Mandu 0.2.0-beta.8

Mandu 0.2.0-beta.8 — public beta

Run Claude Code or Codex next to your real keys and secret files. The AI sees placeholders; you and the programs you allow can use the real values.

Install or update

With Node.js 22.13 or newer:

npm install -g @mandusec/mandu@0.2.0-beta.8
mandu --version
mandu doctor
mandu demo

Or see what your agents already sent to the AI, with nothing installed:

npx @mandusec/mandu scan

Alternatively, download install.sh, SHA256SUMS, and the package below into one folder, then run sh install.sh. The installer checks the package checksum and can install a private copy of Node when needed.

Changes since beta.7

• mandu scan reads the sessions your agents kept on this computer (Claude Code, Codex, OpenCode, Goose, OpenClaw, Gemini CLI, Copilot CLI) and lists each of your secrets that reached the AI: the file it lives in, what the agent ran or read, when, and which provider got it. No value is shown and nothing leaves the computer. It also lists secrets a command sent on (over HTTP, ssh, git, an inline script or an MCP tool), the riskier sessions, and values that only look like keys, with obvious test values set apart. mandu scan --show <n> tells one finding in full; mandu scan --open opens it in the dashboard.
• The dashboard's Scan page tells each finding's story in red (what left your computer) and green (what Mandu keeps), with a figure of what happened without Mandu and what Mandu does instead. A long scan opens at once.
• A dashboard account. Set one username and password with mandu dashboard --set-password; the dashboard shows a sign-in page and nothing else until you do. One-time sign-in links and DASHBOARD_PASSWORD are gone, and an existing DASHBOARD_BASIC_AUTH becomes the account the first time.
• MCP servers' tokens in the configs of Claude Code, Codex, Cursor, VS Code, Claude Desktop, Windsurf, OpenCode, Goose, Gemini CLI, Zed and Continue reach the AI only as placeholders, while the agent's own MCP servers still start with the real values.
• Each mandu <agent> session ends with one line saying what Mandu kept from the AI. Where Mandu cannot check a session's record (the agent could reach Mandu's own controls on that computer), the line says so instead of a count.
• mandu dashboard opens where Mandu never ran and says plainly when protection is off; many smaller dashboard improvements (rule changes say who asked, Back keeps your place, Approvals and History search, real values hide themselves again).
• Faster launches in large home folders: git work only in the launch's own repositories, each question asked once, and every launch step's cost in mandu log --timings.

See the changelog for details.

Scope

This is a beta. Linux x64 is the primary supported platform. The package also contains Linux arm64 native binaries; their startup is checked under emulation. macOS remains experimental.

The default secrets mode protects registered credentials and labeled private data. It does not prevent prompt injection or protect data that has not been registered or labeled. Integrity modes remain experimental and disabled by default.

Report suspected security issues privately. For other bugs, include mandu version and mandu doctor output after removing private information.

Artifact

The GitHub download and npm package are the same file.

• Source revision: 163f423bea5a669acf48c73483ba8c4f9f54d48b
• Public snapshot: 8dc188081e2d1eef778781b35a8ecf1f34e2711e

mandusec-mandu-0.2.0-beta.8.tgz sha256 b999c2f1e90b7788a4447b796b0bff5a6ebaba2dabb9a04179fd349ee09ccb82

Mandu 0.2.0-beta.7

Mandu 0.2.0-beta.7 — public beta

Run Claude Code or Codex next to your real keys and secret files. The AI sees placeholders; you and the programs you allow can use the real values.

Install or update

With Node.js 22.13 or newer:

npm install -g @mandusec/mandu@0.2.0-beta.7
mandu --version
mandu doctor
mandu demo

Alternatively, download install.sh, SHA256SUMS, and the package below into one folder, then run sh install.sh. The installer checks the package checksum and can install a private copy of Node when needed.

Changes since beta.6

• mandu version reports the running installation, source/build commits, other copies on PATH, and conflicting background services.
• Credentials whose formats identify their issuing service can go to that service's API over HTTPS in the sign-in header without a separate approval. Other destinations still require your rules or approval.
• Personal-document recognition includes text-layer PDFs and supported Office files. Claude Code can read a protected PDF's labels with its sensitive values replaced by placeholders.
• Personal names stay masked in protected documents without unnecessarily masking unrelated text that mentions the same name.
• The dashboard identifies the file a secret came from and improves history, rule search, notifications, and long-reply navigation.
• npm-installed copies receive an npm update command; installation and Codex login documentation reflects the current product.

See the changelog for details.

Scope

This is a beta. Linux x64 is the primary supported platform. The package also contains Linux arm64 native binaries; their startup is checked under emulation. macOS remains experimental.

The default secrets mode protects registered credentials and labeled private data. It does not prevent prompt injection or protect data that has not been registered or labeled. Integrity modes remain experimental and disabled by default.

Report suspected security issues privately. For other bugs, include mandu version and mandu doctor output after removing private information.

Artifact

The GitHub download and npm package are the same file.

• SHA-256: 1ea2ec1e78d804adfd8675ebe9e618cfa47e55daf555785b69113213263842a0
• Source revision: b1e05f2a9990263298ce19f8f6ffa753bbd89c3a
• Public snapshot: e6b4461f098c00cb52938ab3f7a7952866f2f24d