4 ms·

NanoClaw Adopts OneCLI Agent Vault

algolint 7mo ago
[flagged]
_pdp_ 7mo ago
From a security standpoint, I'm glad that people are starting to pay attention to basic security practices. That said, while I'm hardly a fan of MCP (judge for yourself by reviewing my previous comments on the matter), at least its security model was standardised around OAuth, which in my opinion is a good thing, albeit with a few small issues. I personally prefer CLIs, but their security is in fact worse. A lot worse! Sure, we can now store API keys in a vault, but it's not like you can rotate or expire them easily. Plus, the security model around APIs is based on path-based rules, which aren't very effective given that most services use REST-style APIs. This is even worse for GraphQL, JSON-RPC, and similar protocols. It is backwards. I bet we will move from CLIs to something else in about 3-6 months.
- rvz 7mo ago
  What this appears to be is that we are now reinventing proxies with policy control and the best part of this is the solution (OneCLI) has no security audit. This would give a complete dismissal from the infosec teams to even attempt integrating this vibe-coded slop. As long as the fake keys are known, they can be mapped directly to the real key with the endpoint in OneCLI to exfiltrate the data and you don't need to leak any keys anyway. The correct solution is that there should be no sort of keys in the VM / Container in the first place. > It is backwards. I bet we will move from CLIs to something else in about 3-6 months. The hype around CLIs is just as unfounded as was MCPs and made no-sense just like OpenClaw did. Other than hosting providers almost no-one is making money from OpenClaw and from its use-cases; which is just wasting tokens. We'll move on to the next shiny vibe-coded thing because someone else on X said so.
- AnDaltan 7mo ago
  Yeah, I think that’s broadly right. MCP has plenty of problems, but standardising on OAuth was one of the better calls. Expiry, scopes, rotation, delegated access, all much better than the usual CLI pattern of long-lived API keys. The CLI story there is still pretty rough. And once the policy model is host/path matching, GraphQL and JSON-RPC become awkward immediately unless the proxy starts understanding payload semantics.
- ianpurton 7mo ago
  > I bet we will move from CLIs to something else in about 3-6 months. My bet would be OpenAPI specs. The model will think its calling a cli but we intercept the tool call and proxy it with the oauth credentials. There are some implementations already out there in open web ui and bionic gpt.
jryio 7mo ago
Nice upgrade. userpsace HTTP proxies are a good start and should make unlikely that a secret gets into the context window due to a high permission read. There are a few missing pieces in the agent security world in general 1. Full secret-memory isolation whereby an agent with root privileges can't exfilrate. Let's assume my agent is prompt injected to write a full-permissions script to spin up OneCli, modify the docker container, log all of the requests w/ secrets to a file outside the container, exfiltrate. 2. An intent layer on top of agents that models "you have access to my gmail (authN) but you can only act on emails where you are a participant". This would be more similar to universal RBAC between agent ↔ mcp etc. I've been building on [2] for a while now using signed tokens expressing intent.
- Jonathanfishner 7mo ago
  Creator of OneCLI here. On (1), the agent runs in its own container where OneCLI doesn't exist. It can't spin up OneCLI or access its process because it's completely isolated from it. The agent only ever sees placeholder tokens, the real secrets live in a separate container it has no way to reach. On (2), we actually address this with OneCLI Rules, deterministic constraints enforced at the proxy level before a request ever hits the API. So the agent doesn't need to "behave", it just can't do what the rules don't allow. Would love to hear more about your signed tokens approach.
- throwaway27727 7mo ago
  At a basic levels, access layers should be aware of operations that are Read-only and operations that are Write/Delete. It should be easy to give agents access to read anything, then require permission/prompt to execute any state changing operations.
gdorsi 7mo ago
Interesting! I still wouldn't give to any claw access to my mail accounts, but it is a step in the good direction. I love how NanoClaw is aggregating the effort of making personal assistants more secure. Good job!
- falcor84 7mo ago
  I don't get the idea of giving a claw access to your own mail account, but am now playing with the idea of it having its own email account that I selectively forward to - that offers almost the full benefit, with significantly less risk.
  - crimsoneer 7mo ago
    yeah, that's the approach I've taken. I quite liked the idea of giving it full delegated perms on my email account and calendar (eg, dig out that email and reply back to them for me) but the risk profile is just too high, and forwarding emails where needed mostly works.
  - vannevar 7mo ago
    Same here. Coupled with configuring the agent's email account at the provider to only be able to send and receive to my email address.
  - sayYayToLife 7mo ago
    [dead]
ting0 7mo ago
I really don't understand the fascination with openclaw. Can only assume it's mostly just guerrilla marketing spam.
- sigmonsays 7mo ago
  can someone explain openclaw/nanoclaw use cases to me? I also do not understand the uses right now. Are we just grasping at usefulness ?
  - gavmor 7mo ago
    It's a mess in terms of code/filesystem organization, but it's nice to be able to text somebody "hey, create and deploy a branch of codebase X with feature Y" while I'm on the go. Not exactly magic, and probably not sustainable, but there's definitely something to it. Also, attaching an LLM with my raindrop.io and Todoist credentials to cron is fun. Haven't got the kinks worked out, yet, but it's pretty incredible how much data-shifting I can do now. Saved me a lot of clicks.
  - kevin42 7mo ago
    Most things I use it for could be done without it, it's just more convenient and entertaining. I had it make a daily aviation weather brief for a private airpark. It uses METAR, outdoor IP cameras I have including one that looks at a windsock and another that looks at the runway surface, and a local weatherstation. It sends me a text message with all of that information aggregated into "It's going to be really windy this afternoon, visibility is high, but there is ice on the runway surface", that sort of thing. The thing is, all I had to do is point it to a few endpoints and it wrote the entire script and set up a cron for me. I just gave it a few paragraphs of instructions and it wrote, then deployed the rest. The other day, there was a post here about a new TTS model. I wanted to try it out, so I gave my claw the github URL, and it pulled everything down and had it running without any effort on my part. Then it sent me a few audio messages on discord to try. When I'm away from home, I can text it to say "what's going on at home" and it will turn on the lights around the house, grab a frame from each camera turn lights back off, and give me a quick report. I didn't have to do any work other than tell it I wanted that skill. I also have a group chat with some friends on signal that's hilarious. It roasts us, gives us reminders, lets us know about books we might be interested in, that sort of thing. It's really fun.
AnDaltan 7mo ago
[dead]
dist-epoch 7mo ago
> You can set rate limits so an agent can only send or delete a few emails per hour Nice idea, but it will not work. Agents are so resourceful and determined, they will find that weird call which can delete all emails with one request (/delete?filter=*)
jameschaearley 7mo ago
Since the vault sees every outbound request with the real credential attached, are you logging all of that? Feels like you're sitting on a full audit trail of everything agents actually did across services. That would be huge for debugging agent behavior after the fact.
croes 7mo ago
The main problem still isn’t solved. It’s not that agents have access to something the shouldn’t have but that the creates havoc exactly with the access they are allowed to have.
- strongpigeon 7mo ago
  OneCLI doesn't solve the problem of the agent wrecking havoc, you're right, but it does help protect against the agent leaking private credentials from prompt injections / malicious skills.
mmcclure 7mo ago
I'm a little shocked that someone like 1Password hasn't released a vault access + approvals model. There are a lot of little menial tasks that I'd love for an agent to take care of ("book me a hair appointment next week when my calendar says I'm free"). Agent has access to a locally synced calendar and can see the existence of a password for the booking portal in my vault, asks to use it, I get a push notification and can approve. These kinds of things aren't common enough for me to want to set up a programmatic policy, and are also low sensitivity enough that I don't mind giving access to complete the task. If it later asks to log into my bank, I decline. I know the devil's in the details for how to actually do this well, but I would love if someone figured it out.
BrandiATMuhkuh 7mo ago
I'm curious how you manage https. If OneCLI intercepts all traffic from the agent (harness/tools/...) and then replaces parts with other data, it should break https. Or is that a man in the middle "attack". And users have to install a certificate?

[flagged]

_pdp_ 7mo ago

From a security standpoint, I'm glad that people are starting to pay attention to basic security practices. That said, while I'm hardly a fan of MCP (judge for yourself by reviewing my previous comments on the matter), at least its security model was standardised around OAuth, which in my opinion is a good thing, albeit with a few small issues. I personally prefer CLIs, but their security is in fact worse. A lot worse! Sure, we can now store API keys in a vault, but it's not like you can rotate or expire them easily. Plus, the security model around APIs is based on path-based rules, which aren't very effective given that most services use REST-style APIs. This is even worse for GraphQL, JSON-RPC, and similar protocols. It is backwards. I bet we will move from CLIs to something else in about 3-6 months.

rvz 7mo ago
What this appears to be is that we are now reinventing proxies with policy control and the best part of this is the solution (OneCLI) has no security audit. This would give a complete dismissal from the infosec teams to even attempt integrating this vibe-coded slop. As long as the fake keys are known, they can be mapped directly to the real key with the endpoint in OneCLI to exfiltrate the data and you don't need to leak any keys anyway. The correct solution is that there should be no sort of keys in the VM / Container in the first place. > It is backwards. I bet we will move from CLIs to something else in about 3-6 months. The hype around CLIs is just as unfounded as was MCPs and made no-sense just like OpenClaw did. Other than hosting providers almost no-one is making money from OpenClaw and from its use-cases; which is just wasting tokens. We'll move on to the next shiny vibe-coded thing because someone else on X said so.
AnDaltan 7mo ago
Yeah, I think that’s broadly right. MCP has plenty of problems, but standardising on OAuth was one of the better calls. Expiry, scopes, rotation, delegated access, all much better than the usual CLI pattern of long-lived API keys. The CLI story there is still pretty rough. And once the policy model is host/path matching, GraphQL and JSON-RPC become awkward immediately unless the proxy starts understanding payload semantics.
ianpurton 7mo ago
> I bet we will move from CLIs to something else in about 3-6 months. My bet would be OpenAPI specs. The model will think its calling a cli but we intercept the tool call and proxy it with the oauth credentials. There are some implementations already out there in open web ui and bionic gpt.

jryio 7mo ago

Nice upgrade. userpsace HTTP proxies are a good start and should make unlikely that a secret gets into the context window due to a high permission read. There are a few missing pieces in the agent security world in general 1. Full secret-memory isolation whereby an agent with root privileges can't exfilrate. Let's assume my agent is prompt injected to write a full-permissions script to spin up OneCli, modify the docker container, log all of the requests w/ secrets to a file outside the container, exfiltrate. 2. An intent layer on top of agents that models "you have access to my gmail (authN) but you can only act on emails where you are a participant". This would be more similar to universal RBAC between agent ↔ mcp etc. I've been building on [2] for a while now using signed tokens expressing intent.

Jonathanfishner 7mo ago
Creator of OneCLI here. On (1), the agent runs in its own container where OneCLI doesn't exist. It can't spin up OneCLI or access its process because it's completely isolated from it. The agent only ever sees placeholder tokens, the real secrets live in a separate container it has no way to reach. On (2), we actually address this with OneCLI Rules, deterministic constraints enforced at the proxy level before a request ever hits the API. So the agent doesn't need to "behave", it just can't do what the rules don't allow. Would love to hear more about your signed tokens approach.
throwaway27727 7mo ago
At a basic levels, access layers should be aware of operations that are Read-only and operations that are Write/Delete. It should be easy to give agents access to read anything, then require permission/prompt to execute any state changing operations.

gdorsi 7mo ago

Interesting! I still wouldn't give to any claw access to my mail accounts, but it is a step in the good direction. I love how NanoClaw is aggregating the effort of making personal assistants more secure. Good job!

falcor84 7mo ago
I don't get the idea of giving a claw access to your own mail account, but am now playing with the idea of it having its own email account that I selectively forward to - that offers almost the full benefit, with significantly less risk.
- crimsoneer 7mo ago
  yeah, that's the approach I've taken. I quite liked the idea of giving it full delegated perms on my email account and calendar (eg, dig out that email and reply back to them for me) but the risk profile is just too high, and forwarding emails where needed mostly works.
- vannevar 7mo ago
  Same here. Coupled with configuring the agent's email account at the provider to only be able to send and receive to my email address.
- sayYayToLife 7mo ago
  [dead]

ting0 7mo ago

I really don't understand the fascination with openclaw. Can only assume it's mostly just guerrilla marketing spam.

sigmonsays 7mo ago
can someone explain openclaw/nanoclaw use cases to me? I also do not understand the uses right now. Are we just grasping at usefulness ?
- gavmor 7mo ago
  It's a mess in terms of code/filesystem organization, but it's nice to be able to text somebody "hey, create and deploy a branch of codebase X with feature Y" while I'm on the go. Not exactly magic, and probably not sustainable, but there's definitely something to it. Also, attaching an LLM with my raindrop.io and Todoist credentials to cron is fun. Haven't got the kinks worked out, yet, but it's pretty incredible how much data-shifting I can do now. Saved me a lot of clicks.
- kevin42 7mo ago
  Most things I use it for could be done without it, it's just more convenient and entertaining. I had it make a daily aviation weather brief for a private airpark. It uses METAR, outdoor IP cameras I have including one that looks at a windsock and another that looks at the runway surface, and a local weatherstation. It sends me a text message with all of that information aggregated into "It's going to be really windy this afternoon, visibility is high, but there is ice on the runway surface", that sort of thing. The thing is, all I had to do is point it to a few endpoints and it wrote the entire script and set up a cron for me. I just gave it a few paragraphs of instructions and it wrote, then deployed the rest. The other day, there was a post here about a new TTS model. I wanted to try it out, so I gave my claw the github URL, and it pulled everything down and had it running without any effort on my part. Then it sent me a few audio messages on discord to try. When I'm away from home, I can text it to say "what's going on at home" and it will turn on the lights around the house, grab a frame from each camera turn lights back off, and give me a quick report. I didn't have to do any work other than tell it I wanted that skill. I also have a group chat with some friends on signal that's hilarious. It roasts us, gives us reminders, lets us know about books we might be interested in, that sort of thing. It's really fun.

AnDaltan 7mo ago

[dead]

dist-epoch 7mo ago

> You can set rate limits so an agent can only send or delete a few emails per hour Nice idea, but it will not work. Agents are so resourceful and determined, they will find that weird call which can delete all emails with one request (/delete?filter=*)

jameschaearley 7mo ago

Since the vault sees every outbound request with the real credential attached, are you logging all of that? Feels like you're sitting on a full audit trail of everything agents actually did across services. That would be huge for debugging agent behavior after the fact.

croes 7mo ago

The main problem still isn’t solved. It’s not that agents have access to something the shouldn’t have but that the creates havoc exactly with the access they are allowed to have.

strongpigeon 7mo ago
OneCLI doesn't solve the problem of the agent wrecking havoc, you're right, but it does help protect against the agent leaking private credentials from prompt injections / malicious skills.

mmcclure 7mo ago

I'm a little shocked that someone like 1Password hasn't released a vault access + approvals model. There are a lot of little menial tasks that I'd love for an agent to take care of ("book me a hair appointment next week when my calendar says I'm free"). Agent has access to a locally synced calendar and can see the existence of a password for the booking portal in my vault, asks to use it, I get a push notification and can approve. These kinds of things aren't common enough for me to want to set up a programmatic policy, and are also low sensitivity enough that I don't mind giving access to complete the task. If it later asks to log into my bank, I decline. I know the devil's in the details for how to actually do this well, but I would love if someone figured it out.

BrandiATMuhkuh 7mo ago

I'm curious how you manage https. If OneCLI intercepts all traffic from the agent (harness/tools/...) and then replaces parts with other data, it should break https. Or is that a man in the middle "attack". And users have to install a certificate?