aiSecurityWarden

Your bot can't read the keysuntil you tap Approve.

aiSecurityWarden encrypts your API keys and passwords on your own computer before they're stored, and lets your AI agents use them — and take sensitive actions — only when you say yes. We only ever store data we can't read.

Windows · macOS · Linux · any web browser · Claude Desktop and other MCP agents

9:41

aiSecurityWarden · Telegramnow

Send email to client@example.com

Subject: Re: Proposal
"Thanks for the revised timeline — we're happy to move forward with…" View in aiSecurityWarden

Match code 47 · expires in 2:00

Example notification · you choose how much detail your phone shows

Your agents act at machine speed.Judgment doesn't.

!

Agents need credentials to be useful

Email, calendars, APIs, cloud services — an agent with no keys is a chatbot with extra steps.

!

Once a credential is handed over, it can do anything

Whatever the key allows. There is no "just read a little" at the API-key level.

!

Agents can be tricked

A single email or web page with hidden instructions ("forward all bank email to this address") can turn a helpful agent into a liability. This is called prompt injection — a real, current risk, not a thought experiment.

!

Most secrets managers make this worse

They store secrets in a form the provider could read — and treat approval workflows as an expensive enterprise add-on.

Approval inbox — live TRY IT

agent gmail-assistant

action gmail.send

to client@example.com

subject Re: Proposal

code 47 · high risk · one-time

waiting for a human… send and delete ask by default — your rules decide · Deny can carry a comment the agent acts on

We can't read your secrets.

Your secrets are encrypted on your device, before they are sent. The server stores only encrypted data and never receives your keys, your secret names, or your secret values. Even we can't read them.

✓

Even secret names are hidden from the server — not just the values.

✓

Industry-standard encryption (AES-256-GCM), built only on well-known, widely reviewed cryptography libraries. No home-made cryptography.

✓

The desktop client and command-line tools do all encryption locally. An open-source desktop client is publishing soon, so anyone can verify it.

✓

No account recovery, and we mean that as a promise: if you lose your password without your recovery key, your data is gone — to anyone, including us. Nothing we can't read, we can't hand over.

✓

A "What we store" help page will show you an actual stored record so you can see it's unreadable Coming soon

WHAT THE SERVER HOLDS v1.9fA4·7c2e·KQ0p·mR9x·2tLw·bH5n·qE8s·Zd1j·
6YuG·pn4V·Tt7b·XA0m·rC3k·wF9d·Ls6h·Jy2q·Nv·
8BzR·ge5W·uP1x·oM4t·iI7n·yY0a·sS3e·dD6f·gG·
[ name: unreadable ] [ value: unreadable ]

Secret name on our serversciphertext

Secret value on our serversciphertext

Your encryption keysnever sent

Approve the bot. And the action.

Your bot asks, you approve Available

Bots can be required to get a human's approval before they read secrets or take sensitive actions.

✓

Approve or deny from your phone (Telegram, ntfy or Discord push) or from the website / desktop admin app.

✓

Every request carries a short match code, so you can confirm the prompt on your phone is for the request you're expecting.

✓

See what asked. A session request shows which program started it — your agent app, or code the agent ran on its own — so a request you didn't expect stands out. New

✓

Approve once at start-up for a working session (say, 8 hours) — or require approval on every access for high-value keys.

✓

Built-in timeouts and limits stop a misbehaving bot from flooding you with requests — no approval fatigue by design. Prefer to answer whenever you get to it? Untick the time limit and the request waits for you.

Channel	What it is	Plan
Website	Approvals page with live updates	All plans
Desktop admin app	Pending approvals tab	All plans
Telegram	Push message with Approve / Deny / Deny with comment (reply to the message)	Paid (free 14-day trial)
ntfy	Push notification with Approve / Deny	Paid (free 14-day trial)
Discord	Message with Approve / Deny / Deny with comment buttons	Paid (free 14-day trial)

If a trial or paid plan ends, nothing breaks: bots keep working and approvals simply move back to the website and desktop app.

Approve the action, not just the password Available

Beyond any secrets manager we know of: aiSecurityWarden sits between your agent and the apps it uses, and requires approval for individual actions.

✓

The rules live in aiSecurityWarden, not on the bot's machine. A compromised or confused bot can't loosen its own rules.

✓

Rules can match what an action is about: "allow pull requests on repo acme/website, ask for everything else" — with path wildcards. Rule values are stored as keyed hashes, so the server can match them without reading them.

✓

Exactly what you approve is what runs. Each request carries a fingerprint of the exact action; a changed action is refused.

✓

Deny with a comment — "make it shorter, cc Dana" — and the agent is told what to change; it revises and asks again. A plain Deny stops it.

✓

The agent is told "waiting for approval" right away and can check back later — a slow human doesn't break the workflow.

✓

Outside content (emails, web pages) is marked untrusted to the agent, reducing the chance it follows hidden instructions.

✓

You choose what your phone shows, per project: the full details (recipient, subject, preview), or only the action name, with the details end-to-end encrypted and reviewed in aiSecurityWarden.

Example, with Gmail: your AI assistant is sorting your inbox. It reads, labels and archives on its own. Then it drafts a reply to a client and asks to send it. Your phone buzzes: "Send email to client@example.com — Subject: Re: Proposal — match code 47." You check the preview and tap Approve. If an email had tricked it into forwarding your inbox somewhere, you'd have tapped Deny — and nothing would have left.

Tight control over every bot.

Each bot or machine gets its own machine token, and each token can be locked down:

◱

Scoped to a project

• A token can only read the secrets in its own project
• One project per bot, app, or environment

⌘

Allowed addresses

• The token only works from network addresses you list
• Change the list anytime — no need to reissue the token

⏱

Expiry dates

• Give each token an end date
• An expired token stops working on its next request

⏻

Instant revocation

• Revoke and it stops on the very next request
• Anything it was waiting on is cancelled — a kill switch for a misbehaving agent

≡

Activity log

• Every sign-in, approval, denial and change, recorded
• Who approved what, and when

⚿

One-time setup codes

• The website shows a short code; paste it into the agent's setup
• The token is stored securely on that machine — no long tokens copied around

Four steps from keys-in-everythingto nothing-happens-without-you.

Store your secrets

Add API keys and credentials in the website or desktop app. They're encrypted on your device before upload.

Give each bot a token

Create a machine token scoped to one project, limited to your bot's network address. Paste a one-time setup code into the agent.

Set the rules

Choose what the agent may do on its own, what needs a quick approval, and what always needs you.

Approve from your phone

When the agent needs something sensitive, you get a notification with the details and a match code. Tap Approve or Deny. Everything is logged.

Ask. Blocked. You decide.

40 seconds of real product screenshots, narrated: an agent asks to reply to an email through the Gmail connector, the approval card appears — and Deny + comment means nothing is sent, no credentials are released, and the agent weaves your comment into a revised request. Then you approve, and only then does it run.

A safety layer betweenyour AI and your apps.

A connector is the bridge between your AI agent and an application such as Gmail. It gives the agent a set of tools ("search email", "send email") and runs every one of them through aiSecurityWarden's approval rules. The agent never holds the application's credentials — the connector uses them on its behalf, and only once the action is allowed or approved.

Rule	What happens	Typical use
Allow	Runs immediately, logged	Reading, searching
Time window	Approve for a time window — the first request asks you; the same kind of action is then allowed for 1 minute to 24 hours	Labeling, archiving, a big inbox clean-up
Ask every time	Each action waits for your Approve	Drafts, anything new
Deny	Never allowed	Actions you never want an agent to take

✓

Safe by default, your call after that. The suggested rules ask before every send, forward, merge or delete. Want to clear 2,000 junk emails without tapping 20 times? Give trash a 30-minute window — it's your account, and the rules box points out every line that lets a high-risk action run without asking. New

✓

Anything without a rule asks first. The safe default.

✓

Your email never touches our servers. Connectors run on your own computer and talk to the app directly. aiSecurityWarden only sees the approval request — and with encrypted summaries, not even its details. Hosted connectors can't say that.

✓

You see exactly what you're approving. The approval card shows the action and its details (for email: recipient, subject, preview). What runs is exactly what you approved — the agent can't swap in different details after you tap Approve.

✓

Same approval for every app, and every action is logged: which bot asked, what action, the risk level, who approved or denied, and when.

Built-in connectors Gmail available More coming soon

Made and maintained by aiSecurityWarden. Turn one on for a project with a switch — they don't count against your plan's custom-connector limit.

• Gmail: search, read, read threads, list labels, label, archive, mark read, draft, send, reply, forward, trash.
• Suggested rules out of the box: read freely, tidy up with a time window, approve every send and delete.
• Signs in with Google's official sign-in — no Gmail password is ever stored.
• "Connect Gmail" wizard on the website: guided Google Cloud steps, Sign in with Google in the browser, the refresh token encrypted in your browser before it's stored — the server never sees it. No terminal, and your agent machines never sign in to Google.
• Permanent deletion isn't possible through the connector (trash only).
• Attachments, with large files sent as Google Drive links shared only with the people you email Coming soon

GitHub Available

aiSecurityWarden sits in front of GitHub's official MCP server with a built-in mapping of its ~100 tools to actions with risk levels. Nothing to install on GitHub — the rules and approvals live here.

• Reading is low risk: your agent reads repos, issues and code freely.
• Creating issues and pull requests asks you first.
• Merging, pushing and deleting are high risk: the suggested rules approve them one at a time.
• Tool changes need you: if GitHub's server changes what its tools say, nothing new runs until you approve the new list — no rule can skip that.
• Works with the local GitHub MCP server or GitHub's hosted HTTP endpoint.
• Deny with a comment works here too — tell the agent what to change instead.

Custom connectors Available

For any application we don't cover yet — internal tools, a niche API, a home automation system.

• Upload once, use everywhere: belongs to your account, switched on per project.
• Preview before you store it: see the tools and their risk levels before saving.
• Automatic updates for your agents: go live now or on next restart — no reinstalling per machine.
• Safe updates: the previous version is kept as backup; if a new version fails, the old one keeps running; machines refuse rollback tricks.
• Encrypted like your secrets, and a bot can only read connectors turned on for its own project.
• We never run your connector. It runs on your machines; we store it encrypted and deliver it.

Need a connector for an app we don't support? Ask your AI to build it.

Our connector toolkit creates a ready-made starter project with instructions written for AI coding assistants. Tell your assistant what the app does and which actions it should offer; it writes the connector, marks each action's risk level, and runs our built-in checker. Pack it into a single file, upload it, and turn it on. Every action goes through the same approval rules as our built-in connectors.

STEP 1 · START One command creates a connector project with AI-ready instructions.

STEP 2 · BUILD Your AI writes it tools in Python, each action described with its risk.

STEP 3 · CHECK + PACK Checker refuses bad ones built-in checker catches mistakes; packing makes one file.

STEP 4 · UPLOAD + ON Switch it on drop the file on the Connectors page, review tools, enable per project.

✓

You don't write any approval logic. You describe the action; aiSecurityWarden handles asking, waiting, approving and logging.

✓

A testing kit is included — test without touching the real application.

✓

The AI must mark each action's risk, the checker flags suggested rules that would let a high-risk action run unasked, and the rules live in aiSecurityWarden — a careless connector can't give an agent more than your rules allow.

✓

Apps with their own official AI connector (MCP servers): the approval proxy already sits in front of them — GitHub's official MCP server ships pre-mapped (about 100 tools with risk levels), and any other MCP server works through a small mapping file Available

Built today. Labeled honestly.

▤

Secrets management Available

• Projects — one per bot, app, or environment
• Add, change, reveal (on request only), delete
• End-to-end encrypted in your browser or computer
• Rejects invisible/control characters — catches broken copy-paste before it's stored

⚿

Machine tokens Available

• One token per bot, shown once at creation
• Project scope · allowed addresses · expiry · instant revocation
• Warning badge on tokens that work from any address
• New tokens ask for approval by default — turning it off is a deliberate choice with a warning
• One-time setup codes for agent machines
• Ready-to-paste MCP settings for Claude Desktop, Claude Code and Hermes when you create a token New

✓

Human approval Available

• Website · desktop admin app · Telegram · ntfy · Discord
• Session approval or approve-every-fetch
• Deny with comment — tell the agent what to change
• Match codes · timeouts · pending limits · hourly limits (or none)
• "Started by" on session requests New
• Per-project approval channels · test-notification button

⇶

AI agent action approval Available

• Per-action rules: allow · ask · time window · deny
• Suggested rules for each connector, added with one click — they ask for every high-risk action; loosen them only if you choose
• Clear approval cards — see exactly what runs
• Works with MCP agents — tested with Claude Desktop and Hermes Agent

◨

Web app Beta

• Projects, secrets, tokens, live approvals, activity log
• All encryption happens in the browser
• No third-party scripts or trackers, no CDNs
• Two-factor sign-in with any authenticator app, plus recovery codes
• Sign out everywhere · password change · recovery key

▣

Desktop & CLI Available

• Desktop admin app for Windows, macOS and Linux — encryption entirely on your computer
• Clipboard auto-clears after 60s · auto sign-out after 15 min idle
• CLI: export secrets at start-up, or run a program with secrets injected
• Secret values never accepted on the command line — nothing in shell history

⇄

Approval proxy for any MCP server Available

• Sits in front of any MCP server — local or remote over Streamable HTTP — same rules, approvals and log, no connector code to write
• sw-mcp proxy-init drafts the mapping from the server's live tool list
• Tool-list pins: if the server changes what its tools claim, nothing runs until you approve the new list

☍

Passkeys Available · New

• Sign in with a passkey — the fingerprint signs you in and unlocks your encrypted data, still end to end
• Passkey as second factor instead of the authenticator code
• Fingerprint to approve — an unlocked device left lying around can't approve
• Off until you switch each one on under Account → Passkeys · every plan · biometrics never leave your device

⚡

Root & admin commands Coming soon

• Your agent doesn't get the root password. It asks to run one exact command — you see the command, the machine and the risk, and you tap Approve
• Rules for routine commands; shells and editable scripts refused
• Linux first (sw-sudo), then Windows (sw-elevate) · planned for every plan

✦

Getting easier Coming soon

• One-click install for Claude Desktop
• Gmail attachments and Google Drive links, shared only with the recipients
• Use from claude.ai on the web and your phone, through a connector running on your own machine
• pipx install securitywarden from PyPI, once the client is public

⛨

Teams & more Coming soon

• Organizations, roles, per-project permissions
• Choose who approves which project · two-person approval
• Activity log export (CSV / JSON) on paid plans
• Self-service data export and account deletion
• Phone-signed approvals; phone-required decryption option

M

Works with your agents Available

• Any agent that speaks MCP (Model Context Protocol)
• Tested with Claude Desktop and Hermes Agent
• Your agent sees its tools straight away, even while its session waits for your approval New
• sw-mcp doctor checks an agent's setup step by step New
• Windows, macOS and Linux
• We host it — no server to run yourself

Encrypted in your browser.Prefer local-only? Use the desktop client.

The website — convenient

Your secrets are encrypted in your browser before they're sent, and we only store data we can't read. But a web page runs code delivered by the website, so you are trusting that code.

The desktop client — local-only

The same encryption, done entirely on your computer, without relying on code served by our site. If you'd rather not rely on the website at all, use the desktop client. We'd rather tell you this than have you find out later.

Approval workflows are an enterprise add-on elsewhere.Here they're in every plan.

Every security feature is on every plan, including Free — end-to-end encryption, two-factor sign-in, passkeys, approval per session or every fetch, website and desktop approvals, action approval and rules, allowed addresses, revocation, the activity log. Plans differ by how much you store, phone notifications, history length and team features.

Free tier is permanent, not a time-limited trial The 14-day phone-approval trial starts when you first connect Telegram, ntfy or Discord — no card required Going over a limit never deletes or locks your data — you just pause on creating new items

Beta early-access pricing preview — final numbers confirmed at launch.

Questions, answered plainly.

What if my app isn't supported?

Build a custom connector, or have your AI assistant build it with our toolkit. It gets the same approval rules as built-in connectors.

Do I have to write approval code in my connector?

No. You describe each action and its risk; aiSecurityWarden does the rest.

Does aiSecurityWarden run my connector?

No. It runs on your machines. We store it encrypted and deliver it to your bots.

Can aiSecurityWarden read my secrets?

No. They're encrypted before they leave your device.

What if I forget my password?

Use your recovery key. Without it, your data can't be recovered — by anyone, including us.

What happens if my free trial of phone approvals ends?

Nothing breaks; approvals move to the website.

Which AI agents does it work with?

Any agent that supports MCP (Model Context Protocol). We test with Claude Desktop and Hermes Agent, the open-source self-hosted agent, and the command-line tools can also hand secrets to bots and scripts that don't use MCP.

Can I deny a request and tell the agent why?

Yes — deny with a comment ("make it shorter, cc Dana") and the agent is told what to change; it can revise and ask again. A plain Deny stops it. Works on the website (your comment is end-to-end encrypted), on Telegram (reply to the message) and on Discord (a form).

Does every plan really get every security feature?

Yes. Approval, end-to-end encryption, two-factor sign-in, passkeys, approve-every-fetch, action rules, allowed addresses, revocation and the activity log are on every plan, Free included. Paid plans add volume, phone push notifications, longer history, log export and team features.

Does aiSecurityWarden see my email or other app data?

No. Connectors run on your machines and talk to the app directly. We see only the approval request: the action name, and its details only if you choose plain (not encrypted) summaries for that project. Note that the AI model your agent uses does read what the agent reads — that's true of any AI connector.

Do you support two-factor sign-in?

Yes. Use any authenticator app (Microsoft Authenticator, Google Authenticator, 1Password and others), with single-use recovery codes as a backup. You can also add a passkey (fingerprint, face or Windows Hello) to sign in, and to approve requests on the website. It's optional and off until you switch it on.

Can I let an agent send or delete without asking?

Yes, if you choose to. The suggested rules ask before every high-risk action, and anything without a rule asks first. You can loosen any rule — for example a 30-minute window for trashing mail during a clean-up — and the website points out each rule that lets a high-risk action run without asking. The one thing no rule can skip: approving a changed tool list from a connected MCP server.

What if my agent can run code on its machine?

Then it can start its aiSecurityWarden tools by itself, even ones its agent app doesn't list. Every request still goes through the same approvals and rules on our side, and a session request shows which program started it, so you can deny one you didn't expect. To keep an agent strictly to its own tools, turn off its code or terminal tool, or run it as its own user.

How do I stop an AI agent from leaking or misusing my API keys?

Don't give it the keys. Store them in aiSecurityWarden and give the agent a scoped token instead: it reaches only one project's secrets, only from the machines you allow, and you can require your approval before it gets them. Revoke the token and the agent is cut off at once, without changing a single API key.

How is this different from a regular secrets manager?

A regular secrets manager hands your bot the key, and from then on the bot can do anything that key allows. aiSecurityWarden also checks what the agent does with it: for connected apps (Gmail, GitHub, or your own) each action, like sending, deleting or merging, is checked against your rules and waits for you to approve it.

Is the client open source?

Yes. The client, which does all the encryption and includes the command-line tools and the agent connector, is open source (Apache-2.0) on GitHub, so you can read exactly what leaves your machine. Install it with pipx install aisecuritywarden from PyPI.

Do I need to run my own server?

No. We host it for you.

Does it work on Windows, macOS and Linux?

Yes. The website works in any current browser, and the desktop admin app, command-line tools and agent connector run on Windows, macOS and Linux.

Talk to a person.

Questions about plans, a team or company rollout, a connector you need, privacy, a security report, or partnering and investing — send us a note and a person will answer.

Please never send secrets, passwords or tokens in this form.