Run a NAMED QUERY against a database preset (PostgreSQL, MySQL, or Redis). You supply query_name (must match one declared in the preset) and params (positional). The SQL / command is FIXED at preset definition time — you cannot send arbitrary SQL. Returns rows as JSON. Approval prompt fires per the preset's policy. If the user previously approved a time-boxed window for this preset+action, the call proceeds without a new prompt and is recorded as 'windowed' in the audit log.

Reveal the raw secret value bound to a name. ALWAYS prompts for approval, regardless of preset policy. Prefer proxy_http — only use this if a child process you are about to spawn must read the secret from an environment variable (e.g. terraform apply reading AWS_SECRET_ACCESS_KEY). The returned value MUST NOT be quoted back into your reasoning trace.

List available mcp-warden presets — named, scoped actions you may invoke. Returns name, description, type (http|ssh), and approval policy (auto|prompt|deny). Read-only; never returns secret values. Use proxy_http for HTTP actions and get_secret_for_env only as a last resort when a child process must read a secret from its environment.

Make an HTTP request through a preset. The preset selects the base URL and authentication; you supply path, method, and optional body / query. Allow-listed methods and paths are validated server-side BEFORE any credential is injected. Sensitive presets trigger a desktop / TUI approval prompt; you cannot bypass approval. If the user previously approved a time-boxed window for this preset+action, the call proceeds without a new prompt and is recorded as 'windowed' in the audit log. Every call is recorded to a local audit log.

Transfer a file between the preset's SSH host and the local machine. direction must be "get" (download) or "put" (upload). The remote path must match the preset's sftp_allowed_paths prefixes; the local path must be under $HOME or /tmp. Always key-based auth, host-key verified. If the user previously approved a time-boxed window for this preset+action, the call proceeds without a new prompt and is recorded as 'windowed' in the audit log.

Run a shell command on the preset's SSH host. The command must match one of the preset's allowed_commands regexes (anchored ^...$). Returns stdout, stderr, and exit_code. Key-based auth only; host key is verified against the user's known_hosts file. Sensitive presets trigger the approval prompt. If the user previously approved a time-boxed window for this preset+action, the call proceeds without a new prompt and is recorded as 'windowed' in the audit log. Every call is recorded to the audit log.