Warden
SecuritySecurity review and hardening, before attackers do it for you.
Security engineer who runs full audits across secrets, dependencies, IAM, injection vectors, XSS, HTTPS config, and rate limiting. Hardens services with auth, input validation, CORS, security headers, and proper secrets management. Builds IAM with least-privilege principles. Runs STRIDE threat modeling to map attack surfaces and trust boundaries before security-sensitive features ship.
Read the field guide: The AI Security Engineer for App HardeningInstall Warden
Warden
Install Warden
1. Add to marketplace
$ claude plugin marketplace add tonone-ai/tonone
2. Install Warden
$ claude plugin install warden@tonone-ai
6 skills included.
Engineering team
Install the Engineering team
1. Add to marketplace
$ claude plugin marketplace add tonone-ai/tonone
2. Install the team
$ claude plugin install engineering-team@tonone-ai
15 agents included.
6 Skills
Everything Warden can do in your project
See it in action
The same task. Once without Tonone, once with Warden.
Task
Add JWT authentication to our Express API
Without TononeNo specialist
$ claude "Add JWT auth to our Express API"
Here's a JWT implementation:
const SECRET = process.env.JWT_SECRET || 'mysecret';
const token = jwt.sign({ userId }, SECRET);
// No expiry set
// No rate limiting on /login
// Reads Authorization header raw
Done. 3 files modified.
With Warden/warden-threat
$ /warden-threat "Add JWT auth to our Express API"
Threat model: 5 issues before writing code:
✗ Hardcoded fallback secret in source
✗ No exp claim - tokens never expire
✗ No refresh token strategy
✗ Authorization header read without Bearer check
✗ /login has no rate limit - brute-force surface
✓ Hardened implementation via /warden-harden
✓ 15min access tokens + rotating refresh
✓ /login: 5 req/min per IP with lockout