using-mcp-warden SKILL.md skillA
using-mcp-warden from ermoluk/mcp-warden is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add ermoluk/mcp-warden/using-mcp-warden@git:20261103.0b29313Pins git:20261103.0b29313 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- ermoluk/mcp-warden
- Path
plugins/mcp-warden/skills/using-mcp-warden/SKILL.md- Versions recorded
- 4
- Latest version
- git:20261103.0b29313, committed Nov 3, 2026
- First version recorded
- Oct 25, 2026
- Size
- 11,855 bytes
- Repository stars
- 12
- License
- Apache-2.0
Use when about to make any external HTTP API call, run a deploy command, or read a credential — invokes the `mcp-warden` MCP server (a local credential broker) so secrets never touch the conversation. Fires on requests like "call the GitHub API", "deploy via SSH", "use my Stripe key", "что в моём GitHub", "проверь репозитории", "make an API call", "fetch from {service}", or any task that would otherwise need a token/key. Skip only if mcp-warden is not in the connected MCP servers list.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Using mcp-warden `mcp-warden` is a local credential broker connected as an MCP server. The user has stored their secrets (GitHub PATs, API keys, SSH keys) in their OS keychain via `mcp-warden secret add`, and defined **presets** — named, scoped actions you may invoke. You call the high-level tool (`proxy_http`); `mcp-warden` injects the credential server-side, executes, and returns only the result. **You never see the credential.** ## The rule When the user asks for anything that involves an external service: 1. **First call `list_presets`.** Don't guess preset names from memory. Don't ask the user to paste a token. Don't suggest editing `.env` files. 2. **If a relevant preset exists**, call `proxy_http` with that preset name. The preset selects base URL + auth. 3. **If no preset matches**, tell the user which preset to create — give them the exact `mcp-warden preset add` command. Do not fall back to asking for credentials. ## Discovery — always start here ``` tool: list_presets ``` Returns presets with `name`, `description`, `kind` (http/ssh), `approval` (auto/prompt/deny). If the list is empty, the user hasn't configured any preset yet — see "Setup" below. …
Read the whole file at its exact version.
How to install
mdr add ermoluk/mcp-warden/using-mcp-warden@sha256:35b159ac65fa1b29The line at the top of this page pins the label git:20261103.0b29313, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_rjw7bochlht3onal)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Oct 25, 2026 and Nov 3, 2026, about one every 3 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261103.0b29313 latest | 2026-11-03 | 0b29313 | 11,855 B | A | view · diff |
| git:20261102.4adb3fa | 2026-11-02 | 4adb3fa | 11,125 B | A | view · diff |
| git:20261027.c464e3c | 2026-10-27 | c464e3c | 10,967 B | A | view · diff |
| git:20261025.d282d62 | 2026-10-25 | d282d62 | 10,868 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (11855 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
ermoluk/mcp-warden · 12 stars · license Apache-2.0 · pushed 2026-11-03 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_rjw7bochlht3onal GET https://markdownregistry.com/api/v1/resolve?ref=ermoluk/mcp-warden/using-mcp-warden GET https://markdownregistry.com/api/v1/blob/35b159ac65fa1b2987ba7c2caa76156bc17c3146914cd9088cf0940955a8374c
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.