Questions
Answers, with the limits attached.
Everything a developer, a buyer and a security reviewer ask before building on Managoat, in one place. Where an answer has a limit, the limit is on the page beside it rather than in a questionnaire three weeks later.
Building on it
What a developer asks between reading the tour and writing the first call.
- Do I need a model key?
- Yes. Bring an Anthropic, OpenAI or Google key and the agent bills your own account for tokens. Managoat charges for the sandbox hours, never for inference, so there is no markup on the model.
- Where a key lives
- I have no API key. I pay for Claude.
- That is a credential Managoat accepts. A Claude Pro or Team subscription works in place of a metered API key, and when you hold both, the subscription is the one your agents spend. It is usually the one you want spent.
- My product has users. Do they each need an account here?
- Usually not. Your account holds the agents and the key, and each of your users gets their own conversation on their own machine, keyed by an id you already have for them. When you would rather they held their own account and their own model key, Sign in with Managoat is OAuth with PKCE and the token it hands back is an ordinary API key.
- Build a chat app
- Is this only good for writing code?
- The runtimes are coding agents, which is to say a shell, a filesystem and a network. One of the applications we built on it runs Python over a CSV you drop in. Another reads real sources and hands back a cited brief. If you would do the job at a terminal, it fits here.
- What happens to the sandbox between messages?
- It parks. The filesystem, the checkout and the agent's memory survive, a parked sandbox costs nothing, and it takes none of your concurrency. The next message wakes it in seconds instead of minutes.
- About sandboxes
- Is my work separate from everyone else's?
- Every query is scoped to your account, every sandbox belongs to one conversation unless you put another on it, and your secrets are encrypted with a key derived for your tenant alone.
- Architecture
- Can I run it myself?
- Yes. Managoat is the hosted edition of Fountain, an open-source server, and you can run it on your own hardware, with your own sandboxes. Nothing is held back for the people who pay.
- Self-host it
What it costs
Read from the same price card the ledger burns at.
- What am I actually charged for?
- Agent time, at $0.25 an hour. An hour means an hour with a prompt in flight, so a parked agent, an idle one and one running on your own machine cost nothing. Two agents working for an hour on the same machine are two hours.
- Is there a plan, a seat or a subscription?
- None of the three. You hold a balance, work spends it, and you buy more when you want more. New accounts start with $5.00 that expires in 14 days; credit you buy never expires.
- What happens when the balance runs out?
- New work pauses and nothing dies. A new conversation or a new prompt is refused until there is credit again, a turn already in flight finishes, and your agents, environments and vaults are all still there.
- How billing works
- Do you take a cut of what the model costs?
- No. The key is yours and the model bills you directly. Managoat never sees that invoice and never adds to it.
Security and data
Each answer names a mechanism rather than an intention, and each limit is stated beside the thing it limits.
- Where do the credentials live, and who can read them?
- An Environment holds the machine's own variables and a Vault holds a small bag of overrides for one run. The name collides with HashiCorp's and means close to the opposite here. A Vault is a per-run override layer rather than a central store. Both are encrypted at rest with AES-256-GCM under a key derived for your account alone. Values are write-only. No endpoint returns one, to anybody, including an operator.
- Deleting your account destroys that key with it, so what any backup still holds is unreadable rather than merely deleted.
- Does the model ever see them?
- No. Secrets merge into the sandbox's process environment when it spawns, and reach an agent's configuration through ${VAR} substitution. Nothing puts them in the prompt, the system prompt or the model's context.
- An agent that reads its own environment and says the value out loud has said it. The next answer is what happens to that line.
- What ends up in your logs?
- Every secret value you registered that is eight bytes or longer is replaced with [REDACTED] before the log line is written, not after. The transcript we store never held it.
- The match is on exact bytes. A value the agent re-encodes, splits or prints in pieces is not caught, and neither is one shorter than eight bytes.
- Can one account's agent reach another's?
- Every user-facing query is scoped by account. The few unscoped internal reads carry an _unsafe_ prefix so a reviewer can grep for all of them in one command, and a cross-tenant isolation suite in CI asserts the scoped endpoints answer 404 on another account's data.
- What is recorded when something changes, and for how long?
- The event is written where the change happens rather than where the request arrived, so the console, the API and a background worker are covered by one rule. An update names the fields that moved and never their values; a secret event records the key, the size and the provider. Read your own trail at GET /api/audit, filtered by action, resource or time.
- Conversation log events are kept 90 days, audit events a year, usage 400 days. On your own instance every window is a setting.
- Can the agent do something nobody approved?
- Set an agent's permission policy to ask and a tool call stops for a human before it runs, not after. The stronger pattern is the one the case study uses. Build the last gate somewhere the agent cannot reach, so refusing is somebody else's job rather than the model's.
- Asking is not the default, and it is not universal. claude, codex and gemini enforce it. opencode cannot, and refuses anything stricter than auto-allow with a 422 rather than pretending to hold the line.
- What if none of this may leave our network?
- Run the server yourself, or keep the platform and put the sandboxes on your own hardware with a runner. Either way the code and the secrets stay inside your perimeter.
- Read the runner's trust model first. It runs in trusted mode, the agent's processes run as the daemon's user, and no container or VM stands between them. An opt-in Firecracker backend exists and is not the default.
What we do not have.
Here rather than in week three of your review.
- No SOC 2 report, no ISO 27001 certificate, and no HIPAA posture. None of that work has been done. A review that requires one of them is a review this platform cannot pass.
- No data processing agreement on file and no published sub-processor list.
- No single sign-on, no organizations and no seats. An account is one person, and a team shares one or runs an instance of its own.
- No independent penetration test. The security work in the repo is the security work there is, and it is open source, so you can read all of it.
- The egress broker that keeps a credential out of the sandbox entirely is built and running for one account. It is not something you can turn on yet, so assume the sandbox holds the values you give it.
Running it yourself
The questions somebody asks between reading the page and running the clone.
- Is it really the same code?
- The same image and the same manifests. Every merge publishes deploy/ as an OCI artifact, and the hosted instance deploys from that artifact. There is no private overlay, and no patch that only we have.
- Does the AGPL reach my application?
- No. Your application talks to your instance over HTTP, and the CLI and the SDK are Apache-2.0 for exactly that reason. The copyleft has one target: somebody who changes the server and then offers the changed server to other people as a service.
- What do I pay for the software?
- Nothing. There is no license key and no seat count, and nobody has to talk to us first. Leave credits off and the instance prices nothing and shows nobody a bill. Turn credits on and it bills your users rather than you.
- Do I still bring a model key?
- Yes, and you always did. The agent bills your Anthropic, OpenAI or Google account for tokens. Nothing in the middle takes a cut of inference, hosted or not.
- Can I try the hosted one first?
- Yes, and none of it is wasted. The console, the CLI and the API are the same on both, and so are the SDK and the manual. What changes is whose machine it runs on.
- How do I get rid of it?
- docker compose down -v. The -v flag deletes the database volume and every account and conversation in it. If you keep the volume instead, keep the same MASTER_SECRETS_KEY with it, because a new key cannot unwrap what the old one wrapped.
- How much of an instance is one person?
- A container, a Postgres and a sandbox token. It ships with a compose file that brings the database with it, and plain Kubernetes manifests for when it outgrows that.
Still holding a question?
The manual answers in more depth than a page like this can, and the server it describes is open source, so the last word is always the code.