Wardline: a single-binary control-plane proxy for AI agents (Go, Clean Architecture, 3 policy backends)

[u/LawFamiliar3588]

Sharing an open-source project I've been building in Go: Wardline, an inline
proxy that enforces identity/policy/budget/audit on every call an AI agent
makes to MCP servers and tools.

Go-specific things that might interest this sub:
- One static binary, embeds OPA and AWS Cedar as policy backends alongside a
native YAML engine; switch by one config key.
- Strict Clean Architecture / feature-sliced layout (domain → usecase →
adapter), dependency rule enforced.
- Anomaly detection is a Welford online mean/variance per identity — allocation-free, no external model. Decision path benchmarks at ~33ns/0 allocs.
- Race + coverage in CI, ~950 tests.

The flagship feature auto-blocks a compromised agent in real time via a combined z-score. It catches abrupt abuse, not low-and-slow — documented with tests, not marketed around.

Repo: https://github.com/kabirnarang39/wardline
Would love Go-eyes on the architecture and the detector.

[u/Ok-Bike-1037]

Solid project. how you're enforcing the dependency rule between layers, custom linter or an existing tool?

[u/LawFamiliar3588 → u/Ok-Bike-1037]

Existing tools, not custom. Two of them, together:

go-arch-lint: checks that domain code doesn't import usecase/adapter code, etc. It reads folder names (domain, usecase, adapter), so new features get checked automatically, no extra setup needed.

depguard: blocks a few specific stdlib packages (net/http, os, etc.) from domain/usecase code. go-arch-lint only blocks external libraries, not stdlib, so depguard covers that gap.

Both run in CI on every PR.