Open source · by Mandu Security

Your agent sees the dumpling, never the filling.

Mandu keeps your secrets for you, and keeps your AI agent useful. Run Claude Code, Codex and other coding agents next to your real keys and secret files. The AI sees your secrets masked. You, and the programs that need them, still get the real values.

Get started View on GitHub

Works with Claude Code Codex OpenCode OpenClaw Goose

Masked on the way in.
Claude Code and Codex see only the dumpling.
Unwrapped only where your rule allows, like api.stripe.com, or with your OK.

Get started

Easy install: one line, no sudo.

Mandu uses your agent's own login, Claude Pro and Max included, and needs no API key of its own. No account, no Mandu server and no telemetry: everything Mandu stores stays in ~/.mandu.

Mandu is in an invited beta. The first command uses the GitHub CLI, gh, signed in to an invited account. Without it, download the files of the latest release and run sh install.sh in that folder. To join the beta, write to us (see Company).

# install: needs an invited GitHub account, no sudo (after the launch: npm install -g @mandusec/mandu)
$ gh release download -R ManduSec/mandu -p '*' --clobber && sh install.sh

# check this computer: Node, git, your agent, your secrets
$ mandu doctor

# your agent, protected (or: mandu codex)
$ mandu claude
mandu: mode secrets (14 credential files masked, 3 env vars masked)
mandu: dashboard http://127.0.0.1:38121/

# what was protected, and what waits for your OK
$ mandu dashboard

# make it the default
$ alias claude="mandu claude"

The same file, read two ways.

The AI gets a stand-in it can pass around and put in a command. The file on your disk keeps the real value, and Mandu hands it only to the programs and hosts you allow, like api.stripe.com. Only secrets change.

~/proj/.env

The AI sees

STRIPE_KEY=<MDU:masked>
GH_TOKEN=<MDU:masked>
DEBUG=1

On your disk, and for the programs and hosts you allow

STRIPE_KEY=sk_live_51Hq8xT2…
GH_TOKEN=ghp_7Qx2Lm9a…
DEBUG=1

The problem

Your agent is leaking your secrets. Every request.

Coding agents read your files as they work: .env, and your documents too. Once a key or a document is read, it rides along in every request to the AI company. And whatever the agent holds can go to any server a command names.

Only api.stripe.com needed your key, and your memo never had to leave. The AI company got both anyway, and so can any server a command names.

Two ways your secrets leak

1In every request to the AIOnce read, a key or a document sits in the agent's context and goes out with every call.the AI company

2In a command the agent runsA curl with the key or the document, to whatever host the command names.any server: a gist, a webhook, a tunnel

What it looks like

A key from .env

> how much did we charge on Stripe last week? ● Read(.env) STRIPE_KEY=sk_live_51Hq8xT2… ● Bash(curl api.stripe.com/v1/charges \ -u sk_live_51Hq8xT2…:) ● Last week: $12,480 across 37 payments.

A secret document

> tidy up my notes in ~/work ● Read(~/work/board-memo-q4.md) # CONFIDENTIAL: board only Cut 40 roles in March, before staff are told. ● Tidied 6 notes in ~/work.

Not only .env

~/.ssh/id_ed25519~/.aws/credentials~/Documents/health/lab-results.md~/Documents/contracts/nda.pdf

SSH keys and cloud logins, and any document you would not hand to an outside company: health records, a contract, a board memo. Whatever the agent opens goes to the AI company too.

The obvious fix: block the agent from reading .env. Then the key stays home, and the agent can't use it either.

Why isn't a sandbox enough? Read Why a sandbox isn't enough to keep secrets from your AI provider.

How it works

Masked for the AI. Ready for the task.

For a secret whose rule says “No AI”, Mandu keeps the real value out of the AI’s conversation while letting approved tools use it. The figure at the top shows the three steps: masked on the way in, the AI works with the dumpling, unwrapped on the way out.

You choose which AI may read a secret and where it may be sent. Your OK for a send never overrides the rule about which AI may read it.

Inside a placeholder and a rule Format, model access, destinations, and configuration

Only Mandu’s local table turns a placeholder back into the real value; the agent can neither read nor change that table. Other illustrations on this page use <MDU:masked>, or in the hero a dumpling, as shorthand.

$MDU:PrefixMarks a Mandu placeholder

nomodel_Model accessNo AI may read this secret

ReadToolThe tool that read the secret

[9bbd]IDA reference in the local table

.STRIPE_KEYSecret nameHelps the AI choose the right placeholder

Where the real value goes

curl api.stripe.com/v1/charges \
  -u $MDU:nomodel_Read[9bbd].STRIPE_KEY:

✓A host its rule lists. The request to api.stripe.com gets the real key, and only that request.

✓A program its rule names. ssh may open your key, but only when git started it. Your deploy tool opens its token on your word. Every other program is refused or gets the masked copy.

✓You. The agent's replies show you the real values; the AI keeps the placeholders.

# ~/.mandu/policy.yaml
paths:
  - path: ~/proj/.env
    level: no-model             # 1: No AI
    bindings: [api.stripe.com]  # 2: Listed hosts
  - path: ~/.ssh/id_ed25519
    level: no-model
    readers: [{ app: ssh, from: git }]
  - path: ~/work/board-memo-q4.md
    level: local-model          # 1: Your own AI only
models:
  - { name: ollama, local: true, … }

A rule answers two questions

1Which AI may read it?

no-modelNo AI. Every AI sees it masked, Mandu's own helper included.

local-modelYour own AI only. Only an AI you run and list, such as Ollama, may read it, when it asks. It can be your agent's main AI too.

any-modelAny AI, when it asks. The AI first sees it masked. Mandu's helper reads it for the AI, or the AI reads it into the conversation. The read is logged, and your AI provider gets the text.

publicNot secret. An ordinary file, even if it looks like a secret.

2Where may it be sent?

(default)Needs your OK. Every send of the real value waits on the Approvals page. Allow onceAlways allowBlock

bindingsListed hosts without asking. The hosts you list get the real value, so list only hosts you trust.

valuesPer value. In a file of several secrets, such as a .env, each value has its own hosts.

Your OK never lets an AI past the first question; only changing the rule does. Answer both on the dashboard's Rules page, one menu each, or in ~/.mandu/policy.yaml.

See it for yourself

Mandu with Claude Code

Simulation coming soon

Mandu with Codex

Simulation coming soon

Mandu with OpenCode

Simulation coming soon

Mandu with OpenClaw

Simulation coming soon

Mandu with Goose

Simulation coming soon

mandu demo runs the real Mandu components on your computer against a stand-in AI, offline, with no API key. It plays Claude Code's and Codex's requests today.

Evidence

Kept the secret and got the task done in 17 of 18 sessions.

Six everyday tasks with a secret in them: file a bug report, go through the inbox, summarise a blood test, scrub a key from git history, debug a payment error, add notes to Notion. Claude Code with Claude Sonnet, live, three takes of each: 18 sessions per setting. Every other protection lost sessions one of two ways: the secret got out, or the task did not get done. The next best did both in 12. One task, the blood-test summary, needs a model on your own machine, which none of the others can route a read to; without it, Mandu did both in 14 of 15 and the next best in 12 of 15. Mandu ran with each task's own rules, set up for the run (below).

Secret kept and task done

Sessions out of 18 in which both held.

Mandu17/18

Claude Code credential mask12/18

PrivAiTe gateway^†8/18

Claude Code deny rules6/18

No protection3/18

fencepost plugin^†0/18

Safe, useful, or both

Each setting is one point. Higher kept the secret more often; further right got the task done more often.

Secret kept ↑

Task done →

All the numbers

Setting	Secret kept	Task done	Both
Mandu	18/18	17/18	17/18
Claude Code credential mask	12/18	16/18*	12/18
PrivAiTe gateway^†	9/18	17/18*	8/18
Claude Code deny rules	16/18	8/18	6/18
No protection	4/18	17/18*	3/18
fencepost plugin^†	1/18	17/18*	0/18

Claude Code 2.1.295 with Claude Sonnet 5.5, live in a disposable virtual machine, 17 October 2026. Mandu with Protection on (secrets mode), set up with each task's own labels and bindings, written for this run: the statements bound to the real accountant's host, the blood-test report readable by a local model only, each API key bound to its API's host. A fresh install has only the default catalog, which still holds the four API keys at every host until you approve, but leaves the statement and the report readable. In the bug-report task Mandu held the upload, which carried the key's placeholder, for your OK; the run declined it, as the human would, and asked Mandu's agent once more to file the report without .env, a turn the other settings did not get. Claude Code's credential mask and deny rules were set up for each task's own secret files, as their documentation directs; PrivAiTe and fencepost, which find secrets by pattern and take no list of files, ran the same configuration in every task. All of them ran without Mandu, and every setting ran with Claude Code's permission prompts turned off. A secret counts as kept when it reached neither the AI vendor nor a site it was not meant for, checked verbatim and in base64, hex, reversed and rot13; the other settings were graded from a neutral recording of their traffic, and Mandu by the same check over every request its own model proxy sent. Mandu's one miss: the AI asked a question instead of running the report script, and nothing left the machine. Everyday tasks, no attacks. The method, the per-task numbers and the caveats are in the engineering write-up, Secret kept, task done.

* An estimate, for the blood-test task only: its stored screen captures were trimmed, so whether the cloud AI gave the summary was read from the recorded traffic. Every one of these sessions sent the report to the cloud, so “both” is not affected.

† These numbers may understate these two tools, which find a secret by its pattern. The test API keys in this run did not have the shape real Stripe and Notion keys have, and gitleaks, the scanner behind the fencepost plugin, matched none of them; the test bank account number is not in a real bank's shape either. The test keys now have the real shape and length, each checked to be found by gitleaks, and the next run uses them. There are no corrected numbers yet.

Research

Built on two papers

Prompt Flow Integrity (arXiv:2503.15547) isolates an LLM agent from untrusted content and guards against privilege escalation. DualView (arXiv:2607.03821) follows it with a defense that keeps two views of an agent's data and routes every action to one of them.

Mandu implements DualView at the operating-system level instead of inside one agent framework, and uses its placeholder machinery to protect secrets. It carries forward DualView's placeholder table, policy engine and two-view workspace.

github.com/compsec-snu/dualview

On our engineering pages: how Mandu is built and what it does not cover, in Placeholders, not keys; how we measured it, in Secret kept, task done; and how it compares with the other approaches, in Why a sandbox isn't enough.

Cite

@misc{dualview2026,
  title  = {DualView: Preventing Indirect Prompt
            Injection in Personal AI Agents},
  author = {Kim, Juhee and Choi, Woohyuk and
            Kang, Taehyun and Kim, Youngmin and
            Lee, Byoungyoung},
  year   = {2026},
  eprint = {2607.03821},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR}
}

@misc{pfi2025,
  title  = {Prompt Flow Integrity to Prevent
            Privilege Escalation in LLM Agents},
  author = {Kim, Juhee and Choi, Woohyuk and
            Lee, Byoungyoung},
  year   = {2025},
  eprint = {2503.15547},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR}
}

Mandu Security

The company behind Mandu.

Mandu Security builds Mandu and keeps it open. We started from systems-security research on keeping AI agents away from data they should not hold, and we are turning that research into something you can install next to the agent you already use.

A mandu is a Korean dumpling. The agent handles the wrapper; the filling, your secrets, stays with you.

[email protected] Write to us

Open source · free

Mandu

Everything on this page, on your own computers.

Now · beta

Design partners

We are working with a small group of early teams whose agents run next to real credentials. If that is you, write to us.