Log inSubmit server
PatchWarden logo

PatchWarden

by jiezeng2004-design

Restricts local coding-agent work to approved workspaces, commands, files, and independently recorded evidence.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install PatchWarden

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "jiezeng2004-design-patchwarden": {
      "command": "npx",
      "args": [
        "-y",
        "patchwarden@0.6.1"
      ],
      "env": {
        "CONTROL_PLANE_API_KEY": "YOUR_VALUE_HERE",
        "PATCHWARDEN_OWNER_TOKEN": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 30 tools correctly (12d ago).

Overview

jiezeng2004-design/PatchWarden MCP server connects ChatGPT to locally installed coding agents such as Codex CLI, Claude Code, and OpenCode. It confines execution to a configured workspace, restricts verification commands, detects out-of-scope changes, and records diff, verification, audit, and lineage evidence. Use it when an AI agent should perform local development work without receiving unrestricted shell or filesystem access. Final acceptance can be bound to the current evidence through a local attestation step.

Use cases

  • Plan a change in ChatGPT and execute it through a local coding agent
  • Confine agent edits to a dedicated project workspace
  • Verify changes with approved project commands
  • Review diffs and audit evidence before accepting a task

Key features

  • Workspace-root confinement
  • Allowlisted verification commands
  • Out-of-scope change detection
  • Independent verification records
  • Diff, audit, and lineage evidence
  • Evidence-bound local attestation

Tools30

What PatchWarden lets your agent do. Expand a tool for its parameters.

Verified live~3.9k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

5/5 checks healthy over the last 78d

What it can do

From the 30 tools this server returned when we ran it.

Runs commands · 3Can delete or modify data · 1Handles credentials · 2Makes network requests · 2Read-only tools · 26
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age117 days
Maintainers1

Observed 2026-10-16 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · patchwarden@0.6.1 (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars6Stargazers on the source repository.
npm downloads604Package downloads in the last 30 days.
Last commit1d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed30Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How PatchWarden works

What jiezeng2004-design/PatchWarden MCP server does

jiezeng2004-design/PatchWarden provides a controlled execution path between a planning interface such as ChatGPT and coding agents already installed on the local machine. The local agent remains responsible for performing the development task, while PatchWarden applies workspace and command boundaries around that work.

The server is intended for tasks where a developer wants an agent to modify a specific project, run approved checks, and produce evidence that can be reviewed afterward. It is not an unrestricted remote shell, remote desktop, or replacement for Codex CLI, Claude Code, or OpenCode.

How it works

A typical workflow starts with a task and constraints from ChatGPT. PatchWarden selects an available local agent, requires work to remain under the configured workspaceRoot, and limits verification commands to an allowlist. After execution, it records the actual changed files rather than relying only on the agent's summary.

The resulting evidence can include a task ID, lineage ID, diff, verification result, out-of-scope change status, audit state, and final lineage state. Independent verification is recorded separately from task execution. A task may remain ready_for_review after an audit succeeds; local patchwarden-attest <task_id> --accept is used for evidence-bound human acceptance.

jiezeng2004-design/PatchWarden can be exposed through the project's MCP tunnel workflow for ChatGPT or through local HTTP MCP. The local HTTP mode requires an owner token for detailed health information and the /mcp endpoint. Direct editing is optional and remains subject to workspace, sensitive-path, and confirmation controls.

Setup and configuration

The documented packaged installation uses the Windows x64 installer or portable release. Running from source or npm requires Node.js 20 or newer. Git is recommended when reliable diffs are needed. At least one of Codex CLI, Claude Code, or OpenCode must be installed and logged in locally before it can be called.

Choose a dedicated project directory for workspaceRoot; the documentation advises against using a disk root, home directory, Desktop, or Downloads directory. In the desktop application, inspect the local agent and model settings, then confirm workspace, agent, and Core health before connecting an external client.

For ChatGPT access, configure a dedicated Core Tunnel with a runtime key having Tunnels Read and Use permissions. The runtime key maps to CONTROL_PLANE_API_KEY and should not be placed in ChatGPT's authentication field. If using local HTTP MCP directly, configure PATCHWARDEN_OWNER_TOKEN first.

Tools and capabilities

Documented MCP operations include health_check for service status and list_agents for discovering callable local agents. The execution workflow also supports controlled task handling, verification, diff inspection, audit evidence, lineage tracking, and acceptance-related status.

Limitations and notes

jiezeng2004-design/PatchWarden does not automatically expose every local file and should not be used to bypass existing host security controls. Verification commands that are absent from the project or fail the allowlist are rejected. Direct is not a read-only channel: when enabled, it can support constrained patching, creation, moving, and deletion, so it should remain disabled unless needed and protected by confirmation.

The project recommends testing first in a disposable repository and preserving manual confirmation for higher-risk operations. Tunnel keys, API keys, account secrets, and tunnel identifiers should not appear in prompts, screenshots, logs, or repositories. The software is licensed under MIT.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about PatchWarden

jiezeng2004-design/PatchWarden is an MCP server that connects ChatGPT with locally installed Codex CLI, Claude Code, and OpenCode agents. Its main tools include health_check and list_agents, alongside controlled task execution, verification, diff inspection, audit evidence, and lineage tracking within configured workspace and command boundaries.

Install it with the documented package command, npx -y patchwarden@0.6.1, or download the Windows x64 installer or portable release. Source or npm use requires Node.js 20 or newer, and at least one supported local coding agent must be installed and logged in.

It supports locally installed Codex CLI, Claude Code, and OpenCode as the agents named in the documentation. The agent must be detected and callable, and its CLI should be logged in and configured before PatchWarden attempts a task.

Set a dedicated workspaceRoot and use a project directory containing only the repository or files the agent may operate on. PatchWarden confines tasks to that root, detects changes outside the approved scope, and applies additional sensitive-path and confirmation controls to optional Direct editing.

Connect it through the currently supported secure MCP Tunnel or custom app flow. Create a dedicated Core Tunnel, use a runtime key with Tunnels Read and Use permissions, configure the connection under MCP and tunnels, and add PatchWarden in ChatGPT Developer mode with No Auth.

Related MCP servers

All in Coding Agents All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewPatchWarden AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/jiezeng2004-design-patchwarden?style=directory)](https://allmcps.com/mcp/jiezeng2004-design-patchwarden)
HTML Embed
<a href="https://allmcps.com/mcp/jiezeng2004-design-patchwarden"><img src="https://allmcps.com/api/badge/jiezeng2004-design-patchwarden?style=directory" alt="PatchWarden on AllMCPs" /></a>