A gateway that auto-blocks a compromised MCP client/agent in real time

Built an open-source MCP-aware proxy: every tools/call, resources/*, prompts/* goes through policy + budget + audit, and a per-identity anomaly detector can auto-block a client whose behavior spikes — no rule written, no human in loop. Catches abrupt deviation, not low-and-slow (baseline adapts to slow ramps — documented with tests). Three policy backends (YAML/OPA/Cedar), one Go binary. Repo: https://github.com/kabirnarang39/wardline — feedback on the threat model wanted. Documentation h