Trust¶

A security tool must earn your trust. This page tells you what CmdWarden sends, how to check the files, and what an AI agent can do to CmdWarden itself. Each claim names the code that makes it true.

What leaves your PC¶

Nothing about you. CmdWarden has no telemetry, no account, and no server of its own.

CmdWarden uses the network only for these commands:

Command	Talks to	Why
`cw update`	`api.github.com`, `github.com`	Reads the newest release and downloads its setup zip. It checks the sha256 of the zip first.
`cw github app`	`api.github.com`	Gets a GitHub App token for one repo that ends in one hour. Only when you set it up.
`cw proxy`	The hosts you list	Puts your API key in place of `cw://NAME`, only for the hosts you name.

Everything else runs on your PC. The Session Agent listens on a named pipe for your user only, not on a network port.

Where your data lives¶

Data	Place
Secret values	Windows Credential Manager, under `CmdWarden/`. Only the Session Agent reads them, and only after the policy or you allow it.
Policy, pins, shims, audit	`%LOCALAPPDATA%\CmdWarden`
Audit rows	Names, tools, launchers, and decisions. Never a secret value. A release writes its audit row first. When the row cannot be written, nothing is released.

Check the files¶

Every CmdWarden exe and dll carries the company name CmdWarden. A signed release gives each one a valid signature. Check them:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

The files in runtime\ are the .NET runtime of Microsoft, with the signature of Microsoft.

Check a download before you run it: compare Get-FileHash <zip> with the sha256 on the release page. cw update does this check for you.

From v0.11.0, GitHub signs a build provenance record for each release file. Check that a file came from this repo and its release workflow:

gh attestation verify CmdWarden.<version>-setup.zip --repo BasantPandey/CmdWarden

From v0.12.0, each release also has two more files:

File	What it is
`CmdWarden.<version>.intoto.jsonl`	The same provenance records in one file. Add `--bundle CmdWarden.<version>.intoto.jsonl` to check with no network.
`CmdWarden.<version>.cdx.json`	The SBOM in CycloneDX format. It lists each package in the portable zip, with its version.

How the code is checked¶

Check	When
Unit tests, a test of the portable folder with no .NET, and an install test	Each PR and each push to `main`
CodeQL code scanning of the C# code and the workflows	Each PR, each push to `main`, and each week
Dependency review: a new package with a known high-severity flaw fails the PR	Each PR
A check for packages with a known flaw, direct or transitive	Each build
Dependabot updates for NuGet packages, GitHub Actions, and the docs build packages	Each week
OpenSSF Scorecard	Each push to `main`, and each week
Fuzz tests of the parsers that read agent data: HTTP requests, sign-in bodies, `.env` files, hook commands, TOTP links, and the agent reason	Each PR, and a long run each week
Each action is pinned to a commit SHA, and each workflow starts with read-only permissions	Always
Secret scanning and push protection on the repo	Always

CmdWarden is open source under the MIT license. Read the code, or build it yourself: pwsh ./scripts/Build-Portable.ps1.

What an AI agent can do to CmdWarden¶

An agent runs commands on your PC. So the fair question is: can it turn CmdWarden off?

What stops it:

Protection	What it does
The policy hook	A harness that runs a `cw` command that weakens protection gets a deny with "Ask the user". The hook also reads the command inside `cmd /c`, `powershell -Command`, `bash -c`, `Start-Process`, and `dotnet cw.dll`. This covers `cw policy set`, `enroll`, `unenroll`, `low-risk`, and `hello`; `cw unharden`; `cw uninstall`; `cw delete`; `cw agent stop`; the `uninstall` of `hook`, `leak-guard`, `mcp`, and `protect`; `cw canary remove`; and the `proxy` changes, `add` too. It also stops `cw read`, which shows a secret value to the agent.
Claude Code deny rules	`cw setup` adds `Edit` and `Write` deny rules for `~/AppData/Local/CmdWarden/**`, so the file tools of Claude Code cannot change the policy file.
Real input only	The Approval Gate accepts Approve only from real keyboard or mouse input. A program that sends keys or clicks to the card gets nothing.
Windows Hello	A secret read asks for Windows Hello after Approve (`cw policy hello`).
The launcher check	Policy follows the real process chain and the file hash or signature of the app, not a name the app gives.
Agent accounts	When an agent runs under its own Windows account, such as the Codex sandbox accounts, that account is the launcher. It may only ask the gate. It cannot save, delete, or list secrets, change grants, or edit files in your profile.

What does not stop it, and what to do:

An agent that runs as your own Windows user can write files that your user can write. A script can edit %LOCALAPPDATA%\CmdWarden\policy.json without the hook seeing a cw command. The hook and the deny rules make this hard, not impossible.
For a hard line, run the agent under its own Windows account. The Codex elevated sandbox does this. cw setup enrolls its accounts.
Watch the tray icon and cw audit. A policy change that you did not make shows up as decisions that you did not expect.

The Threat model lists each attack, its answer, and the test that checks it.

Report a problem¶

Found a way around CmdWarden? Open a private security advisory instead of a public issue. The security policy says what is in scope and when we answer.