Wardline: An Open-Source Proxy That Auto-Blocks Compromised AI Agents

AI agents are increasingly being handed credentials and access to MCP servers, databases, and internal APIs. But as the number of connected tools grows, so does the attack surface. Wardline, a new open-source project, offers a different approach to securing this access: instead of just logging and alerting, it actively blocks compromised agents by detecting anomalies in their behavior.

The core idea is simple: place Wardline as a control-plane proxy between your AI agents (and CLI/IDE tools) and every upstream they call—whether that's an MCP server, a gRPC service, or any other tool. Every request passes through Wardline, which applies identity verification, policy checks, budget limits, and a set of statistical anomaly detectors. All of this runs in a single static Go binary, with no separate database, identity provider, or sidecar required.

Real-Time Anomaly Detection

Wardline's most distinctive feature is its auto-block capability. It uses four self-baselining heuristics to establish a baseline of normal behavior for each identity:

• Rate spike – a sudden increase in request frequency.
• Novel tool – an agent suddenly calling a tool it has never used before.
• Deny-rate spike – a sudden increase in requests that are being denied by policy.
• Combined ML score – a z-score computed via Welford's algorithm, combining multiple signals without requiring any training data or external model.

When one of these signals crosses a threshold, Wardline doesn't just write a log line—it rejects the flagged identity's calls for a bounded time-to-live (TTL). This is enforcement, not just monitoring. The false-positive rate on steady traffic is asserted to be under 2% in the project's automated tests.

Policy Backends and Identity

Wardline supports three policy backends that can be switched with a single configuration key: static YAML, embedded OPA/Rego, and embedded AWS Cedar. No external processes or network hops are needed.

For identity, Wardline issues short-lived RS256 JWTs with refresh tokens and JWKS rotation. It supports OIDC and mTLS-SPIFFE bootstrap, Kubernetes-style RBAC, SCIM 2.0 provisioning, and end-to-end tenant isolation.

Budget and rate control use a two-tier system (per-identity and per-tenant), and every decision is written to a structured JSON audit trail. The wardline export-evidence command produces a checksummed, RSA-signable bundle that an auditor can use to verify compliance.

Developer Experience

Wardline is designed to be easy to try. A prebuilt binary is available for all major platforms, and a quick test can be done by pointing a proxied call at a simple HTTP server. For example, to see a proxied call 502 until you start an upstream, run:

python3 -m http.server 9000

Every request carries an X-Wardline-Identity header, and policy matches on that plus the MCP tool name. The project claims sub-microsecond decision times (around 33 ns with 10 rules, 2.4 µs with 1000 rules) and zero allocations in the hot path.

The dashboard and identity header are unauthenticated by default—the project explicitly warns about this and provides straightforward configuration to turn on JWT verification and RBAC. The proxy fails closed on policy by default, and startup logs warn about any insecure defaults still in effect.

Known Limitations

Wardline is young and evolving. The anomaly detection is designed to catch abrupt abuse, but it won't detect slow-and-steady data exfiltration. For a production deployment, the project recommends keeping explicit policy and budget limits as a hard floor.

Wardline is Apache 2.0 licensed and available on GitHub. The docs site is refreshingly blunt about what each feature does and doesn't do, making it easy to evaluate whether this fits your security posture.