# Mandare > The open-source control and accountability layer for AI agent fleets. Mandare gives every AI agent a signed identity (Passport), a signed spending limit its operator sets once (Mandate), and a tamper-evident record of everything it did (Ledger), plus an offline kill switch. Limits are enforced at the doors the agent must pass through (LLM gateway, vault, card authorization), never by trusting the agent. Tagline: "For what agents can do, Mandare removes the walls; for what they can't reliably do, it caps the blast radius and records everything." Mandare is built by Mandare Labs. Open source since 2026-10-01 (v0.1.0), local-first, and non-custodial (it never holds funds and needs no banking license). The name is Latin *mandāre*, "to entrust, to command", the root of "mandate". Primary site: https://mandarelabs.com. Also reachable at https://mandare.dev. ## Get it - Source: https://github.com/mandarelabs/mandare - Release: https://github.com/mandarelabs/mandare/releases/tag/v0.1.0 - Quickstart (Docker Compose v2, no API keys, mock provider): `git clone https://github.com/mandarelabs/mandare && cd mandare`, then `docker compose up -d --wait`, then `docker compose run --rm demo` - No Docker (Node >= 22.13, pnpm 10): `./install.sh`, then `pnpm demo` - CLI from npm: `npm i -g @mandarelabs/cli && mandare help` (https://www.npmjs.com/package/@mandarelabs/cli) - MCP server: `npx -y @mandarelabs/mcp-server` (reads the ledger at `MANDARE_LEDGER_DB`, default `./mandare-ledger.db`). MCP registry name: `com.mandarelabs/mandare`. Also listed on Glama: https://glama.ai/mcp/servers/mandarelabs/mandare - Docs: https://mandarelabs.com/docs (quickstart: https://mandarelabs.com/docs/quickstart, threat model: https://mandarelabs.com/docs/threat-model, security: https://mandarelabs.com/docs/security) ## The three primitives - **Passport**: a signed per-agent cryptographic identity (did:key), bound to the mandate its operator signed. The agent signs every request (RFC 9421 HTTP Message Signatures over the exact body), so a stolen credential is useless ("dead paper"), and one command revokes everything the agent can touch. Owner KYC is an interface with a mock provider today; Mandare does not claim verified owners. - **Mandate**: the operator signs authority once (budgets, scopes, approval thresholds); the agent then acts freely inside that boundary. One signature replaces dozens of per-action approval prompts. Enforced at the doors, never by trusting the agent. - **Ledger**: an append-only, hash-chained, door-signed record written by the infrastructure, never by the agent. Log-before-act; refusals are entries too. Tamper-evident, not tamper-proof: an edited entry fails `mandare verify`; entries dropped from the end are only caught with a witness on separate infrastructure (verifier holds the door key out-of-band) or a saved `--prev-head`. ## Why it exists (sourced) - 1.5M agent API tokens were exposed in one misconfigured agent-network database (Wiz, 2026-02-02: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys). - Claude Code users approve 93% of permission prompts; Anthropic names the resulting approval fatigue (Anthropic, 2026-03-25: https://www.anthropic.com/engineering/claude-code-auto-mode). - 74% of enterprises have rolled back or shut down an AI customer-communications agent after deployment (Sinch survey, n=2,527, 2026-05-13: https://sinch.com/news/sinch-releases-ai-production-paradox/). - Automated traffic passed human traffic on the web in May 2026 (Cloudflare, 2026-09-27: https://blog.cloudflare.com/cloudflares-2026-annual-founders-letter/). - EU AI Act record-keeping duties for high-risk systems apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) under Regulation (EU) 2026/1744 (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744). ## Key design choice: proofs, not data Mandare is local-first. The record of what your agents did stays on your machine; Mandare Labs never sees its contents and runs no hosted service today. All that leaves the machine is a content-free fingerprint (salted tree heads) sent to a witness the operator chooses: their own second machine or a third party. Built on open standards: HTTP Message Signatures (RFC 9421) for request signatures, made and checked with the `web-bot-auth` library; a JWK Set (RFC 7517) key directory for door keys, modelled on the Web Bot Auth directory drafts; SD-JWT VC credentials; did:key. Mandare does not claim that a Web Bot Auth verifier accepts a Mandare-signed request or directory: `Signature-Agent` carries the agent's did:key and `keyid` is a SHA-256 hex of the raw public key, where the current draft (draft-ietf-webbotauth-httpsig-protocol-00, 1 September 2026) requires a dictionary of https URIs and a JWK thumbprint. ## Proof it is real Five demos run in CI on every push; each is in the repo: 1. A runaway loop dies at a €20/day cap (`pnpm demo`: 71 calls, call #72 refused, €19.72 settled; the docker quickstart stops at call #24, €19.17 settled). 2. A stolen credential is dead paper; a kill command halts the agent mid-run (`pnpm demo:dead-paper`). 3. One signed mandate replaces 40 prompts; only the over-threshold decision pauses for a human (`pnpm demo:mandate`). 4. The card declines at the network; one cap governs LLM and card spend (`pnpm demo:card`). Tested against a Stripe mock that signs webhooks like Stripe; the live Stripe test-mode run hasn't happened yet. 5. Truncation and rewrites are caught by an independent witness, verified with the door key held out-of-band (`pnpm demo:witness`). ## Status (v0.1.0) - Security: two AI-assisted security reviews, findings fixed with regression tests; no external audit yet (pending). - Witness: binds the operator only on infrastructure the operator doesn't control; the one-host docker stack runs it on the same machine. - Licences: Apache-2.0 for spec, policy-engine, verifier, passport, witness-protocol, sdk, sdk-py; AGPL-3.0-only for gateway, ledger, vault, card-rail, witness server, MCP server, CLI, dashboard. See https://github.com/mandarelabs/mandare/blob/main/LICENSING.md ## Business model Open core, pre-revenue. Everything above is open source and free; verification stays free for anyone. Planned, not available, no dates: a hosted control plane for teams and fleets, and an enterprise pack (SSO, roles, retention, compliance exports). ## Pages - [Homepage](https://mandarelabs.com/): the problem, the three primitives, the five demos, status, the trust model, and the business model. - [Docs](https://mandarelabs.com/docs): quickstart, concepts, demos, self-hosting, integrations, threat model, security. - [Docs, page index](https://mandarelabs.com/docs/llms.txt): every docs page with a one-line summary. - [Docs, full text](https://mandarelabs.com/docs/llms-full.txt): every docs page in one Markdown file. - [Journal](https://mandarelabs.com/journal): guides, standards, comparisons and field notes on giving AI agents identity, limits, and a tamper-evident record. Every entry is listed under "Journal entries" below. - [Journal, full text](https://mandarelabs.com/llms-full.txt): every journal entry in one plain-text file. - [Privacy & imprint](https://mandarelabs.com/privacy): what the site collects (only an email address, after double opt-in) and provider information. - [RSS feed](https://mandarelabs.com/journal/feed.xml) and [JSON feed](https://mandarelabs.com/journal/feed.json): new journal entries. ## Journal entries Newest first. Full text of every entry in one file: https://mandarelabs.com/llms-full.txt - [Web Bot Auth: Signature-Agent, key directories, limits](https://mandarelabs.com/journal/web-bot-auth-signature-agent) (2026-10-18, Standards): How a website checks a signed agent under Web Bot Auth: the Signature-Agent header, the key directory, caching, and what the draft leaves out. Read 18 October 2026. - [AI agent deleted a production database: PocketOS and Railway](https://mandarelabs.com/journal/ai-agent-deleted-production-database) (2026-10-17, Incidents): What Railway's post-mortem says happened when an agent deleted a database with a token it found, which three controls failed, and what to change. - [How to stop an AI agent infinite loop: four layers](https://mandarelabs.com/journal/stop-ai-agent-infinite-loop) (2026-10-16, Guides): Turn caps, SDK budgets, rate limits and an outside spend cap each stop a runaway agent loop differently. What each counts, returns and misses. - [Fail closed or fail open: what an AI gateway should do](https://mandarelabs.com/journal/fail-closed-vs-fail-open-ai-gateway) (2026-10-15, Design): What a gateway does with an agent's request when its budget store, ledger or approver is down: Envoy, Stripe and LiteLLM defaults, and which way to fail. - [LiteLLM budget per key: what it enforces and where it ends](https://mandarelabs.com/journal/litellm-budget-per-key) (2026-10-14, Comparisons, Guides): How LiteLLM key budgets work: max_budget, resets, pre-call reservation, three documented ways a budget stops capping, and who can change it. Read 14 October 2026. - [How to detect deleted or truncated audit log entries](https://mandarelabs.com/journal/detect-deleted-audit-log-entries) (2026-10-13, Demos): Which checks catch an edited, deleted or re-signed audit log and which need a head kept elsewhere. CloudTrail, witnesses and a demo transcript. - [RFC 6962 Merkle tree and consistency proofs, explained](https://mandarelabs.com/journal/rfc-6962-merkle-tree-consistency-proof) (2026-10-12, Standards): How RFC 6962 turns a log into one root, what inclusion and consistency proofs show, and why an old root must be kept. Worked example with real hashes. - [Moltbook exposed 1.5M agent API keys: what limits damage](https://mandarelabs.com/journal/moltbook-database-exposed-api-keys) (2026-10-11, Incidents): What Wiz found in Moltbook's open database, why a table of API keys is a table of logins, and what key storage, key custody and spend caps change. - [Cloudflare AI Gateway spend limits: what they enforce](https://mandarelabs.com/journal/cloudflare-ai-gateway-spend-limit) (2026-10-10, Comparisons, Guides): What Cloudflare AI Gateway spend limits check, what a 429 means, where a burst can pass the cap, and what a per-agent budget rests on. Read 10 October 2026. - [Virtual card limits for an AI agent: what Stripe enforces](https://mandarelabs.com/journal/virtual-card-for-ai-agent-spending-limit) (2026-10-09, Guides, Demos): How to cap an AI agent's virtual card with Stripe Issuing: spending controls, real-time authorizations, their gaps, and one cap shared with LLM spend. - [EU AI Act Article 12: what it means for AI agent logs](https://mandarelabs.com/journal/eu-ai-act-article-12-ai-agent-logs) (2026-10-08, Standards): What Article 12 says about logs, who must keep them under Articles 19 and 26, and the new 2027 and 2028 dates after the Digital Omnibus. - [20 tools that cap, identify or audit AI agents (2026)](https://mandarelabs.com/journal/ai-agent-governance-tools) (2026-10-07, Comparisons): Twenty tools scored on four controls: signed agent identity, hard spend cap, tamper-evident record and offline kill switch. Vendor docs read 7 October 2026. - [Stolen AI agent API key: what proof of possession fixes](https://mandarelabs.com/journal/stolen-ai-agent-api-key-proof-of-possession) (2026-10-06, Guides, Demos): What a thief can do with a leaked agent key, what short lifetimes and proof of possession change, and what they leave open. With RFC quotes and a demo. - [How to set a daily spending limit for an AI agent](https://mandarelabs.com/journal/ai-agent-daily-spending-limit) (2026-10-05, Guides): Anthropic and OpenAI cap spend by the month. Where a daily window exists, what each cap returns when it trips, and how to stop an agent retrying into it. - [AI agent approval fatigue: a signed limit beats prompts](https://mandarelabs.com/journal/ai-agent-approval-fatigue) (2026-10-04, Guides, Demos): Why per-action approval prompts stop working, what auto mode and allow rules trade away, and how a held request with a threshold asks a human when it matters. - [RFC 9421 HTTP message signatures for AI agents](https://mandarelabs.com/journal/rfc-9421-http-message-signatures-ai-agents) (2026-10-03, Standards): What RFC 9421 signs, what it leaves to you (body, replay, coverage), and how a gateway can check an agent's signed request. With the RFC's own example. - [Proofs, not data](https://mandarelabs.com/journal/proofs-not-data) (2026-07-23, Design): Why the accountability layer for AI agents must not see your data — and how content-free fingerprints still make the record checkable by anyone. - [A runaway agent loop dies at €20](https://mandarelabs.com/journal/runaway-loop-dies-at-20) (2026-07-23, Demos): 71 API calls in 0.1 seconds. Call #72 refused by a mandate signed once — and the refusal becomes tamper-evident evidence. Real transcript, no mockups. Topic hubs: [Guides](https://mandarelabs.com/journal/topic/guides), [Standards](https://mandarelabs.com/journal/topic/standards), [Comparisons](https://mandarelabs.com/journal/topic/comparisons), [Incidents](https://mandarelabs.com/journal/topic/incidents), [Demos](https://mandarelabs.com/journal/topic/demos), [Design](https://mandarelabs.com/journal/topic/design) ## Contact - Email: info@mandarelabs.com - Design partners and hosted-plane interest: https://mandarelabs.com/#waitlist - Security reports: https://mandarelabs.com/docs/security - What Mandare is NOT: not a bank, not a payment network, not a crypto token, not a surveillance/observability tool, not a company that makes agents "smarter". It is the accountability layer.