mike-cardwell

So MCP is useful until cheap models get better?

I just run claude's cli tool?

I gave claude an API key for Home Assistant. I can tell it to create dashboards, set up automations, diagnose problems etc, all using natural language. No MCP needed.

Yesterday I received a new thermometer for my aquarium to replace an old broken one. Both were bluetooth, but different models. I just told claude "I'm going to set up up my new bluetooth thermometer for my fish tank in a few minutes, keep an eye out for it and replace the old broken one with it in Home Assistant" and then walked away and put a battery in it and put it in my aquarium.

When I came back it had found it, replaced all my existing entities for the broken one with the new one, and verified it was all working with my existing graphs and automations.

I turned this on a few days ago. Looking good so far (UK)

Also, if your domain doesn't receive mail, set up a null mx record:

  @ IN MX 0 .

https://datatracker.ietf.org/doc/rfc7505/

That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt...

They don't seem to know or care what is going on with their own email systems.

The text is added to get around bayesian filters. The spammer doesn't want the text to be displayed to the end user though typically.

I spend a lot of time telling Opus 4.8 to search for security bugs in the code it wrote, and it spends a lot of time finding them, and then fixing them. Fable wont let me fix the security issues that Opus 4.8 created.

https://gitlab.com/grepular/calendiff - Point it at a .ics URL and it monitors for calendar changes and emails you about them.

https://gitlab.com/grepular/foxcage - Runs Firefox inside podman to isolate it from the host. Has some interesting features that I wanted and nothing else gave me.

https://gitlab.com/grepular/claude-sandbox - Yet another Claude sandbox. Runs it inside podman again. Has a pretty powerful proxy system for securing your credentials.

Currently working on a tool for sanitising email. Will be blogging it up at https://www.grepular.com/blog/ when it's ready for others to use. Does things like applying policies to html/svg/calendar/vcard parts to whitelist or blacklist tags/attributes/css/url schemas, clean URLs, fetch remote content at delivery time and attaching to the email to prevent tracking, pgp and smime auto encryption/decryption and a million other features.

I don't use X. You can tell him if you want.

That wouldn't be better guidance. That would be additional guidance. I'm sure Google also never let anybody set up postmaster@gmail.com

I wasn't able to sign up for postmaster@rootshell.is, but I was able to get abuse@rootshell.is. You should be careful about what standard email addresses you allow people to take. I recommend you take abuse@ back from me and you should really have a strong denylist. I just asked an LLM for a list of things you should be blocking and it came back with the following. The cert validation ones seem particularly important:

RFC 2142 mailbox names (the core list):

postmaster@ — required by RFC 5321; mail systems expect it to always work abuse@ — for reporting spam/misuse hostmaster@ — DNS issues webmaster@ — website issues noc@ — network operations security@ — security/vulnerability reports info@, marketing@, sales@, support@ — business functions

TLS/certificate validation addresses (RFC 8552 / CA-Browser Forum):

admin@, administrator@ ssladmin@, ssladministrator@, sysadmin@ These can be used to validate domain control and issue certificates, so handing them to a random user is a real security risk.

Common automated/system senders people impersonate or that cause confusion:

noreply@, no-reply@, donotreply@ mailer-daemon@ — bounce messages (RFC 5321 sender) root@, daemon@, bin@, sys@ — Unix-style system accounts null@, devnull@

Brand/trust-sensitive ones worth blocking too:

billing@, accounts@, payments@ help@, contact@, service@ legal@, privacy@, dmca@ register@, registration@, signup@ The service's own name (e.g. [brand]@, team@, staff@, official@)

[edit] Re the TLS issue. You should set up a CAA DNS record and also check on crt.sh later to see if anybody managed to get a cert for rootshell.is if you didn't lock down the validation addresses

You declare HSTS preload, but you are not in the preload list. You can not be added to the preload list at https://hstspreload.org/ because www.rootshell.is exists but has an invalid certificate.

Your MX TLS configuration supports various anon ciphers. These should be disabled.

Your DANE is broken. Try any of a number of freely available online validators.

Weirdly, if I click Load Images, all I get is a load more CSP errors and the image fetches don't happen.

You defeated https://www.emailprivacytester.com straight off. Which is more than most new email services. You seem to be relying on CSP entirely for this, but it works.

Targetted automated spam, most likely written by an LLM you say. By any chance do you see the text "agentmail" anywhere in the headers/body of that email?

Working 14 hours a day isn't normal. From an IT person who works 8 hours a day.

This reads like you just made up a workaround without reading the proposed law or without looking at the reality of the situation in other countries that it has been implemented. Your suggested workaround doesn't work.

Are you unaware that scalpers are set up to hoover up as many tickets as possible before an actual person that wants to visit the event can get one? Because it seems like you are?

The "market price" you're talking about, is set by how many scalpers are creating scarcity. If the number of scalpers is 0, then the "market price" is different. It becomes the price that both the vendor is willing to sell for, and the event visitor is willing to buy for. Which is a more desirable "market price" to achieve.

The only thing scalpers make possible, is pricing out people that the vendor wanted to sell tickets to.

Re "sent via AgentMail" - that's good to hear, but I hope it's not the entire planned text, as "AgentMail" will mean nothing to most people that receive an email from your service. It wont indicate that the email was composed by an AI rather than a person, which is the information that needs to get across.

I received this email the other day:

  From: Kushal <kushal@kushalsm.com>
  Date: Mon, 18 May 2026 05:03:11 +0000

  Saw your question on the Agent Vault thread about websocket-frame auth
  (Home Assistant) and the worry about the model reflecting the bearer
  token back into its own context.

  chrome-relay's answer is structurally different: the credential never
  enters the agent's context because the agent never touches it — the HA
  session lives in your real Chrome (cookies, WS handshake and all), and
  the agent drives the tab over CDP, only ever seeing the rendered page.
  URL: https://chrome-relay.kushalsm.com/

  For your HA + agent setup today, are you keeping the session alive in a
  browser the agent attaches to, or doing the WS auth on the agent side
  and managing the token-in-context risk yourself?

  Kushal

Read to me like an LLM had written it. It references something I said in a HN comment, but it was clearly just an excuse to spamvertise their product.

I looked at the headers and it contained a List-Unsubscribe header pointing to https://api.agentmail.to

So basically somebody wrote a bot to scrape HN for comments related to some software they wanted to push and send targetted spam. agentmail.to is a Ycombinator funded email service for LLMs which can be, and is, used to send targetted spam and impersonate people. They could mostly solve this problem by adding a block of text to every email expaining an "AI" wrote it. They'd lose customers doing that though of course. I reported this abuse but haven't (and don't expect to) received a response.

I don't even get the point anyway. You can get Claude using an SMTP or IMAP server in seconds.

> Why should anything be done?

Because there is demand for it. A lot of people like going to live music and theatre events and scalpers make it more difficult and more expensive for them.

Why shouldn't anything be done? Because capitalism is God?

In the UK they're making it illegal to resell tickets for more than the original cost. That should deal with the majority of the problem.

Perhaps he's moribund

Does it work for websockets too, where the authentication is done in a websocket frame? Like for Home Assistant? Also, if the LLM manages to do something to reflect the authentication token back in a response, do you detect it and strip it out as an extra layer of protection?

https://gitlab.com/grepular/claude-sandbox runs claude in a podman container. The way it deals with this is:

claude-cli executes whatever is in the BROWSER env variable to open your browser at a current URL, so I pointed it at a simple shell script that writes the URL to a named pipe which is mounted into the container. The sandbox tool outside of the container is reading from that named pipe. When it receives a URL to open, it pops up a confirmation dialog with info about the URL. If you accept, it opens it in your host browser.

The second step is, the callback URL after you sign in on the claude website wants to connect back to a port on localhost to complete the sign in. If the sandbox is being run with host networking mode, this just works fine as claude cli has already opened that port so it's listening on the host network. However if it is not running in host networking mode, the sandbox tool figures out what port it need to listen on from looking at the URL, listens to it, and when it is hit, it just podman exec's curl inside the container to complete the callback.

Ah I see. Recommend you run "npm install" on your host then instead.

Guessing you meant "python" rather than "docker", as docker is not subject to the same type of attack. However, it's a single .py script that you copy somewhere. Not even close to a typical nodejs project using npm install.

I host my own email. I use a default SpamAssassin configuration along with some basic greylisting. I barely get any spam. Maybe one every month or two.