Security scan
Finds the mistakes agents make most often: hard-coded secrets, code run from untrusted input, unexpected outbound calls and secrets stored without protection. Every finding has a file and line.
Check the code your AI agents write.
Wardrail gives your coding agent a written set of rules for the project, checks every change it makes against them, and keeps a signed record of each result. It runs on your own model key, with read-only access to your repository.
- Did what was askedHonoured
- Stayed inside its briefBreachedEdited auth/session.ts, which the contract marks off limits
- Security scan1 findingsrc/auth/session.ts:42 runs code taken from a request header
- Tests for the changePresent
- Blast radius5 filesDepend on the changed code
Not ready to mergeSigned and logged
Agents write code faster than anyone can review it
Wardrail sits between your agent and your main branch, on every change, in three steps.
Agree the rules
Wardrail turns your project’s rules into a versioned contract, committed to the repository as the CLAUDE.md file your agent already reads. Off-limits folders, required tests and house conventions are written down, not assumed.
Check every change
Each change gets two checks. A deterministic security scan reports concrete problems with file and line. A separate review, outside the agent’s own session, judges whether the change did what was asked and nothing else.
Keep the record
Every verdict is signed and added to an append-only log, so anyone you share it with can confirm it came from Wardrail and has not been edited since.
What it adds to an agent working alone
| Aspect | Agent working alone | With Wardrail |
|---|---|---|
| Rules for the project | Whatever is in the prompt this session | A versioned contract, committed with the code |
| Checking its own work | The agent marks its own homework | A separate review of every change against the contract |
| Security mistakes | Caught if someone happens to notice | Reported with file and line before the change merges |
| Understanding the codebase | Reads file after file, spending tokens | Asks the code graph who calls what, and what a change will touch |
| Drift over time | Invisible until something breaks | A running history of where the repository has moved from its rules |
| Proof for someone else | Screenshots and goodwill | Signed records anyone can check |
Wardrail checks code against the rules you agree. It does not replace review by people who understand the system, or your own tests.
Ask the code, rather than read it
Before an agent can change code safely, it has to understand it. Left alone, it reads file after file, spending tokens and time before it writes a line.
Wardrail builds a graph of how your code fits together. Your agent asks who calls a function, or what depends on a file, and gets the answer from the graph.
- Shows the blast radius of every change
- Answers your agent through the MCP server
- Covers TypeScript, JavaScript, Python, PHP and Go
parseUser5 dependentsA result you can show, not just assert
Anyone can say their code is clean. Wardrail signs each verdict and adds it to a public, append-only log in which every entry is linked to the one before it. Share the link with a client or an auditor and they can check it for themselves.
- Signed with a published key
- Linked into an append-only public log
- A README badge that links to your public trust report
Verification recordSignature valid
- Repository
- acme/checkout
- Verdict
- Contract honoured
- Security scan
- No open findings
- Log entry
- 1,284, linked to entry 1,283
- Recorded
- 28 October 2026, 09:41
Everything in the box
Project contract
Your rules, versioned and compiled into the CLAUDE.md file your agent reads as it works. Change the rules once and every session picks them up.
Skill analysis
Reads the SKILL.md files in your repository and tells you what your agents are actually equipped to do, and where they are not.
Drift tracking
A verdict on every change and a running history of where the repository has moved away from its contract, with alerts when a change breaches it. On Pro.
The Warden
An assistant inside the app that explains findings in plain terms and drafts new rules from what it finds. On Pro.
Templates
A library of skills and recurring checks your agents can pull from, such as a safe database migration or a nightly security sweep. The full library is on Pro.
Four ways in
Use the hosted app, or bring Wardrail into the tools your agents already work in.
The hosted app
Connect a repository, scan it, compile your contract, run verdicts and share a public trust report.
Open the appMCP server
Gives Claude Code, Cursor, Windsurf and Claude Desktop your contract and the code graph while they write. Open source, on npm.
claude mcp add wardrail \
-e WARDRAIL_URL=https://wardrail.ghostables.io \
-e WARDRAIL_INGEST_TOKEN=your-project-token \
-- npx -y @wardrail/mcpClaude Code plugin
The MCP tools plus a checkpoint, clear and resume workflow that keeps long sessions short and grounded in checked facts.
claude plugin marketplace add https://wardrail.ghostables.io/marketplace.json
claude plugin install wardrail@wardrailPull request checks
A verdict on every pull request that runs inside your own CI, on your own key, with each result recorded to your log. In early access.
Ask for accessBuilt to know as little as possible
A tool that reviews your code should not become another thing to worry about.
Your own model key
Reviews run on your own Anthropic key. Saved in the app, it is encrypted in your browser first, so Wardrail cannot read it.
Read-only access
The GitHub connection can read the repository you choose. It never writes to your code and never runs it.
Your pipeline
Pull request checks run inside your own CI. The model call goes from your pipeline to the provider, not through Wardrail.
Plans and pricing
You always bring your own model key, so there is never an inference charge on top.
Free
£0for ever
For one developer or a small project. No card needed.
- Security scan with file and line
- Versioned project contract
- Skill analysis
- Encrypted key vault
- Code graph
- Up to 3 repositories
Pro
£4.99per month
Or £49.90 a year, two months free.
- Everything in Free
- Drift verdict on every change
- Alerts when a change breaches
- Signed, verifiable records
- The Warden assistant
- Full template library
- Unlimited repositories
- Priority support
Teams
£22.50per month
For 5 seats. 10 seats £40, 50 seats £150 a month.
- Every seat gets all of Pro
- One subscription, one invoice
- Organisation-wide health overview
- White-label options
Annual billing on Pro and Teams gives two months free. Manage or cancel your plan at any time from the billing portal.
Questions
Does Wardrail see my model key?
No. Keys you save in the app are encrypted in your browser before they are stored, and Wardrail cannot read them. In CI, the key stays in your pipeline’s secrets. Wardrail never charges you for model usage.
Does Wardrail see my code?
The hosted app reads the repository you connect, so it can scan it and build the code graph. Pull request checks in CI run inside your own pipeline instead, and the model call goes straight from there to the provider.
Can Wardrail change my code?
No. The GitHub connection is read-only. Wardrail reads the repository you choose; it never writes to it and never runs it.
What exactly does a verdict check?
Two things. A deterministic security scan finds concrete problems, such as hard-coded secrets or code run from untrusted input. A separate review then judges the change against your contract: did it do what was asked, and nothing it should not have.
How can someone else trust the result?
Each verdict is signed and added to a public, append-only log in which every entry is linked to the one before it. Anyone with the link can confirm the record came from Wardrail and has not been altered.
Do I need Ghostables to use Wardrail?
No. Wardrail is built and run by Ghostables Ltd, but it is a separate product with its own account and billing.
Put your agents on the rails
Connect a repository, compile your contract and run your first verdict. Free to start, on your own key.