Blog · Why Mandu
Your agent can use a secret without the AI reading it.
A sandbox controls what your agent can do. Mandu also controls who gets the secrets it knows. Your AI works with placeholders; the programs and hosts you allow receive the real values.
One key, two readers
Your agent needs your Stripe key to call Stripe, but the AI that plans its next step never needs to read the key. Mandu stands around the AI: the key is masked on its way in, the AI writes the placeholder into its command, and Mandu puts the real key back on the way out, only for a host its rule lists.
<MDU:masked>, never the key. Mandu puts the real key back only on the way out, and only where it belongs, like api.stripe.com.This example uses a No AI rule with api.stripe.com as a listed host. It covers secrets Mandu knows about; it does not stop prompt injection.
Four other approaches, and Mandu
The products that keep secrets away from an AI agent today fall into four families. Each acts in one place: around the agent's commands, on the network path, on the path to the AI, or inside the agent. Mandu acts in three of those places at once (the path to the AI, around the tools and on the network path), under one set of rules. Pick an approach to see what it does and its catch.
Fence the agent
Acts around the agent's commands
What it does. Box in the agent's commands and ask before risky steps.
The catch. Whatever the agent reads still goes to the AI.
- NoKept from the AIfile reads reach the AI
- PartlyKept off the networkallowlist, or ask
- YesStill usablenothing is masked
Also in this family: Docker Sandboxes (one microVM per agent), and cloud sandboxes such as E2B.
Swap the credential
Acts on the network path
What it does. Give the agent a stand-in key; the real one is added on the way out.
The catch. Only keys, mostly over HTTP; files and output the agent reads still reach the AI.
- PartlyKept from the AIkeys yes, file reads no
- PartlyKept off the networkreal key to its host only
- PartlyStill usableHTTP APIs work
Also in this family: 1Password's agentic autofill, which fills a browser login without the agent or its model seeing the password.
Filter the content
Acts on the path to the AI
What it does. Spot sensitive content on its way to the AI, and block or redact it.
The catch. Blocked data can't be used, detectors miss things, and the agent's own traffic goes unchecked.
- PartlyKept from the AIwhat is labelled or detected
- NoKept off the networkagent traffic unchecked
- PartlyStill usableblocked means unusable
Also in this family: Skyflow's LLM privacy vault (tokens it can turn back into values), and the AI data-loss features of network security suites such as Netskope, Zscaler and Palo Alto Prisma.
Rebuild the agent or move the model
Acts inside the agent, or in place of the AI provider
What it does. Split the agent so the planner is kept from the data, or run the model yourself.
The catch. Means a new agent or a weaker model, and leaves most of the network side open.
- PartlyKept from the AIyes with a local model
- PartlyKept off the networkonly label checks
- PartlyStill usablenew agent or weaker model
Mandu: all three places, one set of rules
Acts on the path to the AI, around the tools and on the network path
What it does. The AI sees your secrets masked; the programs you name and the hosts a rule lists get the real value.
The catch. Covers the secrets it knows about, Linux first; database logins need a workaround.
- YesKept from the AIplaceholders only
- YesKept off the networkreal value to its host only
- PartlyStill usablessh, HTTPS tools, named programs
- the real secret, where it should not be
- the real secret, sent where it belongs
- masked: a placeholder in its place
- stopped
- a protection
Every product, side by side
| Product | Covers | Blind spot | Kept from the AI | Kept off the network | Still usable |
|---|---|---|---|---|---|
| Fence the agent | |||||
| Claude Code: sandbox and auto mode | Bash and its children; a classifier on risky actions | the Read tool, and so the AI, sees every file | No | Partly | Yes |
| Codex: sandbox and auto-review | commands, offline by default; asks you for more | commands may read any file; output reaches the AI | No | Partly | Partly |
| Swap the credential | |||||
| Claude Code: credential mask | sandboxed Bash; HTTP hosts you list | the Read tool shows the real file | Partly | Partly | Partly |
| NVIDIA OpenShell | the whole agent in a box; keys added for allowed endpoints | files the box may read; what goes to an allowed host | Partly | Partly | Partly |
| nono | the whole agent; home-directory credentials denied; phantom tokens | a project's .env, the environment, command output | Partly | Partly | Partly |
| Filter the content | |||||
| Microsoft Purview | Microsoft 365 Copilot, Microsoft-built agents, browsers on managed devices | blocks rather than masks; not a coding agent's shell or MCP | Yes | Partly | No |
| AI gateways and LLM DLPLiteLLM + Presidio, Portkey, Nightfall, Prompt Security, Lakera, AWS Bedrock Guardrails, Skyflow, PrivAiTe | the prompt on its way to the AI | secrets in formats the detector does not know; the tools' own traffic | Partly | No | Yes |
| Rebuild the agent or move the model | |||||
| Information-flow control: dual LLM, CaMeL, FIDES | a planner kept from the data, or tracked when it looks; labels checked at tool calls | a new agent design; the quarantined model still reads the data | Partly | Partly | Partly |
| Local models and confidential inference | the model itself, run locally or in an attested enclave | weaker models; what tools send out | Yes | No | Partly |
| Mandu: all three places, one set of rules | |||||
| Mandu | the path to the AI, the tools and the network, for the secrets it knows | unregistered secrets; database logins; prompt injection itself | Yes | Yes | Partly |
From each product's public documentation, read 2026-10-11. Each verdict is about the documented default or a documented opt-in.
Mandu is open source. To try it, follow Get started, or read how it works on the homepage.