yakkomajuri

Great question. I assume you mean tools like Composio right?

So the difference here is the granular permissioning layer. In practice it means AgentPort is basically an open source Composio with granular permissions today. But whereas their focus is on just connecting you to everything my focus here is security. And that leads to pretty different products down the line in my opinion.

As for connecting your own tools, I have a feature basically ready to let you create your own integrations. Should launch soon!

OP here. Happy to answer any questions. Security for autonomous agents/claws is a deep rabbit hole that I've jumped into and I'm really interested in having open discussions about how people are approaching it.

Yeah so this is the part where it needs to be tested actively by more people in order to design the best experience.

So today there are two modes:

1. The agent halts and waits for you to approve

2. The agent can fire the tool calls and keep working on other things and only at the end ask for the approvals it needs

It's not perfect, but it does work well in a lot of cases. Retrying is pretty simple because you can just tell the agent to re-run the same tool call and approve it then. As of right now approvals expire within 15min but I'm actually putting a PR up today to make this configurable.

Adding a human in the loop technically does limit how much can be done fully autonomously (e.g. via scheduled agents) but: a) I think the tradeoff is worth it b) it gives me peace of mind to let agents run unsupervised on a schedule for tasks that shouldn't require approval because I know they won't do something they weren't instructed to do when left unsupervised.

Nevertheless, it's a tricky design problem. I prefer the current approach to having to log into AgentPort and approve things from a "pending approvals list" there, but what do you think? What would make most sense to you?

I've been thinking a lot about securing autonomous agents recently and the rabbithole goes deep as you might expect.

One of the principles I believe you should follow is: if there's enough access for an action to be taken, then you must assume that action can be taken at any point.

Basically, if it has access to delere prod data, you should assume it might do it and plan accordingly.

I also believe the actions of your agent are entirely your responsibility.

As part of my digging into securing these systems I've baked some of these principles into AgentPort, a gateway for connecting agents to third-party services with granular permissions.

If anyone's interested in this space:

https://github.com/yakkomajuri/agentport

I do think this is likely to make things more secure but it's also dangerous by potentially giving users a false sense of complete security when the security layer is probabilistic rather than deterministic.

EDIT: it does seem to have a deterministic layer too and I think that's great

Really cool! I'm also building something in this space but taking a slightly different approach. I'm glad to see more focus on security for production agentic workflows though, as I think we don't talk about it enough when it comes to claws and other autonomous agents.

I think you're spot on with the fact that it's so far it's been either all or nothing. You either give an agent a lot of access and it's really powerful but proportionally dangerous or you lock it down so much that it's no longer useful.

I like a lot of the ideas you show here, but I also worry that LLM-as-a-judge is fundamentally a probabilistic guardrail that is inherently limited. How do you see this? It feels dangerous to rely on a security system that's not based on hard limitations but rather probabilities?

I did something very similar recently, just made it open source but haven't posted anywhere.

https://github.com/yakkomajuri/seams

Run `seams .` in any dir and get a rich markdown editor with image uploads, block editing, tables, etc etc

Congrats on launching!

I've been trying out Hermes this week. OpenClaw felt like too much.

It was really easy to setup and I've been getting some value out of it but hasn't been the craziest thing in the world. I'm using it for:

- Unstructured note-taking: I suck at notes and todos and used to have a WhatsApp chat with myself (this is really common in Brazil) where I dump stuff. Now I dump into Hermes and it sorts whatever I put in there into one of various lists like to-do, to-read, to-try, to-buy, and so on.

- Briefings on a cron: I get reminded of my todos every morning and at the end of the day so I can cross stuff off. Later in the day I get reminded of my to-read list. I also get a summary of what went on from my coding orchestrator.

- Some coding: I built my own remote orchestrator and have been using Hermes to manage tasks, review code, and trigger tasks when on the move. Hermes has been a nice interface to allow me to use the orchestrator on my phone.

Haven't connected email or anything else yet. I feel like the security story here is lacking.

Overall it's been interesting but not mind-blowing. Plus setting up was easy but it's a bit buggy at times, messing up where files were and not being able to configure itself according to its own docs.

EDIT: Ah yes and voice notes via WhatsApp out-of-the-box is really nice

I'm inclined to believe this one given the people involved.

Congrats, and I'm rooting for this to work.

I think the comment was out of legitimate interest rather than weighing one against the other

I mean I'm as annoyed as the next person about the outages but I'm not sure correlating with the Microsoft acquisition tells the whole story? GitHub usage has been growing massively I'd imagine?

The abrupt ending was funny and then I realized the author is Finnish and it all made sense.

Nice post.

(P.S. I'm also Finnish)

As others have pointed out this would likely not save you in this case, but there are some phones which do support this, and I know people in Brazil that use these features in order to be able to comply when getting mugged without giving away access to your bank etc.

The most phonetically consistent language I know is Finnish. I believe there is exactly one way to pronounce every word and it's clear to all speakers.

And the least phonetically consistent is English.

This is not new, but it's certainly getting worse and will get even worse. Some large companies used to do bot interviews for low-level positions even pre-AI where the bot would ask a recorded question and you'd have a certain amount of time to answer.

It reminds me of a funny story. I did a Business Management degree at university and during my first year was already freelancing as a dev. But basically everyone around me wanted to work in either consultancy or investment banking (this was in London) so the path was to get accepted for a "spring week" during your first year, internship the second, and then get an offer to work there at the end of your third year.

With all everyone could talk about being applying for spring weeks, I gave in and decided I was going to prove to myself and others that I could do this if I wanted to but I just wanted to be a dev. Applied to JPMorgan and got through to this first bot interview stage. I thought I was knocking it out of the park and then the last question was "Why do you want to work at JP Morgan?". The answer time was something like 30s. I froze for what felt like 15 then blurted out some BS.

That told me all I needed to know. I never again thought about working in this industry and soon after was hired as a developer full-time while taking my studies lightly.

2 years ago I built something I called "social media for blogs" that had some similar ideas. Nothing around encryption though, all on public data.

I'd be keen to revisit those ideas and see if they can take shape in another form.

MIT licensed if anyone's interested: https://github.com/yakkomajuri/recess

For all people have to say about Pete the openclaw guy he's been perhaps one of the most vocal voices about CLIs > MCPs (or maybe his is just the loudest?) and he also built a GSuite CLI that probably inspired this project.

I mean it's great that we get this, hopefully it can continue to be maintained and I'd love to see a push for similar stuff for other products and at other companies.

Exactly, this is the very stuff I'd be interested to hear more about. Great work on all this btw and best of luck going forward!

This is exactly my experience. I've had it as my primary search engine for 6-7 years now but add !g to about 80% of queries.

Happy user of the DDG mobile browser though.

I think this is pretty standard and similar to approaches that are evolving naturally (I've certainly used very similar patterns).

I'd be pretty keen to actually hear more about the Unikraft setup and other deeper details about the agent sandboxes regarding the tradeoffs and optimizations made. All the components are there but has someone open-sourced a more plug-and-play setup like this?

I guess no GPT on Bedrock still it seems

I guess this is Anthropic's early version of a "claw"?

I wonder how much of a role parents played here. Surely there must have been some help involved with resources, encouragement, and at least getting the letters sent?

I applaud parents who encourage kids to do stuff like this when they have the innate drive for it.

> "Like most tech debt, we didn’t make this decision, we just did not not make this decision."

This is an important point.

I'm pretty careful with Claude Code in non-sandboxed environments but recently found myself approving what it told me was a "search" or something which was actually a find command piping into rm -rf.

Pressed ESC immediately after I realized but alerted me to the dangers

The blog also contains this post: "Two Hours of War: Fighting Open Source Gatekeeping" [1]

The bot apparently keeps a log of what it does and what it learned (provided that this is not a human masquerading as a bot) and that's the title of its log.

[1] https://crabby-rathbun.github.io/mjrathbun-website/blog/post...

I've honestly been looking for this -- a modern slick db management app, both for local dbs and remote (just for me though, no collaboration). Existing tools are solid but they feel outdated.

Downloaded and onboarding was nice. A couple of things:

- The initial schema for my local Postgres table was showing public but there were a bunch of tables showing that clearly were not tables in my public schema. Changing the schema to something else and back worked.

- Limiting the free version on number of tabs feels... annoying. I appreciate that a lot of stuff out there doesn't even have a free version but the software automatically opened with a few tabs (or I accidentally clicked on it?) and then as soon as I clicked on my first table I was paywalled. I feel like I'll accidentally open more tabs (even though I really just wanna work on one at a time) and get frustrated, which is more likely to drive me away than to pay at this point.

Note btw that ofc you have to make money and this is a product that I feel I'd be willing to pay for but I got frustrated within 2mins of using it so it wasn't like oh I've felt the value let me pay, it was more like I haven't even gotten to value yet.

Great work anyway and I'll keep trying and provide feedback as it comes! Thanks for building this

If you want to go a step further the PostHog roadmap items are all GitHub issues that users can upvote which gives a great sense of who wants what in the community.

https://posthog.com/roadmap

(disclaimer: I used to work at PostHog)

RemindMe! 2 years

Secret placeholders seems like a good design decision.

So many sandbox products these days though. What are people using in production and what should one know about this space? There's Modal, Daytona, Fly, Cloudflare, Deno, etc