Open source · by Mandu Security
Your agent sees the wrapper, never the filling.
Mandu keeps your secrets for you, and keeps your AI agent useful. Run Claude Code, Codex and other coding agents next to your real keys and secret files. The AI sees your secrets masked. You, and the programs that need them, still get the real values.
Masked on the way in.
Claude Code and Codex see only the wrapper.
Unwrapped only where your rule allows, like api.stripe.com, or with your OK.
Get started
Easy install: one line.
Mandu uses your agent's own login, Claude Pro and Max included, and needs no API key of its own. No account, no Mandu server and no telemetry: everything Mandu stores stays in ~/.mandu.
Mandu installs with npm and needs Node 22.13 or newer.
# install: needs Node 22.13 or newer $ npm install -g @mandusec/mandu # check this computer: Node, git, your agent, your secrets $ mandu doctor # your agent, protected (or: mandu codex) $ mandu claude mandu: mode secrets (14 credential files masked, 3 env vars masked) mandu: dashboard http://127.0.0.1:38121/ # what was protected, and what waits for your OK $ mandu dashboard # make it the default $ alias claude="mandu claude"
The same file, read two ways.
The AI gets a stand-in it can pass around and put in a command. The file on your disk keeps the real value, and Mandu hands it only to the programs and hosts you allow, like api.stripe.com. Only secrets change.
The AI sees
STRIPE_KEY=<MDU:masked> GH_TOKEN=<MDU:masked> DEBUG=1
On your disk, and for the programs and hosts you allow
STRIPE_KEY=sk_live_51Hq8xT2… GH_TOKEN=ghp_7Qx2Lm9a… DEBUG=1
The problem
Your agent is leaking your secrets. Every request.
Coding agents read your files as they work: .env, and your documents too. Once a key or a document is read, it rides along in every request to the AI company. And whatever the agent holds can go to any server a command names.
Two ways your secrets leak
curl with the key or the document, to whatever host the command names.any server: a gist, a webhook, a tunnelWhat it looks like
.envNot only .env
~/.ssh/id_ed25519~/.aws/credentials~/Documents/health/lab-results.md~/Documents/contracts/nda.pdfSSH keys and cloud logins, and any document you would not hand to an outside company: health records, a contract, a board memo. Whatever the agent opens goes to the AI company too.
The obvious fix: block the agent from reading .env. Then the key stays home, and the agent can't use it either.
Why isn't a sandbox enough? Read Why a sandbox isn't enough to keep secrets from your AI provider.
How it works
Masked for the AI. Ready for the task.
For a secret whose rule says “No AI”, Mandu keeps the real value out of the AI’s conversation while letting approved tools use it. The figure at the top shows the three steps: masked on the way in, the AI works with the dumpling, unwrapped on the way out.
You choose which AI may read a secret and where it may be sent. Your OK for a send never overrides the rule about which AI may read it.
Inside a placeholder and a rule Format, model access, destinations, and configuration
Only Mandu’s local table turns a placeholder back into the real value; the agent can neither read nor change that table. Other illustrations on this page use <MDU:masked>, or in the hero a dumpling, as shorthand.
Where the real value goes
curl api.stripe.com/v1/charges \
-u $MDU:nomodel_Read[9bbd].STRIPE_KEY:
api.stripe.com gets the real key, and only that request.ssh may open your key, but only when git started it. Your deploy tool opens its token on your word. Every other program is refused or gets the masked copy.# ~/.mandu/policy.yaml paths: - path: ~/proj/.env level: no-model # 1: No AI bindings: [api.stripe.com] # 2: Listed hosts - path: ~/.ssh/id_ed25519 level: no-model readers: [{ app: ssh, from: git }] - path: ~/work/board-memo-q4.md level: local-model # 1: Your own AI only models: - { name: ollama, local: true, … }
A rule answers two questions
1Which AI may read it?
no-modelNo AI. Every AI sees it masked, Mandu's own helper included.local-modelYour own AI only. Only an AI you run and list, such as Ollama, may read it, when it asks. It can be your agent's main AI too.any-modelAny AI, when it asks. The AI first sees it masked. Mandu's helper reads it for the AI, or the AI reads it into the conversation. The read is logged, and your AI provider gets the text.publicNot secret. An ordinary file, even if it looks like a secret.2Where may it be sent?
(default)Needs your OK. Every send of the real value waits on the Approvals page.
Allow onceAlways allowBlockbindingsListed hosts without asking. The hosts you list get the real value, so list only hosts you trust.valuesPer value. In a file of several secrets, such as a .env, each value has its own hosts.Your OK never lets an AI past the first question; only changing the rule does. Answer both on the dashboard's Rules page, one menu each, or in ~/.mandu/policy.yaml.
See it for yourself
Debug. The AI reads a log that printed your database password, fixes the payment bug, and never sees the password.
Deploy. The AI moves your .env to the hosting platform. It only ever has the keys masked; the real ones go out after you allow it.
Paperwork. The AI files a tax extension. Your Social Security number reaches the state's site, never the AI.
mandu demo runs the real Mandu components on your computer against a stand-in AI, offline, with no API key. It plays Claude Code's and Codex's requests today.
Evidence
Kept the secret and got the task done more often than any other protection we tried.
Fifteen everyday tasks with a secret in them, each run three times with Claude Code: under Mandu, under eight other protections, and under none. A run counts only when the secret was kept and the task got done. Straight after install, with no setup, Mandu did both in 41 of 45 runs. The next best, Claude Code's credential mask set up for each task, did both in 27 of 45.
Some tools cannot do some tasks by design: deny rules hide a key from the program that needs it, and only Mandu can send a read to a model on your own machine. Counted only over the tasks both sides can do, Mandu still leads every tool; next to the credential mask, 41 of 42 (fresh install) against 27 of 42.
A browser agent too
Six web chores with browser-use on Gemini 2.5 Flash, three runs each, without Mandu and then with it: a lookalike sign-in page, a support chat that asks for the key, an ad above the car registry, an expense report, and two more.
How we tested: Claude Code 2.1.295 with Claude Sonnet 5.5, live in a disposable virtual machine on 19 October 2026, every setting on the same Mandu build, the same API key and Claude Code's permission prompts off. "Fresh install" is Mandu with its default catalog only; the first time it asks about a key's own API host or your real accountant, the person answers "always", as you would on day one (42 answers in 45 runs; the other tools never ask). "A rule for each task" adds labels and bindings written for that task, including a model on your own machine for the blood-test summary. Claude Code's mask and deny rules and NVIDIA OpenShell 0.1.4 (alpha) were set up for each task's secret files as their documentation directs; PrivAiTe 0.7.2, fencepost 0.13.1 and nono 0.80.0 ran their standard configurations. A secret counts as kept when it reached neither the AI company nor a site it was not meant for, checked verbatim and encoded. Runs the model's own safeguards stopped are left out (one each for four settings). We chose the tasks, and we improved Mandu using earlier runs of these same tasks; the other tools got no such tuning. One agent, one model, three runs per task: read a gap of a few runs as noise. Everyday work, no prompt injection; two tasks include a request to send a document somewhere you never approved, and one a dependency that tries to post your .env. The method, every task's result and the caveats are in Secret kept, task done.
Research
Where Mandu comes from
Prompt Flow Integrity (arXiv:2503.15547) isolates an LLM agent from untrusted content and guards against privilege escalation. DualView (arXiv:2607.03821) follows it with a defense that keeps two views of an agent's data and routes every action to one of them.
Mandu builds on our experience with Prompt Flow Integrity and DualView. It works at the operating-system level instead of inside one agent framework, and protects secrets with placeholders; from that work it carries forward the placeholder table and the policy engine.
github.com/compsec-snu/dualview
On our engineering pages: how Mandu is built and what it does not cover, in Placeholders, not keys; how we tested it, in Secret kept, task done; and how it compares with the other approaches, in Why a sandbox isn't enough.
Cite
@misc{dualview2026,
title = {DualView: Preventing Indirect Prompt
Injection in Personal AI Agents},
author = {Kim, Juhee and Choi, Woohyuk and
Kang, Taehyun and Kim, Youngmin and
Lee, Byoungyoung},
year = {2026},
eprint = {2607.03821},
archivePrefix = {arXiv},
primaryClass = {cs.CR}
}
@misc{pfi2025,
title = {Prompt Flow Integrity to Prevent
Privilege Escalation in LLM Agents},
author = {Kim, Juhee and Choi, Woohyuk and
Lee, Byoungyoung},
year = {2025},
eprint = {2503.15547},
archivePrefix = {arXiv},
primaryClass = {cs.CR}
}
Mandu Security
The company behind Mandu.
Mandu Security builds Mandu and keeps it open. We started from systems-security research on keeping AI agents away from data they should not hold, and we are turning that research into something you can install next to the agent you already use.
A mandu is a Korean dumpling. The agent handles the wrapper; the filling, your secrets, stays with you.
Open source · free
Mandu
Everything on this page, on your own computers.
Now · beta
Design partners
We are working with a small group of early teams whose agents run next to real credentials. If that is you, write to us.