Mantou 2026.03.21 — M-* Rules, Smart Dedup & Cute Animation

🛡️ Mantou 2026.03.21

Your OpenClaw agent is probably misconfigured. Mantou finds out in 10 seconds — on your machine, with zero telemetry.

pipx install git+https://github.com/peeweeh/mantou.git

---

✨ What's New

🔒 19 New Security Rules (M-* checks)

Phase 1 static rules — work even if OpenClaw is not running:

Rule	Severity	What it catches
M-AUTH-001	HIGH	No auth rate limiting configured
M-AUTH-002	CRITICAL	Gateway token too short (<32 chars)
M-BIND-001	CRITICAL	Gateway bound to 0.0.0.0 without strong auth
M-CRED-001	CRITICAL	Gateway credentials empty or hardcoded
M-CRED-002	CRITICAL	Telegram bot token hardcoded in config
M-CRED-003	CRITICAL	Discord token hardcoded in config
M-CRED-004	CRITICAL	Model provider
M-LOG-001	HIGH	Log redac

🎨 Cute Animation

🔍 Starting Mantou security scan...

 ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋.
 ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phale ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phale ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phale ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ Phas ⠋ scan progresses

### 📊 Enhanced Text Output

📊 SUMMARY: 22 findings (12 critical, 9 high, 1 medium, 0 low)

🔴 Critical ██████████░░░░░░░░░░ 12 ( 54.5%)
🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� 🟠 High ████████░░upp 🟠 High ██s** — 🟠 High ██████�y caught issue X, openclaw security audit reporting the same thing is suppressed 🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� 🟠 High ████████░░░░░░░�� ��rra 🟠 High ███��tain , 🟠 High ████████░░░░░░░�� ll 🟠 High ████████░░░░░░░�� 🟠 High ███

Upgrade

pipx upgrade mantou

Verify

mantou scan --text --skip-tools

---

## ⚡ Quick Start

```bash
# Full scan (Phase 1 static + Phase 2 tool checks)
mantou scan --text

# Self-contained — no OpenClaw required
MANTOU_SKIP_TOOLS=1 mantou scan --text

# JSON output for CI/automation
mantou scan --json | jq .findings

---

117 tests passing · ruff clean · zero telemetry

Nightly — nightly-20260321-99d05cb

🌙 Nightly build — not for production use.

Nightly — nightly-20260321-1a79e91

🌙 Nightly build — not for production use.

2026.03.15

What's Changed

• Add actionable audit parity checks and isolation rules by @peeweeh in #1
• Add deep agent and inline credential checks by @peeweeh in #2

New Contributors

• @peeweeh made their first contribution in #1

Full Changelog: 2026030...2026.03.15

Nightly — nightly-20260315-74b12f3

🌙 Nightly build — not for production use.

🔧 Other

• ci: release system with CalVer, auto-merge, categorized notes; marketing README

Nightly nightly-20260315-56fb9f6

Full Changelog: 2026030...nightly-20260315-56fb9f6

Nightly nightly-20260315-0cc58fe

Full Changelog: nightly-20260315-56fb9f6...nightly-20260315-0cc58fe

2026030801

Full Changelog: https://github.com/peeweeh/mantou/commits/2026030801