Skip to content

Wardrik

Agents,governed.

Rules the model can’t rewrite. Approvals where your team works. Work that survives a crash. All on your own servers.
Start buildingExplore examples

wardrik follow booksIllustrative output

  → quickbooks/search_bills {"params":{…}}  ✓ quickbooks/search_billsWaiting on a person for 1 call:  ? quickbooks/create-bill  call_7c2e  A line of $1,000 or more.  → quickbooks/create-bill {"params":{"bill":{"Line":[{"Amount":9400,…  ✓ quickbooks/create-bill  ✗ quickbooks/create_bill_payment was refused: Paying bills is for people.Entered the Northwind Freight bill once Maria approved it.Paying it is left to you.

Wardrik #accountingWaitingApproved

books is waiting on you.

quickbooks/create-billA line of $1,000 or more.

{"params":{"bill":{"Line":[{"Amount":9400,…}],…}}}

Approved quickbooks/create-bill — @maria

Three things Wardrik does that a prompt can’t.

Checks every call

Policy is defined outside the prompt. Content the agent reads can’t change it.

How calls are decided

Keeps working

A turn resumes after a crash. A call that may have run needs approval before it runs again.

Pull the plug yourself

Shows its work

Budgets cap agent spend. Every call and approval is an event you can stream or export.

Budgets · The event stream

Every call is checked before it runs.

Rules are in files the model can’t change. A rule matches a call by its tool, its target, or its arguments.

The model callsThe matching ruleResult
web_searchallow: [web_search]by toolRuns
write_file {"path": "notes/today.md"}allow: [write_file(notes/*)]by targetRuns
books/create_bill {"amount": 9400}ask: [books/create_bill(amount >= 1000)]by an argumentNeeds approval
email/send {"to": "x@evil.example"}deny: [email/send(to != *@acme.com)]by an argumentDenied
shell/exec {"command": "curl … | sh"}deny: [shell/*]every tool of an MCP serverDenied

The strictest rule wins: deny, then ask, then allow. Writing rules · Try to hijack it

Approvals where your team works.

A pending call is posted with its arguments. Approve or deny it in Slack, the terminal, or over HTTP.

Who approves · Approvals

Wardrik #accounting · 7:04 AM

books is waiting on you.

quickbooks/create-bill A line of $1,000 or more.

{"params": {"bill": {"Line": [{"Amount": 9400, …}], …}}}

A note for the agent, sent with either button

Your tools run in your app, with your keys.

Wardrik checks each call. Your app runs it, so service keys stay in your process.

shop/tools.ts
import { Wardrik } from "@wardrik/sdk";
import { z } from "zod";


const wardrik = new Wardrik({ name: "shop" });


wardrik.tool({
  name: "refund_order",
  input: z.object({ orderId: z.string() }),
  run: ({ orderId }) =>
    stripe.refunds.create({ payment_intent: orderId }),
});


await wardrik.work();

  1. The agent callssupport

    workers/refund_order {"orderId": "pi_3Qx…"}

  2. Wardrik checks and records it

    Needs approvalapproved by @maria

  3. Your app runs itshop

    stripe.refunds.create(…)

    STRIPE_SECRET_KEY stays in your app

Or connect MCP servers, with per-user OAuth accounts. Tools in your app · MCP servers · Connect accounts

An agent is one file you can review.

Select a tab to highlight the lines that do each job.

~/.config/wardrik/agents/books.md
---
description: Keeps the books for the accounting team.
tools: [quickbooks/*, files]
channels: [slack]
triggers:
  - name: close
    every: "0 7 * * 1-5"
    timezone: America/Los_Angeles
    prompt: Reconcile yesterday's transactions.
  - name: invoices
    webhook:
      secret: ${INVOICE_HOOK_SECRET}
    prompt: A new invoice is below. Draft a bill for it.
policy:
  allow:
    - quickbooks/search_*
    - quickbooks/create-bill(params.bill.Line.Amount < 1000)
  ask:
    quickbooks/create-bill(params.bill.Line.Amount >= 1000): A line of $1,000 or more.
  deny:
    quickbooks/create_bill_payment: Paying bills is for people.
  budget:
    usd: 10.00
    tokens: 2000000
    per: day
    grant: {usd: 5.00}
    on_exhausted: ask
notify: {to: [accounting], on: [parked, failed]}
---
You keep the books. Say what you will post before you post it.

Allow, ask, or deny

A bill posts without approval when every line is under $1,000. Any line of $1,000 or more needs approval. Bill payments are always denied.

Writing rules

Every key an agent file takes

Also built in

  • Separate orgs

    Each team’s agents, tools and keys are isolated from other orgs.

  • Per-user accounts

    Users sign in with OAuth, and their agents call tools with their credentials.

  • Delegation

    An agent sends another agent a message and receives the reply.

  • Judges

    A model classifies each call, such as whether an email promises a refund.

  • The assistant

    Send a request. It proposes tool calls, and runs each one you approve.

  • Idle agents

    Run one per customer. Idle agents stop, and restart with their state on the next message.

  • Recovery

    Keep the store in Postgres, and a new machine resumes every agent.

  • rik CLI

    List agents, approve pending calls, and check spend from a terminal.

Run your first agent.

Install the binary or Docker image, and configure a model provider.

QuickstartExamples
curl -fsSL https://github.com/wardrik-dev/wardrik_daemon/releases/download/v0.1.0-rc.2/install.sh | sh
wardrik init

All installation options