warden

How to use warden

Everything you need to read your agent's footprint, use the controls safely, and get the most out of it. New here? Open the live demo and follow along.

What warden is

warden is a local dashboard for everything Claude Code stores on your machine. It reads the scattered places the agent writes to and turns them into one picture you can actually read, and it lets you change a safe, reversible subset of them.

Think of it as two things in one:

  • A lens. See every connection the agent can reach, the rules and hooks that shape it, what it remembers about you, where your session history lives, and anything sensitive sitting on disk.
  • A safe set of controls. Forget a memory note, reclaim session-history disk space, tighten permissions, and disable a hook, each one reversible.

Three promises hold the whole thing together:

  • 100% local. Zero network calls. Nothing is uploaded or phoned home. The server binds to 127.0.0.1 and rejects any non-local request.
  • Read-only by default. warden changes nothing until you explicitly turn Controls on.
  • Reversible. Even with Controls on, warden never hard-deletes your live data. Changes move to a local trash you can restore.

It reads the standard Claude Code locations: ~/.claude.json, the ~/.claude/ directory, per-project memory notes, session transcripts, and telemetry.

Install and run

You need Node 18 or newer. There are no dependencies to install.

$ git clone https://github.com/AmanKumarVerma11/warden
$ cd warden
$ npm start

warden starts a local server on 127.0.0.1:4317 and opens it in your browser. That is it. To explore without pointing it at your own machine, run the demo:

$ npm start -- --demo        # synthetic data, touches nothing of yours

Options

--demo
Show a fictional machine's data. Nothing of yours is read.
--port 4400
Run on a different port if 4317 is taken.
--no-open
Start the server without auto-opening the browser.

New to it? Start with the demo, either the hosted one or --demo locally. Click through every screen with Controls on to see exactly what warden can do, safely.

The dashboard, view by view

Every screen answers one question about your agent. Here is what each one shows and why it matters.

Overview
A risk-ranked feed of what needs your attention, computed from everything below. Start here: it tells you the few things worth looking at.
Capabilities
Every MCP connection the agent can use, classified by how sensitive it is and flagged when it can write, not just read. This is where you catch "the agent can reach production."
Rules & Hooks
Your global CLAUDE.md, your permission rules (allow, ask, deny), the hooks that auto-run shell commands, and per-project trust. The instructions and automation that shape every session.
Skills & Plugins
The installed abilities the agent can invoke. Each one can change its behavior for a whole class of task.
Memory
Everything the agent has written down about you, across projects. Bad or stale notes quietly degrade its answers, and some may hold personal data.
Personas
Save your current rules and permissions as a named persona, then switch between them per client or context. Switching is reversible; connection (MCP) switching is coming.
Activity & Data
Session history and its footprint on disk. It is the largest and most sensitive store on your machine, and it is never cleaned up on its own.
Audit log
A tamper-evident, hash-chained record of every change warden makes. If any entry were altered or removed, the chain breaks and warden flags it. Local and append-only.
Privacy & Egress
Secret and PII patterns found in your files and recent transcripts, always masked, plus the telemetry sitting on disk, including events that tried to leave and are still here.
All Locations
A plain-English map of every place Claude Code stores something, so nothing is a mystery folder.

Turning on Controls

warden is read-only until you say otherwise. To make changes, turn Controls on.

Click Controls: off in the top-right of the dashboard. It flips to Controls: on, the status pill changes, and edit affordances appear across the views. Turn it back off any time; it is off again next time you open warden unless you leave it on.

The safety model

This is the part that lets you experiment without fear:

  • Your live data is never hard-deleted. "Forget" a note or "archive" transcripts and the files move into a local trash at ~/.claude/.warden-trash, recorded so they can be put back exactly.
  • The only permanent delete is emptying the trash. It never happens automatically, and you confirm it by typing before it runs.
  • Every path is checked. warden only ever touches paths inside ~/.claude, and settings edits back up the file before writing.

On the hosted demo, Controls show as Preview controls. The buttons are all there and each one tells you exactly what warden would do, but nothing is written. It is the safest way to learn the controls before running them for real.

Using each control

With Controls on, here is how to use each one. Every action is reversible from the trash unless you explicitly empty it.

Forget a memory note
In Memory, click Forget on any note. It moves to the trash; a Restore button appears so you can put it back any time.
Reclaim disk
In Activity & Data, click Archive on a project to move its transcripts to the trash. Nothing is freed yet. Click Empty trash (and confirm) to permanently delete them and reclaim the space.
Remove a permission
In Rules & Hooks, click the × on any allow, ask, or deny rule to remove it. Your settings.json is backed up first; undo it from the trash below.
Add a permission
Use the add form under Permissions: pick a list (deny is the default), type a rule like Bash(rm:*), and click Add rule.
Disable a hook
In Rules & Hooks, click Disable on any hook to stop it running automatically. Re-enable it from the trash whenever you want it back.
Save & switch personas
In Personas, name your current setup and click Save current setup. Later, Switch to any saved persona to apply its rules and permissions; your current ones are backed up first, so it undoes from the trash.
Restore or empty
Each view's trash section lets you Restore (undo) an item, or Empty the trash to permanently free the space. Emptying is the one irreversible step, and it always asks first.

Use cases

Concrete moments where warden earns its place.

Before you trust the agent with more

New machine, new setup, or just due diligence. Open the Overview and Capabilities to answer, in seconds, "what can this thing reach, and what can it write?" Tighten anything that looks too broad before you hand it a bigger task.

Auditing a connection to production

Capabilities flags every connection that can write, not just read. If an MCP can reach a production database or a payments API, you see it immediately, and you can add a deny rule or plan to scope it down.

Tightening an over-permissive setup

Permissions drift wide over time. Remove broad allow rules you no longer need, and add deny rules for destructive commands so they always require a prompt. It takes a minute and it is fully reversible.

Reclaiming gigabytes of session history

Transcripts are the biggest store on most machines and nothing cleans them up. Activity & Data shows the footprint per project. Archive the projects you are done with, then empty the trash to get the space back.

Finding a secret that leaked into a transcript

Keys and tokens end up pasted into sessions more often than anyone likes. Privacy & Egress scans your memory and recent transcripts for secret patterns and shows a masked sample so you can find and rotate it.

Knowing what runs automatically

Hooks run shell commands around the agent's actions, often set up once and forgotten. Rules & Hooks lists every one. Disable anything you do not recognize or trust.

Cleaning stale or wrong memories

The agent's notes about you shape its answers. When one is outdated or simply wrong, forget it from the Memory view so it stops steering the model.

Separating work by client or context

If you use one machine across clients, your rules and permissions blur together. Save each setup as a persona, then switch your rules and permissions in one action when you change context, reversibly. Connection switching is the next step. This is warden's headline: one agent, cleanly separated contexts.

FAQ

Does warden send my data anywhere?

No. warden makes zero network calls. It runs a server on 127.0.0.1, reads your local files, and renders them in your browser. Nothing is uploaded, tracked, or phoned home, and the server rejects any request that is not from your own machine.

Can it break my Claude Code config?

By default, no: warden is read-only and changes nothing. With Controls on, every change backs up the file first, only ever touches paths inside ~/.claude, and never hard-deletes your live data. If a change was not what you wanted, restore it from the trash.

What is the trash, and how do I undo a change?

The trash is a local folder, ~/.claude/.warden-trash, where warden puts anything you forget, archive, or edit, so it can be put back. Each view shows a trash section with a Restore (or Re-enable) button. The only way anything is permanently deleted is if you explicitly empty the trash, and it asks you to confirm first.

Do I need to install dependencies?

No. warden is plain Node plus vanilla HTML, CSS, and JavaScript. There is no build step and no package to install, which is part of the point: there is no supply chain to trust.

Does it work offline?

Yes, entirely. warden never needs the network. If you are offline it works exactly the same.

Is the hosted demo showing my real data?

No. The hosted demo runs on synthetic data for a fictional machine, entirely in your browser. warden only ever reads your real machine when you run it locally, and even then only to display it to you.

Which versions of Claude Code does it support?

warden reads the standard Claude Code storage locations. The config format changes over time, so expect the occasional gap; the scanner is defensive and degrades gracefully when something is missing or in a new shape.

Is it free and open source?

Yes. warden is MIT licensed and runs locally for free. The source is on GitHub, and it is small on purpose so you can read it.

What can it not do yet?

Today warden gives you full visibility plus reversible controls: forget memory, reclaim disk, edit permission rules, disable hooks, edit your CLAUDE.md, save and switch personas (rules and permissions), and a tamper-evident audit log of every change. Switching a persona's connections (MCPs), and syncing personas across a team, are next. It is early and honest about it.