Skip to content

Vectimus Warden

Vectimus Warden is the containment layer for AI agents, from Claude Code sessions to autonomous fleets on Amazon Bedrock AgentCore.

Code Video Cerebral Valley

Core trick

Policy hook evaluates each tool call in under 10ms and escalates denied sessions to quarantine or runtime termination.

Tags

securityagents

Description

Vectimus Warden is the containment layer for AI agents, from Claude Code sessions to autonomous fleets on Amazon Bedrock AgentCore. Three escalation tiers: deny the tool call under 10ms, quarantine the session, terminate the runtime. Works today across eight coding tools and agent frameworks via existing Vectimus adapters. Four model integrations handle the work the deterministic layer can't: Sonnet 4.6 pattern detection across allowed actions, Opus 4.7 fleet investigation, Opus 4.7 policy drafting with sandbox replay, and Opus 4.7 incident narrative. Built solo around full-time work, sixty-plus rescue animals at our sanctuary, and two side businesses. Architecture was thought through on Claude voice mode while mucking out stables, then implemented on Claude Code monitored from the phone between rounds. Four pivots in five days, all in commits and ADRs. Apache 2.0. Built on Vectimus.
vectimus/warden★ 20 forksPythonNOASSERTIONCreated Apr 22, 2026 · last push Jun 18, 2026

README excerpt

# Vectimus Warden

**The containment layer for AI agents.**  From Claude Code sessions to autonomous fleets on Amazon Bedrock AgentCore.

Three escalation tiers: deny the tool call (under 10ms), quarantine the session, terminate the runtime.  Works with eight coding tools and agent frameworks via existing Vectimus adapters.  Powered by four model integrations: Sonnet 4.6 pattern detection across allowed actions, Opus 4.7 autonomous fleet investigation, Opus 4.7 autonomous policy drafting with sandbox replay, and Opus 4.7 incident narrative.  AgentCore is the first platform-termination integration; Azure, Google and self-hosted runtimes are on the roadmap.

Built solo for *Built with Opus 4.7*, April 2026.

Works today with Claude Code, Cursor, GitHub Copilot, Codex, Gemini CLI, Claude Agent SDK, Google ADK, and LangGraph through existing [Vectimus](https://github.com/vectimus/vectimus) adapters.

[![Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE) [![Built with Opus 4.7](https://img.shields.io/badge/built%20with-Opus%204.7-7c3aed.svg)](https://www.anthropic.com) [![Cedar](https://img.shields.io/badge/policy-Cedar-1d4ed8.svg)](https://www.cedarpolicy.com/)

<p align="center"><img src="docs/assets/warden-demo.gif" alt="Vectimus Warden demo: live attack chain triggers Pattern Engine, auto-quarantine, AgentCore termination, autonomous Investigator and Security Engineer" width="720"></p>
<p align="center"><em>Three-minute demo: <a href="">link</a><

Team