Open source · by Mandu Security

Your agent sees the dumpling, never the filling.

Mandu keeps your secrets for you, and keeps your AI agent useful. Run Claude Code, Codex and other coding agents next to your real keys and secret files. The AI sees your secrets masked. You, and the programs that need them, still get the real values.

Get started View on GitHub

Works with Claude Code Codex OpenCode OpenClaw Goose

Masked on the way in.
Claude Code and Codex see only the dumpling.
Unwrapped only where your rule allows, like api.stripe.com, or with your OK.

Get started

Easy install: one line.

Mandu uses your agent's own login, Claude Pro and Max included, and needs no API key of its own. No account, no Mandu server and no telemetry: everything Mandu stores stays in ~/.mandu.

Mandu is in an invited beta. It installs with npm and needs Node 22.13 or newer. To join the beta, write to us (see Company).

# install: needs Node 22.13 or newer
$ npm install -g @mandusec/mandu

# check this computer: Node, git, your agent, your secrets
$ mandu doctor

# your agent, protected (or: mandu codex)
$ mandu claude
mandu: mode secrets (14 credential files masked, 3 env vars masked)
mandu: dashboard http://127.0.0.1:38121/

# what was protected, and what waits for your OK
$ mandu dashboard

# make it the default
$ alias claude="mandu claude"

The same file, read two ways.

The AI gets a stand-in it can pass around and put in a command. The file on your disk keeps the real value, and Mandu hands it only to the programs and hosts you allow, like api.stripe.com. Only secrets change.

~/proj/.env

The AI sees

STRIPE_KEY=<MDU:masked>
GH_TOKEN=<MDU:masked>
DEBUG=1

On your disk, and for the programs and hosts you allow

STRIPE_KEY=sk_live_51Hq8xT2…
GH_TOKEN=ghp_7Qx2Lm9a…
DEBUG=1

The problem

Your agent is leaking your secrets. Every request.

Coding agents read your files as they work: .env, and your documents too. Once a key or a document is read, it rides along in every request to the AI company. And whatever the agent holds can go to any server a command names.

Only api.stripe.com needed your key, and your memo never had to leave. The AI company got both anyway, and so can any server a command names.

Two ways your secrets leak

1In every request to the AIOnce read, a key or a document sits in the agent's context and goes out with every call.the AI company

2In a command the agent runsA curl with the key or the document, to whatever host the command names.any server: a gist, a webhook, a tunnel

What it looks like

A key from .env

> how much did we charge on Stripe last week? ● Read(.env) STRIPE_KEY=sk_live_51Hq8xT2… ● Bash(curl api.stripe.com/v1/charges \ -u sk_live_51Hq8xT2…:) ● Last week: $12,480 across 37 payments.

A secret document

> tidy up my notes in ~/work ● Read(~/work/board-memo-q4.md) # CONFIDENTIAL: board only Cut 40 roles in March, before staff are told. ● Tidied 6 notes in ~/work.

Not only .env

~/.ssh/id_ed25519~/.aws/credentials~/Documents/health/lab-results.md~/Documents/contracts/nda.pdf

SSH keys and cloud logins, and any document you would not hand to an outside company: health records, a contract, a board memo. Whatever the agent opens goes to the AI company too.

The obvious fix: block the agent from reading .env. Then the key stays home, and the agent can't use it either.

Why isn't a sandbox enough? Read Why a sandbox isn't enough to keep secrets from your AI provider.

How it works

Masked for the AI. Ready for the task.

For a secret whose rule says “No AI”, Mandu keeps the real value out of the AI’s conversation while letting approved tools use it. The figure at the top shows the three steps: masked on the way in, the AI works with the dumpling, unwrapped on the way out.

You choose which AI may read a secret and where it may be sent. Your OK for a send never overrides the rule about which AI may read it.

Inside a placeholder and a rule Format, model access, destinations, and configuration

Only Mandu’s local table turns a placeholder back into the real value; the agent can neither read nor change that table. Other illustrations on this page use <MDU:masked>, or in the hero a dumpling, as shorthand.

$MDU:PrefixMarks a Mandu placeholder

nomodel_Model accessNo AI may read this secret

ReadToolThe tool that read the secret

[9bbd]IDA reference in the local table

.STRIPE_KEYSecret nameHelps the AI choose the right placeholder

Where the real value goes

curl api.stripe.com/v1/charges \
  -u $MDU:nomodel_Read[9bbd].STRIPE_KEY:

✓A host its rule lists. The request to api.stripe.com gets the real key, and only that request.

✓A program its rule names. ssh may open your key, but only when git started it. Your deploy tool opens its token on your word. Every other program is refused or gets the masked copy.

✓You. The agent's replies show you the real values; the AI keeps the placeholders.

# ~/.mandu/policy.yaml
paths:
  - path: ~/proj/.env
    level: no-model             # 1: No AI
    bindings: [api.stripe.com]  # 2: Listed hosts
  - path: ~/.ssh/id_ed25519
    level: no-model
    readers: [{ app: ssh, from: git }]
  - path: ~/work/board-memo-q4.md
    level: local-model          # 1: Your own AI only
models:
  - { name: ollama, local: true, … }

A rule answers two questions

1Which AI may read it?

no-modelNo AI. Every AI sees it masked, Mandu's own helper included.

local-modelYour own AI only. Only an AI you run and list, such as Ollama, may read it, when it asks. It can be your agent's main AI too.

any-modelAny AI, when it asks. The AI first sees it masked. Mandu's helper reads it for the AI, or the AI reads it into the conversation. The read is logged, and your AI provider gets the text.

publicNot secret. An ordinary file, even if it looks like a secret.

2Where may it be sent?

(default)Needs your OK. Every send of the real value waits on the Approvals page. Allow onceAlways allowBlock

bindingsListed hosts without asking. The hosts you list get the real value, so list only hosts you trust.

valuesPer value. In a file of several secrets, such as a .env, each value has its own hosts.

Your OK never lets an AI past the first question; only changing the rule does. Answer both on the dashboard's Rules page, one menu each, or in ~/.mandu/policy.yaml.

See it for yourself

Mandu with Claude Code

Simulation coming soon

Mandu with Codex

Simulation coming soon

Mandu with OpenCode

Simulation coming soon

Mandu with OpenClaw

Simulation coming soon

Mandu with Goose

Simulation coming soon

mandu demo runs the real Mandu components on your computer against a stand-in AI, offline, with no API key. It plays Claude Code's and Codex's requests today.

Evidence

Kept the secret and got the task done more often than any other protection we tried.

Six everyday tasks with a secret in them: file a bug report, go through the inbox, summarise a blood test, scrub a key from git history, debug a payment error, add notes to Notion. We ran each one live with Claude Code, under Mandu, under other protections and under none. Every other protection fell short, in one way or both: the secret got out, or the task did not get done.

ManduThe AI worked with placeholders. The real value went only where the task's rule allowed, such as the API's own host or a model on your own machine. Where it fell short, the AI asked a question instead of running the bug-report script: the task was not done, and nothing left the machine.
Claude Code deny rulesKept the secret by blocking the task: the app that needed the key could not read it, and the AI could not read the report it was asked to summarise. A rule on a file also missed the key in an old commit.
Claude Code credential maskWorks inside sandboxed commands, where its design reaches. The secret got out where it does not look: a file the AI read with its own tool, and a key a command printed from git history.
PrivAiTe gatewayFilters only the AI's traffic. A program the agent ran still sent the real file, and the blood-test results, which its detectors do not look for, reached the AI.
fencepost pluginRedacts what its scanner has a rule for. These test secrets got past it nearly every time, and it does not see what a program sends over the network.
No protectionThe agent read the files it needed and sent them on.

How we tested: Claude Code 2.1.295 with Claude Sonnet 5.5, live in a disposable virtual machine on 17 October 2026, three takes of each task under each setting, all with Claude Code's permission prompts turned off. Mandu ran with Protection on (secrets mode) and labels and bindings written for each task: the statements bound to the real accountant's host, the blood-test report readable by a local model only, each API key bound to its API's host. A fresh install's default catalog still holds the API keys at every host until you approve, but leaves the statements and the report readable. In the bug-report task Mandu held the upload for your OK; the run declined it and asked once more for the report without .env, a second turn only Mandu got. Claude Code's credential mask and deny rules were set up for each task's own secret files, as their documentation directs; PrivAiTe 0.7.2 and fencepost 0.13.1, which find secrets by pattern, ran one configuration throughout. The other settings ran without Mandu. A secret counts as kept when it reached neither the AI company nor a site it was not meant for, checked verbatim and in base64, hex, reversed and rot13. The test keys and account number were not in the shape real ones have, so the pattern-based tools may have done better with real ones; there is no corrected run yet. We also chose the tasks, and some suit Mandu's design: the blood-test summary needs a model on your own machine, and only Mandu can route a read to one. Everyday tasks, no attacks. The method and the caveats are in Secret kept, task done.

Research

Where Mandu comes from

Prompt Flow Integrity (arXiv:2503.15547) isolates an LLM agent from untrusted content and guards against privilege escalation. DualView (arXiv:2607.03821) follows it with a defense that keeps two views of an agent's data and routes every action to one of them.

Mandu builds on our experience with Prompt Flow Integrity and DualView. It works at the operating-system level instead of inside one agent framework, and protects secrets with placeholders; from that work it carries forward the placeholder table and the policy engine.

github.com/compsec-snu/dualview

On our engineering pages: how Mandu is built and what it does not cover, in Placeholders, not keys; how we tested it, in Secret kept, task done; and how it compares with the other approaches, in Why a sandbox isn't enough.

Cite

@misc{dualview2026,
  title  = {DualView: Preventing Indirect Prompt
            Injection in Personal AI Agents},
  author = {Kim, Juhee and Choi, Woohyuk and
            Kang, Taehyun and Kim, Youngmin and
            Lee, Byoungyoung},
  year   = {2026},
  eprint = {2607.03821},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR}
}

@misc{pfi2025,
  title  = {Prompt Flow Integrity to Prevent
            Privilege Escalation in LLM Agents},
  author = {Kim, Juhee and Choi, Woohyuk and
            Lee, Byoungyoung},
  year   = {2025},
  eprint = {2503.15547},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR}
}

Mandu Security

The company behind Mandu.

Mandu Security builds Mandu and keeps it open. We started from systems-security research on keeping AI agents away from data they should not hold, and we are turning that research into something you can install next to the agent you already use.

A mandu is a Korean dumpling. The agent handles the wrapper; the filling, your secrets, stays with you.

[email protected] Write to us

Open source · free

Mandu

Everything on this page, on your own computers.

Now · beta

Design partners

We are working with a small group of early teams whose agents run next to real credentials. If that is you, write to us.