Skip to main content

Agent Security Quick Start

Connect an AI agent to WardenAuth in three steps.

1. Register an MCP server​

curl -X POST https://api.wardenauthz.com/v1/scope/workspace-eng/mcp-server \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "serverKey": "github",
    "name": "GitHub MCP",
    "url": "https://api.githubcopilot.com/mcp/",
    "tier": "low",
    "authType": "oauth",
    "allowedTools": [
      { "name": "list_issues", "tier": "low" },
      { "name": "read_repo", "tier": "low" },
      { "name": "create_issue", "tier": "medium", "hitl": "self" },
      { "name": "merge_pr", "tier": "high", "hitl": "admin" }
    ]
  }'

Issue a bearer token for your agent:

curl -X POST https://api.wardenauthz.com/v1/mcp/consent/grant \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subjectId": "agent-1",
    "servers": [
      { "serverKey": "github", "tier": "low" }
    ],
    "expiresInSeconds": 3600
  }'
{ "token": "mcp_bearer_eJx1VU...", "grantId": "grant-abc123", "expiresAt": "..." }

3. Configure your agent​

Point your agent to https://public.wardenauthz.com/mcp and pass the bearer token. The agent sees namespaced tools: github__list_issues, github__read_repo. merge_pr is absent — the grant only allows up to low tier.

Edge cases​

  • Tokens expire. Issue short-lived grants (1-24 hours) and rotate them.
  • merge_pr requires HITL admin approval. When the agent calls it, a push notification fires. An administrator must approve.
  • New tools appear automatically. Drift detection raises an alert if the upstream server adds tools.