Use free models with less exposure

Free models can be useful for personal coding projects. With a remote provider, your requests still leave your computer. Mandri offers two separate settings: pseudonymization replaces automatically detected sensitive values in text before sending it to the model; Docker execution runs the agent’s tool in a disposable container. You can use either setting or combine them.

Experimental pseudonymization

Pseudonymization, also called surrogate in Mandri, is experimental. It is intended for personal projects and hobbies, not enterprise use. Do your own research into the model provider’s policies and the limits below. Do not entrust critical data to this mode. It reduces exposure of detected values; it does not guarantee anonymity or complete detection.

Before you start

Connect a provider, for example OpenRouter in the app or OpenRouter in the terminal. Choose a model currently marked as free in its catalog and check its data policy. Availability, usage limits and policies can change. OpenRouter’s privacy policy describes its role and the model providers’ handling of requests.

Use a small personal project without critical data. For Docker execution, Docker must be available on the machine running the Mandri daemon, with the required worker image and security configuration. If startup reports a missing prerequisite, resolve it before continuing.

In the app

1. Open New chat, select your project folder, then choose Codex or another available agent tool and the free model from your provider.
2. Open Standard below the prompt. This is the Session protection menu, separate from approval permissions.
3. For surrogate mode, keep Standard selected and enable Pseudonymized. The agent runs on the daemon machine, while detected values in model-bound text are replaced.
4. For container execution, select Docker sandbox. Enable Pseudonymized in the same menu if you want both settings. Docker alone does not pseudonymize model requests.
5. Check your approval setting, write your task and send it. Wait for the selected environment to finish preparing.

These modes require a model connected through Mandri’s provider gateway. A tool’s native connection is not enough.

During a pseudonymized session, open its protection menu and select the information button labelled View protected data. Mandri detects values automatically and lists them in Protected data. The app displays partially masked values so you can inspect what was detected without showing each value in full. An empty list does not establish that your project contains no sensitive data.

In the terminal

Set up the CLI and provider first. Run the command from your project folder and replace <model-id> with the exact ID of a currently free model in your OpenRouter catalog.

Surrogate on the host

mandri run --model "openrouter/<model-id>" \
  --execution-backend host \
  --privacy-mode surrogate \
  codex

Docker without pseudonymization

mandri run --model "openrouter/<model-id>" \
  --execution-backend docker \
  --privacy-mode none \
  codex

Docker with surrogate

mandri run --model "openrouter/<model-id>" \
  --execution-backend docker \
  --privacy-mode surrogate \
  codex

Mandri prepares the selected environment and opens the agent’s terminal interface. Enter your task there and respond to its approval prompts. The options appear before codex because arguments after the tool name are passed to that tool.

What surrogate does not cover

Text only and incomplete detection

Surrogate processes text only. It does not protect images, video, audio or other media. Do not attach sensitive media. Where your chosen tool allows it, disable vision or image input in its capability settings. This is a precaution, not protection for the other media types.

Only values detected by Mandri are replaced. Text can still reveal information through context, missed identifiers or source code. A file attachment is not made safe simply because surrogate is enabled. Inspect the protected-data list in the app and keep sensitive files out of the project.

Adding your own values to replace is part of the privacy roadmap. It is not a setting available in this guide today.

What changes inside Docker

Container limits

The disposable container does not inherit the commands, language runtimes or tools installed on your machine. A build or test that works on the host may fail inside the container because a dependency is missing.

For an unsupported toolchain, ask the agent to edit the code, then review the changes and run checks manually on your machine. Planned Docker image customization should make more environments possible.

The selected project folder remains shared: edits persist after the container stops. Internet access remains available. Docker does not conceal the project from the agent or make requests to a remote model private. Review changes before keeping them, just as in a standard session.