Install TentaClaw on the same computer as your MCP client.

Before installation

• Use Python 3.10 through 3.13.
• Obtain tentaclaw-mcp-0.3.0rc13-release.zip and its matching .sha256 file from the same authorized candidate release.
• Create a disposable Poppy board and chat for the first test.
• Keep the Poppy key in a password manager until the local setup wizard asks for it through hidden input.
• Do not paste a key, credential URL, private identifier, or key-file content into an AI conversation.

1. Verify and run the bundled installer

Windows PowerShell

$Expected = (Get-Content .\tentaclaw-mcp-0.3.0rc13-release.zip.sha256).Split()[0].ToLower()
$Actual = (Get-FileHash .\tentaclaw-mcp-0.3.0rc13-release.zip -Algorithm SHA256).Hash.ToLower()
if ($Actual -ne $Expected) { throw "TentaClaw release checksum mismatch" }
Expand-Archive .\tentaclaw-mcp-0.3.0rc13-release.zip .\tentaclaw-0.3.0rc13
cd .\tentaclaw-0.3.0rc13
& .\scripts\install-local.ps1

Linux

sha256sum --check tentaclaw-mcp-0.3.0rc13-release.zip.sha256
unzip tentaclaw-mcp-0.3.0rc13-release.zip -d tentaclaw-0.3.0rc13
cd tentaclaw-0.3.0rc13
sh ./scripts/install-local.sh

macOS

expected=$(awk '{print $1}' tentaclaw-mcp-0.3.0rc13-release.zip.sha256)
actual=$(shasum -a 256 tentaclaw-mcp-0.3.0rc13-release.zip | awk '{print $1}')
test "$actual" = "$expected" || { echo "TentaClaw release checksum mismatch" >&2; exit 1; }
unzip tentaclaw-mcp-0.3.0rc13-release.zip -d tentaclaw-0.3.0rc13
cd tentaclaw-0.3.0rc13
sh ./scripts/install-local.sh

Close and reopen the terminal if the installer updates PATH, then run tentaclaw-mcp --version and confirm 0.3.0rc13.

2. Run the guided local setup

tentaclaw-mcp init

1. TentaClaw prints the per-user config and key-file locations.
2. Paste the Poppy key at the hidden terminal prompt. It is not displayed.
3. TentaClaw validates the key directly against Poppy before writing it.
4. Select one or more visible boards by number.
5. Select one or more chats by number.
6. TentaClaw writes an owner-protected key file and a separate non-secret policy file.

3. Understand the local files

The MCP client configuration contains neither the key value nor the key-file path.

4. Verify local setup

tentaclaw-mcp status
tentaclaw-mcp doctor

status prints sanitized local state: local-only transport, key-file validity, approved destination counts, and limits. doctor validates the configuration/key and checks whether the approved Poppy destinations remain visible.

5. Connect a local client

Codex CLI, Codex IDE, or the same local Codex host

tentaclaw-mcp codex-config install
tentaclaw-mcp codex-config check

Do not manually merge the reference TOML. RC13 preserves Codex-added non-empty cwd and boolean enabled = true, migrates an exact RC6 entry, and still rejects disabled, malformed, or policy-altering entries.

Other candidate clients

tentaclaw-mcp client-config claude-desktop
tentaclaw-mcp client-config claude-code
tentaclaw-mcp client-config gemini-cli
tentaclaw-mcp client-config perplexity-mac
tentaclaw-mcp client-config inspector

Open all client instructions and acceptance status →

6. Run the disposable acceptance test

1. Call tentaclaw_version and confirm transport: stdio and local_only: true.
2. Call boards and chats; only approved destinations should appear.
3. Approve one harmless poppy_ask call.
4. Create and continue a disposable conversation with save_history=false.
5. Try an unapproved fake board/chat and confirm policy_denied.
6. Inspect TentaClaw and client logs for keys or private payloads.

Change destinations or rotate the key

Run tentaclaw-mcp init again. Reuse the protected key when it remains valid, or enter a replacement key through hidden input. Complete discovery and run doctor before revoking the old key.

Remove TentaClaw

1. For a Codex-backed client, close it and run tentaclaw-mcp codex-config remove; for another client, remove only its TentaClaw entry.
2. Follow the removal script or instructions included in the exact verified release bundle.
3. Delete the per-user TentaClaw config directory only when you also intend to remove the local key and policy.
4. Revoke the Poppy key when it will no longer be used.