Mandare MCP server

Mandare

Give your agents a budget they cannot talk their way out of.

Mandare is the accountability stack for AI agent fleets: signed agent identity (Passport), signed machine-readable authority (Mandate), a tamper-evident ledger of what agents actually did (Ledger), an offline kill switch — and external witnessing + public anchoring so ledger history cannot be truncated or rewritten without detection (with the witness on separate infrastructure, not even by the operator — the solo compose stack runs everything on one host and says so). Local-first: raw activity never leaves your machine.

Replay of the captured Demo 1 run — the same script CI executes and asserts on every push. Regenerate: node scripts/render-demo-gif.mjs.

Quickstart — 3 commands, no API keys needed

git clone https://github.com/mandarelabs/mandare && cd mandare

docker compose up -d --wait

docker compose run --rm demo

The demo releases a runaway agent loop against your gateway. The €20/day mandate kills it mid-run: 23 calls settle €19.17, call #24's reservation would cross €20 and is refused 403 PERDAYEXCEEDED, the refusal is itself a ledger entry, and mandare verify proves chain VALID, counters == replay(ledger), and the witnessed head history covers the chain. Dashboard at http://127.0.0.1:8788. Real providers: put keys in .env (docs).

When you're done, docker compose down -v removes the containers and the demo volumes (mandare-data, mandare-witness-state).

No docker:

./install.sh

pnpm demo

(pnpm demo runs a cheaper model and raises the gateway's default 60 calls/minute velocity limit so the budget is the only limit in play: 71 calls, call #72 refused at the same €20 cap. The docker demo above runs the stack's real defaults.)

Proofs, not data

Raw prompts and responses never leave your machine. What crosses a trust boundary is only ever a proof: salted tree heads to the witness, an integrity certificate to an auditor, a revocation bitstring to a verifier.

agent (any SDK, base URL → the door)
   │  RFC 9421-signed request (passport)   or scoped PoP token
   ▼
 ┌──────────────── gateway door ────────────────┐
 │ kill-check → policy (mandate: caps/window/   │     ┌─ witness (external) ─┐
 │ scope/approval) → INTENT entry (reserves     │────▶│ salted head history, │
 │ cost in the ledger tx) → provider → RESULT   │ acks│ consistency-enforced,│
 │ entry (settles true cost)                    │◀────│ public anchor (OTS)  │
 └───────────────┬──────────────────────────────┘     └──────────────────────┘
                 ▼
        append-only ledger (SQLite/Postgres)
        hash-chained · door-signed · RFC 6962 tree
        budget counters + revocation = PROJECTIONS (replay-checkable)
                 ▼
   mandare verify · certify (third-party checkable) · dashboard · kill

Every door obeys three rules: fail-closed on spend, log-before-act, and agent input is hostile. Refusals are recorded — the system keeps its no's.

The five demos are the acceptance tests (CI runs all of them)

Shortened. The full README is on GitHub.