mandare

Mandare is an accountability stack for AI agent fleets, with the core goal of making agents' budget limits impossible to bypass through "persuasion" and providing tamper-proof verifiable records of their behavior.

Purpose

Mandare is used for closed-loop management of the identity, permissions, budget, and behavior of AI agent fleets. It provides signed identities (Passport), machine-readable signed authorizations (Mandate), a tamper-proof ledger (Ledger), and an offline kill switch, and through external witnessing and public anchoring, it makes the ledger history impossible to truncate or rewrite without detection. Its design follows a local-first principle: raw activity data never leaves your machine.

Main capabilities

1. Signed identity (Passport): Issues verifiable credentials and keys for agents.
2. Signed authorization (Mandate): Specifies an agent's permissions and budget in a machine-readable signed form.
3. Tamper-proof ledger (Ledger): Records an agent's actual behavior, including denial records, and supports SQLite and Postgres.
4. Offline kill switch: Terminates an agent without relying on any remote component.
5. External witnessing and public anchoring: Through witnesses on independent infrastructure, prevents the ledger from being truncated or rewritten; even the operator cannot tamper with it without detection.
6. Local CLI and MCP server: Provides a command-line tool and MCP server for operations such as verification, issuance, and termination.
7. Proofs rather than data: Only proofs cross trust boundaries (such as salted tree heads, integrity certificates, revocation bitstrings); raw prompts and responses do not leave the local machine.

Usage

Quick start (Docker)

Requires Docker and Compose v2 (up --wait requires v2.1.1+). The first run builds the image locally and takes a few minutes. The demo releases a runaway agent loop against your gateway, using built-in simulated provider pricing: enforcement is real, but the funds are simulated. A €20/day authorization terminates it during the run: 23 calls settle at €19.17, the reservation for the 24th call would exceed €20, is denied and returns 403 PER_DAY_EXCEEDED, and the denial itself is also a ledger record,mandare verify will prove the chain is valid, the counter equals the ledger replay, and the witnessed head history covers that chain. The dashboard is located at http://127.0.0.1:8788。真实提供者需在 Put the key in .env.

No-Docker method (Node ≥ 22.13 and pnpm 10)

If pnpm is missing, install.sh will run corepack enable (a global change).pnpm demo runs a cheaper model and raises the gateway's default speed limit of 60 calls/minute, making the budget the only limit: 71 calls, and the 72nd call is denied at the same €20 cap. Note:pnpm demo runs without a witness, so mandare verify cannot see entries dropped from the end of the ledger (including denials) unless the saved --prev-headis passed in. The Docker stack runs a witness,pnpm demo:witness Show that it captures the situation.

Install from npm (CLI + MCP server)

No need to check out the code; the MCP server reads the ledger located at MANDARE_LEDGER_DB, defaulting to ./mandare-ledger.db.

State locations

The CLI's vault (./mandare-vault.db, used for passport issue and vault …) stores the master key in the operating system keychain by default; passport issue writes agent credentials and keys to ~/.mandare/agents/ by default; unless MANDARE_VAULT=1, the gate's private key is located next to the ledger (<ledger>.doorkey.pem, permissions 0600).

The five demos

The five demos are acceptance tests (CI runs all of them). Each demo also has a standalone, narrated scenario in examples/—the story, real captured output, and the code to read next.

Applicable scenarios

• Organizations that need to set hard budgets for AI agents and enforce them.
• Compliance scenarios that require tamper-proof auditing of agent behavior.
• Environments that need offline termination capability without relying on remote control.
• Multi-agent systems that need external witnesses and public anchoring to enhance verifiability.
• Privacy-sensitive scenarios that are local-first and keep data on the machine.

Limitations and caveats

• The funds in the demos are simulated; real providers need to configure keys themselves.
• Without a witness,mandare verify cannot detect entries discarded at the end of the ledger unless a saved --prev-headis provided.
• The security review was completed with AI assistance and has not yet undergone an external audit; an external audit is still pending.
• From launch: npm Trusted Publishing (OIDC provenance), cosign-signed images, signed skill envelopes.
• License: AGPL-3.0-only, but the embeddable packages (spec, policy-engine, verifier, passport, witness-protocol, sdk, sdk-py) are Apache-2.0, and this split is permanent.
• For vulnerability reports, see SECURITY.md (private reporting, safe harbor, 90-day disclosure).
• Requires Docker and Compose v2 or Node ≥ 22.13 and pnpm 10.
• All operations are performed through the local CLI and MCP server.