Local stdio client setup

Connect Tentaclaw to your MCP client.

Tentaclaw runs locally, and your client configuration contains only the path to the protected key file—not the key itself.

Overview Install Skills Clients Testing status

Codex

Current Codex clients use config.toml for local MCP servers rather than a generic cross-client JSON file. User config is normally ~/.codex/config.toml; trusted projects may use .codex/config.toml.

[mcp_servers.tentaclaw]
command = "/absolute/path/to/tentaclaw-mcp"
args = []
required = true
default_tools_approval_mode = "writes"

[mcp_servers.tentaclaw.env]
POPPY_API_KEY_FILE = "/absolute/path/to/poppy_api_key"

Restart the client, use /mcp or the MCP settings surface to confirm the server, call tentaclaw_version, then run the disposable canary workflow. The path is not secret; the file contents are.

Claude Code and Claude Desktop

Claude Code supports a local stdio server through its MCP CLI or .mcp.json. Use user scope for a private machine-level setup unless a reviewed team configuration is intended.

claude mcp add tentaclaw --scope user \
  --env POPPY_API_KEY_FILE=/absolute/path/to/poppy_api_key \
  -- /absolute/path/to/tentaclaw-mcp

Claude Desktop uses an mcpServers JSON entry with command, args, and env. Never place the key value in env; set only POPPY_API_KEY_FILE to the protected file path.

OpenClaw

Use OpenClaw's managed outbound MCP registry—not openclaw mcp serve, which makes OpenClaw itself the server. Current OpenClaw provides mcp add, status, doctor, and probe operations for third-party servers.

{
  "mcp": {
    "servers": {
      "tentaclaw": {
        "command": "/absolute/path/to/tentaclaw-mcp",
        "args": [],
        "env": {
          "POPPY_API_KEY_FILE": "/absolute/path/to/poppy_api_key"
        }
      }
    }
  }
}

Run openclaw mcp status --verbose, then doctor and probe for the registered server before an agent turn. The exact candidate registry file/CLI command still needs release-client validation.

Hermes Agent

Hermes supports local stdio MCP servers in ~/.hermes/config.yaml. Configure only the key-file path in the child environment.

mcp_servers:
  tentaclaw:
    command: "/absolute/path/to/tentaclaw-mcp"
    args: []
    env:
      POPPY_API_KEY_FILE: "/absolute/path/to/poppy_api_key"
    timeout: 60
    connect_timeout: 30

Restart or reload MCP according to the current Hermes client, inspect discovered tools, then run the disposable canary. Hermes acceptance is planned and must not be represented as complete yet.

Client testing status

Client	Configuration guide	End-to-end Tentaclaw + Poppy test
Codex	Available: TOML / client UI	In progress
Claude Code/Desktop	Available: CLI / JSON	In progress
OpenClaw	Available: managed MCP registry	In progress
Hermes Agent	Available: YAML	In progress

Per-client evidence required

Client name and exact version
Operating system and Python version
Sanitized configuration with path placeholders
Successful stdio startup and six discovered tools
Version, boards, chats, ask, create conversation, and chat results on a disposable destination
Negative tests for missing key, denied destination, malformed response, and prompt injection
Confirmation that the raw key was never visible to the agent or captured in evidence