idea-scout

signed hashsha256:208b0208cd3c58a9…

re-derived nowsha256:208b0208cd3c58a9…

VERIFIED — 11/11 checks · the bytes match the signature

An honest trust gradient

Five curated skills, three packs. No vanity scores — the badge tells the truth about each one. secret-sentinel is a C on purpose.

Warden A/100 ✓research-brain/idea-scout

Find and score a net-new idea before building — evidence gates and a mandatory pre-mortem.