Scope and evidence: this article is based on a static review of one supplied, unversioned, instruction-only integration artifact. We did not use a real credential, make a live provider request, demonstrate exploitation, or establish that a breach occurred. The product and vendor remain unnamed because the architectural lesson is broader than one implementation.

The pattern we reviewed

The artifact asked a user to provide a credential-bearing value through an agent conversation, retain the reusable account credential in agent-accessible state, and later build direct command-line API requests with it.

Telling the agent not to reveal the credential did not create an enforceable boundary. Once a model, its tools, workspace, or shell can read the secret, every prompt, imported document, tool invocation, debug path, transcript, and extension in that environment becomes part of the exposure surface.

The invariant

We chose one falsifiable rule: the local AI client and its skills must be able to request approved Poppy operations without receiving the account-wide Poppy API key.

A prompt cannot revoke authority that its process already has. We needed a local child process outside the agent-visible instruction layer to own the protected key and expose only narrow capabilities.

The local boundary

TentaClaw is a local-only MCP server. A supported client starts it as a child process over stdio. TentaClaw reads the key from an owner-protected per-user file, applies explicit board/chat policy, makes fixed-host HTTPS requests to Poppy, and returns a structured result.

The client receives six named operations rather than arbitrary API authority. Its configuration contains only the local executable command. It contains no key, key-file path, URL, port, OAuth configuration, or hosted endpoint.

Why it is not a hosted gateway

The route name for this article is historical; the active product is not a remote gateway. TentaClaw opens no MCP network listener and includes no HTTP transport, OAuth server, bearer-token layer, domain, tunnel, reverse proxy, Docker deployment, VPS/cloud setup, or managed remote offering.

That is deliberate. Local clients that can launch a process are the supported architecture. Browser-only products that cannot start a local child process are outside this release instead of being supported through a second hidden product.

The skills still matter

Skills provide operating discipline. The local TentaClaw process provides the credential and execution boundary.

Controls that follow from the design

What this does not solve

A local process boundary is not magic. A user, administrator, malware, or compromised MCP client with arbitrary access to the current account can still read files or inspect processes. Retrieved board content can still contain prompt injection. Poppy still applies its own retention, usage, credits, and account policies. A client can misuse every tool it is allowed to call.

Where TentaClaw stands today

The 0.3.0rc13 private beta candidate includes guided local setup, exact destination policy, guarded client configuration, and six focused tools. Core packaging, security, and cross-platform qualification have passed.

Live-client and clean-machine testing continue before wider release. Approved testers receive the checksum-bound candidate privately.

Read the technical operating modelOpen the security manualCheck current evidence