SharetoBoardPython 3.10+
The v0.3.0 candidate package requires Python 3.10 or newer.
MCP server, first-party skills, and release status.
The v0.3.0 candidate preserves six Poppy MCP tools and adds four first-party skills, a stdio-only release CLI, stronger request controls, client examples, tests, packaging, and security manuals.
Requirements
Your own Poppy access
Tentaclaw requires a Poppy subscription and Poppy API key. Poppy controls API access, provider credits, and account policy.
An MCP-capable host
The default path expects a client or agent runtime that can spawn a local MCP stdio server.
First-party skills
Skills teach the agent when and how to use Tentaclaw. They never contain the Poppy key and never make direct Poppy HTTP requests.
tentaclaw-setup
Safe installation, diagnosis, rotation, incident response, and migration.
poppy-operator
Core board/chat resolution, bounded questions, conversation control, and fail-closed behavior.
poppy-board-research
Focused, source-aware research from one explicitly approved destination.
poppy-content-workflow
Brainstorm, create, and rewrite workflows that always return a draft for human review.
Tool reference
| Tool | Purpose | Primary inputs |
|---|---|---|
tentaclaw_version | Return the running Tentaclaw version. | None |
poppy_get_boards | List boards available to the configured Poppy API key. | None |
poppy_get_chats | List chat assistants for a board. | board_id |
poppy_create_conversation | Create a conversation thread for a board and chat assistant. | board_id, chat_id, optional name |
poppy_ask | Ask a one-time question without a conversation thread. | board_id, chat_id, prompt; optional model/context/format flags |
poppy_chat | Continue an existing conversation. | conversation_id, board_id, chat_id, prompt; optional history/context fields |
Documented Poppy API boundary: Tentaclaw does not currently expose arbitrary visual-node creation, node connection, chatbot publishing, customer-account governance, or billing controls.
Secret and endpoint configuration
The current implementation supports a Poppy key file as the preferred path and an environment variable as fallback.
Preferred
Point POPPY_API_KEY_FILE at a file readable only by the user running the MCP host. On POSIX systems, Tentaclaw checks strict file permissions.
Fallback
Set POPPY_API_KEY in the process environment. Avoid putting the key in source, committed configuration, prompts, logs, or shell history.
Routing guard: POPPY_BASE_URL is HTTPS-only and host-allowlisted by default. A key file remains plaintext protected by filesystem permissions; use stronger secret storage when available.
Release transport
stdio
No inbound port, reverse proxy, or browser origin is required. This is the default and the preferred local-agent deployment.
Remote HTTP
The v0.3.0 release CLI does not expose HTTP. Any future remote mode requires a separately authenticated, TLS-protected, reviewed gateway and must not expose raw Tentaclaw directly.
Do not improvise public exposure. Local stdio is the release path. Remote governance belongs to a separately designed gateway/API Conduit boundary.
Configuration check
tentaclaw-mcp --doctor
The candidate doctor command loads the configured secret and endpoint, then performs a live GET /api/boards request. Release acceptance requires a safe summary that does not print board content. Success proves connectivity only—not all six tools or a specific MCP client workflow.
Client compatibility status
| Environment | Current statement |
|---|---|
| Codex | Candidate configuration exists; end-to-end acceptance evidence remains open. |
| Hermes Agent | Designed for MCP-compatible use; Tentaclaw-specific acceptance evidence remains open. |
| OpenClaw | Candidate configuration exists; end-to-end release acceptance remains open. |
| Claude Desktop / Code | Candidate desktop configuration exists; use only the exact surface validated during release testing. |
Remaining release gates
- Complete final review. The source archive, four-skill catalogue, client setup guides, documentation, and hardened code are prepared for release review.
- Keep automated checks green. The current release candidate passes code-quality checks, 24 tests on Python 3.10-3.12, clean-install and package checks, the production dependency audit, reproducible skill packaging, software-bill-of-materials generation, and checksum verification.
- Run live Poppy acceptance. Exercise all six tools against a dedicated disposable board/chat and record redacted evidence.
- Validate clients one by one. Record Codex, OpenClaw, Claude, then Hermes or any additional client only after its real run.
- Publish deliberately. Merge, tag, publish the canonical repository and artifacts, and make only claims unlocked by the evidence.