Question 1

What is the Warden9 runtime, and what does it run for me?

Accepted Answer

The runtime is the layer your agent runs on. It sits between the agent and the systems it calls, speaks the Model Context Protocol, and ties together everything an agent needs to act safely: managed secrets, deep cloud access, a sandbox and filesystem, a knowledge base, tools, and policy. Warden9 runs that layer for you. It authenticates the caller, resolves per user tokens, applies your policy on every call, runs the action, lets a supervisor model watch the output, and writes the audit record. You point an agent at it and get governed action, with no gateway, token store, or proxy to operate.

Question 2

Do I have to run my own servers and model?

Accepted Answer

No, and that is the point. Warden9 hosts the runtime, the tools, and access to top-tier models, so there is nothing for you to deploy, scale, or patch. Point an MCP client or our IDE harness at one endpoint and the whole thing is live. Prefer to bring your own? You can. Connect your own model and keys, register self hosted MCP servers, or import tools you already have. Hosted is the default. Your own setup is the option.

Question 3

How does access work for the actions an agent takes?

Accepted Answer

Agents act for a signed in user, never a shared service account. Warden9 runs the OAuth 2.0 authorization code and PKCE flow for each connected app, stores and refreshes tokens on the server, and adds them at call time so the credentials never reach the model, the prompt, or your logs. Every call is checked where the user scopes and the agent scopes overlap. Step outside either and the call is denied before it ever reaches the system it was aimed at.

Question 4

Can I add my own policies and human approval?

Accepted Answer

Yes. Register pre and post tool-call hooks to apply policy without forking the runtime. A pre hook reads the tool name and arguments before anything runs: allow, deny, rewrite the arguments, or pause and send the call to a person for approval over Slack, email, or webhook. A post hook reads the response before it returns to the model: redact sensitive data, strip fields, or stop it leaving. On top of that, an independent supervisor model watches the output, so a model that slips past a rule and starts to wander gets caught. Hooks run on every call, and every decision lands in the audit log.

Question 5

What is in the hosted tool catalog?

Accepted Answer

The catalog includes tools for the systems your agents need to use, with schemas and descriptions designed for agent interaction. Use Warden9-hosted tools, write your own in Python or TypeScript, or bring your own MCP tools.

Question 6

Which models can I use, and am I locked in?

Accepted Answer

No model lock-in. Every plan includes access to top-tier models through one OpenAI compatible Chat Completions API: one endpoint, one key, and you switch models with a config change and no rewrite. Use the generous usage included in your plan, or bring your own keys and pay your providers directly. Tools are offered to the model but never run by it. The model only asks for a tool call, and the runtime decides whether to run it.

Question 7

Does Warden9 work with my IDE and agent framework?

Accepted Answer

Yes. Our harness plugs into the editors your team already uses, including VS Code, Cursor, OpenCode, and Claude Code, so coding agents run through Warden9 as they work. It is also framework and client agnostic because it speaks standard MCP, so it works from LangChain, LlamaIndex, CrewAI, Mastra, Pydantic AI, Google ADK, or the OpenAI Agents SDK, and from clients like Claude, Cursor, and ChatGPT. Anything that speaks MCP can connect, and nothing ties you down.

Question 8

Can I self-host or run it in my own cloud?

Accepted Answer

Yes. Hosted cloud is the fastest way to start, but the same runtime runs in your own cloud account, a dedicated VPC, on your own hardware, or fully air gapped when data residency or compliance calls for it. You choose where tokens, logs, and traffic live, and you pick the region. The API and the tool catalog stay the same across every deployment mode.

For AI security teamsControl what AI agents can do in real systems

Security controls built into execution

Credentials stay out of the model

See every connected action

Enforce policy at the runtime

Plans for controlled agent execution

Make agent activity visible and controllable.

Controls around every important action

Frequently Asked Questions

Bring agent execution under control