待翻譯：Show HN: Wardline, a Go proxy that auto-blocks compromised AI agents

AI 服務暫時不可用，以下為來源正文，待恢復後補全翻譯。

Notifications You must be signed in to change notification settings Fork 0 Star 2 BranchesTags Open more actions menu Folders and files NameName Last commit message Last commit date Latest commit History 573 Commits 573 Commits .github .github charts/wardline charts/wardline cmd/wardline cmd/wardline demo demo docs-site docs-site docs docs internal internal site site .dockerignore .dockerignore .gitignore .gitignore .golangci.yml .golangci.yml .goreleaser.yaml .goreleaser.yaml CLAUDE.md CLAUDE.md CODE_OF_CONDUCT.md CODE_OF_CONDUCT.md CONTRIBUTING.md CONTRIBUTING.md Dockerfile Dockerfile LICENSE LICENSE Makefile Makefile README.md README.md SECURITY.md SECURITY.md credentials.yaml.example credentials.yaml.example go.mod go.mod go.sum go.sum policy.cedar.example policy.cedar.example policy.rego.example policy.rego.example policy.yaml.example policy.yaml.example rbac.yaml.example rbac.yaml.example wardline.yaml.example wardline.yaml.example Repository files navigation Wardline is an open-source proxy that sits between your AI agents and everything they call (MCP servers, tools, gRPC upstreams) and enforces identity, policy, budget, and audit — with statistical anomaly detection that blocks a compromised agent in real time, no rule written for the attack and no human in the loop. One static Go binary; no database, IdP, or sidecar to start. make demo # spins up a mock MCP server + Wardline and runs the scenario above The same run in the built-in read-only dashboard — the block, the anomaly that triggered it, and the policy behind it: How it works Any caller — an AI agent, a CLI/IDE, or an app — reaches its MCP/gRPC upstreams only through Wardline, which applies identity, policy, budget, and anomaly detection in-process and writes every decision to the audit trail. Full design: Architecture. Key Features Real-time anomaly auto-block Four self-baselining heuristics (rate spike, novel tool, deny-rate spike, and a combined ml_score z-score via Welford's algorithm — no training data, no external model) that don't just alert: auto_block rejects a flagged identity's calls for a bounded TTL. Enforcement, not a log line. Three policy backends, one binary Static YAML, embedded OPA/Rego, and embedded AWS Cedar — switched by a single policy_backend config key, with no external process and no network hop. Identity & access Short-lived RS256 JWT issuance with refresh tokens and JWKS rotation, OIDC / mTLS-SPIFFE bootstrap, Kubernetes-style RBAC, SCIM 2.0 provisioning, and end-to-end tenant isolation. Budget & rate control Two-tier per-identity and per-tenant rate limits — both must clear for a call to proceed. Compliance & audit Structured JSON audit trail, wardline export-evidence (checksummed, RSA-signable bundle for an auditor), configurable retention, and wardline infer-policy to generate a starter allow-list from observed traffic. Federation & observability Cross-instance correlation over signed, pseudonymized anomaly summaries; OpenTelemetry tracing; a live web dashboard; and HA multi-replica deployment with shared state over Postgres. Getting Started # From source (always works) go build -o wardline ./cmd/wardline # Or pull the published multi-arch image (built for each tagged release) docker pull ghcr.io/kabirnarang39/wardline:latest ./wardline validate-policy --file policy.yaml.example ./wardline validate-config --config wardline.yaml.example ./wardline serve --config wardline.yaml.example Point upstream at a real MCP server (a proxied call 502s until you do — for a quick test, python3 -m http.server 9000). Every request carries an X-Wardline-Identity header; policy matches on that value plus the MCP tool name: curl -X POST http://localhost:8080 \ -H "X-Wardline-Identity: agent-abc123" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"read_file"}}' Prebuilt binaries (linux/darwin/windows · amd64/arm64) and multi-arch images ship on every v* tag via Releases and GHCR. Documentation Full docs, per-feature design notes, and honest known-limitations live on the docs site: Getting Started — install, quickstart, configuration Concepts — architecture, policy backends, identity, audit Features — every capability in depth Deployment — Docker, Helm, HA, observability Framework integrations — LangChain, LlamaIndex, OpenAI Agents SDK, CrewAI, raw MCP Full capability list Everything below is shipped and testable under internal/features/. The v0.1 baseline (proxy + policy + audit) is always on; everything else is gated by a config flag. Capability Docs Policy backends — YAML · OPA/Rego · AWS Cedar Policy backends Anomaly detection + auto-block Anomaly detection Budget enforcement (per-identity + per-tenant) Budget Credential issuance (JWT + refresh + JWKS) Credentials SSO (OIDC) / mTLS-SPIFFE bootstrap SSO · mTLS RBAC + SCIM + tenancy RBAC · SCIM Federation (cross-instance correlation) Federation Compliance evidence export + retention Compliance Auto-generated sandbox policy infer-policy Policy packs (12 embedded + -packs-dir) Policy packs gRPC transport passthrough gRPC Postgres storage + HA deployment HA Web dashboard Dashboard OpenTelemetry tracing Observability Performance Reproducible with go test -bench, not marketing numbers. BenchmarkDecider_Decide (default YAML backend, Apple Silicon): ~33 ns / 0 allocations at 10 rules, ~2.4 µs at 1000 rules. The ml_score false-positive claim is regression-guarded by TestDetector_MLScore_FalsePositiveRateOnSteadyTraffic (asserts 0% false positives on steady traffic, budget < 2%). Security The dashboard and the X-Wardline-Identity header are unauthenticated by default — pair with credential_issuance and/or rbac for real security value. Every optional capability ships off by default and fails closed. On startup Wardline logs a WARN for each insecure default still in effect, so the posture is never silent. Report vulnerabilities per SECURITY.md. Hardening Out of the box the proxy fails closed on policy, but identity and the dashboard are open. For any real deployment, turn on: features: credential_issuance: true # verify a signed bearer token instead of trusting X-Wardline-Identity rbac: true # gate the dashboard and admin actions on real permissions With credential_issuance on, the spoofable header is replaced by RS256 bearer-token verification; with rbac on, dashboard read views and mutations require an authorized identity. Anomaly detection catches abrupt abuse but not low-and-slow ramps (see its known limitations), so keep explicit policy + budget limits as the hard floor. Project status Wardline is young and moving fast. Every feature's docs page is deliberately blunt about what it does and doesn't do. Feedback, issues, and contributions are welcome — especially on the anomaly-detection approach and threat model. Contributing See CONTRIBUTING.md and CODE_OF_CONDUCT.md. Architecture and engineering conventions are documented in CLAUDE.md; the roadmap lives in the docs. License Apache 2.0. Topics Resources Readme Apache-2.0 license Code of conduct Code of conduct Contributing Contributing Security policy Security policy Activity Stars 2 stars Watchers 0 watching Forks 0 forks Report repository