Mandare

Give your agents a budget they cannot talk their way out of.

Mandare is the accountability stack for AI agent fleets: signed agent identity (Passport), signed machine-readable authority (Mandate), a tamper-evident ledger of what agents actually did (Ledger), an offline kill switch — and external witnessing + public anchoring so ledger history cannot be truncated or rewritten without detection (with the witness on separate infrastructure, not even by the operator — the solo compose stack runs everything on one host and says so). Local-first: raw activity never leaves your machine.

_{Replay of the captured Demo 1 run (pnpm demo, the no-docker path; the docker quickstart stops at call #24) — the same script CI executes and asserts on every push. Regenerate: node scripts/render-demo-gif.mjs.}

Quickstart — 3 commands, no API keys needed

Needs Docker with Compose v2 (up --wait needs v2.1.1+). The images build locally on first run, which takes a few minutes.

git clone https://github.com/mandarelabs/mandare && cd mandare

docker compose up -d --wait

docker compose run --rm demo

The demo releases a runaway agent loop against your gateway, priced against a bundled mock provider: the enforcement is real, the money isn't. The €20/day mandate kills it mid-run: 23 calls settle €19.17, call #24's reservation would cross €20 and is refused 403 PER_DAY_EXCEEDED, the refusal is itself a ledger entry, and mandare verify proves chain VALID, counters == replay(ledger), and the witnessed head history covers the chain. Dashboard at http://127.0.0.1:8788. Real providers: put keys in .env (docs).

When you're done, docker compose down -v removes the containers and the demo volumes (mandare-data, mandare-witness-state).

No docker (Node ≥ 22.13 and pnpm 10; if pnpm is missing, install.sh runs corepack enable, a global change):

./install.sh

pnpm demo

(pnpm demo runs a cheaper model and raises the gateway's default 60 calls/minute velocity limit so the budget is the only limit in play: 71 calls, call #72 refused at the same €20 cap. The docker demo above runs the stack's real defaults.)

pnpm demo runs without a witness, so mandare verify there can't see entries dropped from the end of the ledger — refusals included — unless you pass a saved --prev-head. The docker stack runs a witness, and pnpm demo:witness shows it catching exactly that.

Or from npm (CLI + MCP server, no checkout; the MCP server reads the ledger at MANDARE_LEDGER_DB, default ./mandare-ledger.db):

npm i -g @mandarelabs/cli && mandare help

npx -y @mandarelabs/mcp-server

Where state lands: the CLI's vault (./mandare-vault.db, used by passport issue and vault …) keeps its master key in the OS keychain by default; passport issue writes the agent's credential and key under ~/.mandare/agents/ by default; and unless MANDARE_VAULT=1, the door's private key sits next to the ledger (<ledger>.doorkey.pem, mode 0600).

Proofs, not data