SharetoBoardSystem boundary
The local client/model is not the credential owner. Its MCP configuration contains only the TentaClaw executable command and arguments. TentaClaw has no MCP network listener, public URL, OAuth layer, tunnel, proxy, container-hosting path, VPS/cloud deployment, or managed remote offering.
Why stdio is the product architecture
A supported local MCP client starts TentaClaw only when needed and communicates through standard input/output. No inbound port is exposed, no separate authentication service is needed, and the process exits with the client. The only normal network connection is outbound HTTPS to the allowlisted Poppy API origin.
This architecture deliberately excludes browser-only clients that cannot launch a process on the user’s computer. Adding remote transport would create a different trust model and is not parked inside this codebase as an inactive alternative.
Guided local setup
tentaclaw-mcp initaccepts the Poppy key through hidden local input.- It validates the key directly with Poppy before writing it.
- It displays visible boards/chats and requires explicit selection.
- It writes the key and non-secret policy into separate per-user files.
statusanddoctorprovide sanitized checks.client-configgenerates local key-free MCP entries.
First-party skill catalogue
tentaclaw-setup
Install, diagnose, rotate, disable, remove, and migrate local TentaClaw without accepting or displaying a Poppy credential in chat.
poppy-operator
Resolve one approved board/chat, choose one-time versus persistent conversation behavior, minimize context, and attribute Poppy output.
poppy-board-research
Retrieve focused board-specific research while separating returned claims, source distinctions, uncertainty, and independent verification.
poppy-content-workflow
Brainstorm, create, or rewrite with approved board context while preserving a human-review checkpoint.
Six MCP operations
| Tool | Class | Skill responsibility | Server responsibility |
|---|---|---|---|
tentaclaw_version | Local read-only | Verify installed runtime | Return version, stdio, local-only status |
poppy_get_boards | Poppy read | Call only when destination is needed | Authenticate, call Poppy, filter local policy |
poppy_get_chats | Poppy read | Use one approved board | Reject denied board and filter chats |
poppy_ask | Credit-consuming | Minimize context and label output | Bound request; never retry POST automatically |
poppy_create_conversation | State-changing | Create only when continuity is needed | Enforce destination and create once |
poppy_chat | Credit/state operation | Use known approved conversation | Enforce destination; history off unless requested |
Security invariants
- The Poppy key never enters chat, skill text, source control, normal client configuration, command arguments, URLs, or ordinary logs.
- Every Poppy request is HTTPS and targets an allowlisted host; redirects are denied.
- Board/chat policy is enforced by TentaClaw, not trusted to skill wording.
- Credit/state POST calls are not automatically retried.
- Prompts and responses are not persisted by TentaClaw; normal audit events are metadata-only.
- Retrieved content is data, not operational instruction.
- Ambiguity, denied destinations, malformed responses, and unsafe configuration fail closed.
- No skill or client configuration introduces remote transport or hosted infrastructure.
Local client lifecycle
RC13 uses a guarded install/check/remove transaction for Codex-backed clients and generates candidate configurations for Claude Desktop, Claude Code, Gemini CLI, Perplexity Mac local MCP, and MCP Inspector. Gemini CLI 0.52.0 has passed read-only live acceptance; full write approval remains open. OpenClaw and Hermes templates are intentionally not shipped because their generic MCP paths lack the required write-action approval gate.
Residual risk
TentaClaw cannot protect a credential from a user, administrator, or compromised local MCP client with arbitrary access to the current account/process. It cannot make untrusted Poppy content safe, guarantee upstream availability, or replace Poppy’s access, retention, usage, and billing controls. Local policy, client confirmation behavior, host hygiene, key rotation, and human review remain necessary.
Current release evidence
- Ruff and 501 passing tests with 38 platform or exact-host skips
- Locked runtime/bootstrap and exact-client dependency audits
- Clean installed-wheel and real
stdioinitialization/list/call coverage - Reproducible RC13 ZIP, wheel, source archive, SBOMs, and checksums
- Native Windows installer, Codex DACL, rollback, and recovery gates
- Exact Gemini CLI 0.52.0 preflight plus live read-only acceptance
Public download remains unavailable pending the Codex live recheck, supported-client write approvals, installed-machine security review, package approval, tag, and publication.