SharetoBoardProtected assets
- Account-wide Poppy API key
- Private board/chat/conversation content and identifiers
- Poppy credits and conversation integrity
- Local board/chat allowlist
- Local configuration and audit metadata
TentaClaw local security and incident manual.
Protect the account-wide Poppy credential on the user’s computer, approve exact destinations, minimize content, treat returned material as untrusted, and keep the MCP boundary local.
Local-only invariant: TentaClaw has no MCP HTTP listener, public URL, OAuth layer, tunnel, proxy, container deployment, VPS, or cloud-service path.
Assets and local trust boundaries
Boundaries
- Human ↔ local MCP client
- Local MCP client ↔ TentaClaw child process over
stdio - TentaClaw ↔ current user’s protected files
- TentaClaw ↔ Poppy over fixed-host HTTPS
- Poppy output ↔ model/user as untrusted data
No inbound network trust boundary exists because TentaClaw opens no listener.
Primary threats and controls
| Threat | Primary control | Residual risk |
|---|---|---|
| Credential enters model or transcript | Hidden init input, separate owner-protected key file, no key or key path in client configuration | A compromised local user/client can access local process or files |
| Unsafe key/config file | POSIX symlink, type, owner, mode, and size checks; Windows setup applies an owner-only ACL | Administrator/root or later ACL changes |
| Wrong board or chat | Guided explicit selection, fail-closed allowlists, filtered discovery | User can deliberately approve broad access |
| Redirect or destination substitution | HTTPS origin validation, exact host allowlist, redirect denial, fixed API paths | Trusted upstream compromise |
| Credit/state duplication | Poppy POST operations are never retried automatically; tools are marked non-read-only | User/client can intentionally repeat a call |
| Prompt injection in Poppy content | Skills treat output as data and forbid operational obedience | Model may still mishandle persuasive content |
| Oversized/slow response | Request/response limits, streaming response cap, timeout, GET-only bounded retries | Upstream work can occur before the cap is observed |
| Sensitive logging | Metadata-only audit events, generic errors, recursive credential redaction | The local MCP client controls its own transcript/log behavior |
Local credential and policy files
poppy_api_key
Contains only the Poppy key. tentaclaw-mcp init writes it after live validation and protects it for the current user.
config.json
Contains non-secret settings and explicit approved destination IDs. New destinations remain denied until setup is rerun.
Never: paste the key into chat; put it in a skill, source file, command argument, client JSON/TOML/YAML, URL, screenshot, support ticket, or ordinary log; ask the agent to read the key file.
Data handling
- TentaClaw does not persist prompt or Poppy-response bodies by default.
- Normal audit events contain destination host, method, sanitized API path, status, outcome, and latency—not keys, prompts, responses, names, or conversation IDs.
- The local MCP client may independently retain tool payloads; review its transcript and logging settings.
- Send the minimum required
additional_context. - Poppy receives the request and applies its own service, retention, usage, credit, and account policies.
Suspected exposure response
- Stop the local client. This stops its TentaClaw child process.
- Rotate at Poppy. Revoke/reissue the Poppy key; moving the same exposed value is not remediation.
- Remove exposed copies. Sanitize chat exports, workspace files, shell history, logs, screenshots, and source-control entries using each platform’s procedure.
- Review scope. Determine which approved/account-visible destinations, credits, and conversations may have been affected.
- Reconfigure locally. Run
tentaclaw-mcp initwith the replacement key and explicit policy. - Retest. Run
status,doctor, and a disposable six-tool canary before returning to production data. - Report product defects safely. Email security@sharetoboard.com without the key or private content.
Security non-claims
- TentaClaw cannot protect against an administrator/root account or compromised local MCP client with arbitrary local access.
- Skills do not make Poppy-returned content trustworthy.
- The Poppy key remains account-wide because upstream TentaClaw-specific scopes are unavailable.
- Automated tests do not prove every live Poppy behavior or exact-client write-approval path; only recorded live evidence may be claimed.
- No public certification or external audit is claimed.