What was blocked
The resource, directive, and policy mode, so you can see which rule a script, style, or request ran into.
See what your CSP blocks.
Fix it with your agent.
Browsers report Content Security Policy violations. Warden collects them, groups them into issues you can triage in the dashboard, and gives your coding agent the same context through MCP.
Start on the free plan. No card required.
Connects to your favourite coding agents
Claude Code
Codex
Cursor
GitHub Copilot
Cline
Gemini CLI
OpenCode
The details behind a blocked request.
A console error is a starting point. Warden groups related reports into issues you can triage in the dashboard or hand to your agent, with the evidence kept together.
Where it happened
Affected pages, occurrence counts, and sanitised events. Enough context to trace an issue back to the code that needs attention.
Whether it came back
Resolve an issue after fixing it. If another occurrence arrives, Warden reopens it with its history intact.
From your visitors’ browsers to a fixed policy.
Send browser reports to Warden and triage them in the dashboard. Connect your agent through MCP when you want to investigate in the tools you already use.
Add your website.
Create an endpoint, add your website’s hostnames, and copy the reporting header into your site. Start in report-only mode to collect violations without blocking resources. Reports appear in the dashboard as grouped issues within seconds.
Report-only header example
Content-Security-Policy-Report-Only:
default-src 'self';
report-uri YOUR_ENDPOINT_URL;
report-to csp
Reporting-Endpoints:
csp="YOUR_ENDPOINT_URL"Replace YOUR_ENDPOINT_URL with the URL from your endpoint’s setup panel. This example observes violations without blocking resources.
Connect your agent. Optional.
Add Warden’s MCP URL to your compatible agent as a remote HTTP server. Sign in, choose your organisation, and authorise the connection.
https://app.cspwarden.com/api/mcpStart an investigation.
Once reports arrive, triage them yourself or ask your agent to explore them alongside your code. Here’s a question to start with:
Review my open CSP issues. Investigate the most frequent one and explain what I should check in my code.
Start free.
Grow into Pro.
Both plans collect your reports, group them into issues, and include the dashboard and MCP access. Choose Pro for more volume, longer history, and your whole team.
Good questions.
Straight answers.
Something else on your mind?
Say hello
Can I get started for free?
Yes. Free includes 10,000 reports per month, 1 reporting endpoint, 7-day event retention, and read-only MCP access for your agents. No card is required. You can upgrade to Pro when you need more capacity or team members.
What is Content Security Policy, anyway?
Content Security Policy (CSP) is a browser security feature that lets your site specify which sources can load scripts, styles, images, and other resources. When something violates the policy, the browser can send a report. CSP Warden collects those reports and turns them into issues you can investigate in the dashboard, or through MCP with your coding agent.
Will setting this up break my website?
Start with a Content-Security-Policy-Report-Only header. It asks browsers to report violations of that policy without blocking resources. Any enforced policy you already have still applies. Use what you learn to refine your policy before enforcing it.
Do I need to install an SDK?
No. CSP reporting is built into supporting browsers. Create an endpoint, allow your website’s hostnames, and configure your HTTP response headers. Delivery and reporting support vary by browser, so reports are useful evidence rather than a complete record of every visit.
Do I need to use a coding agent?
No. The dashboard shows your reports as grouped issues with affected pages, browser share, sanitised event history, and a timeline of when each issue was opened, resolved, or reopened. MCP is an optional way to give a coding agent the same read-only view.
What happens when a fixed issue comes back?
A new occurrence after an issue was resolved automatically reopens it. Its history stays together so you can investigate the regression. You can also ignore issues that don’t need action.
What can my agents do through MCP?
On both Free and Pro, a compatible agent can read issues, sanitised events, and endpoints after you authorise access to your organisation. The MCP connection is read-only, so it cannot resolve issues or change your reporting configuration.
What happens if I reach the report limit?
Free accepts 10,000 reports and Pro accepts 5,000,000 reports per UTC calendar month. Reports beyond the allowance are dropped until the next month; they are not queued for later. You can see your usage and limits in the dashboard.
How do I upgrade to Pro?
Start on the Free plan, then upgrade to Pro in billing settings when you need higher limits or team access. Your paid subscription starts at checkout. You can manage or cancel it in billing settings. Monthly and yearly billing include the same features and report allowance.