Claws Out: Securing and Building with OpenClaw

[upbeat music] Yeah.

So, uh, like, like Phil said, I work at Pomerium, and he's not the first person to have trouble pronouncing it. So I actually convinced the marketing team to, uh, create Pomeranian stickers, so if anybody wants Pomeranian stickers, I have a bunch with me.

Um, a bit about me. Uh, uh, I'm a, a dev advocate over at Pomerium, as Phil said. Um, from Canada, uh, hailing from Montreal, so, uh, if anybody likes poutine and bagels, feel free to chat with me after.

Uh, also a GitHub Star, Microsoft MVP, and AWS Community Builder, and these ... You can pretty much find me everywhere, uh, [REDACTED:username] online.

Um, I was pretty happy to see this, that there's a, a pretty sizable instance on-prem of, uh, OpenClaw, so was pretty happy with that, and it looks like that's the operator there.

Cool. So, uh, I don't know, I came up with a funny title I guess, but Claws Out. Um, w- we're gonna talk about a feature I contributed to the OpenClaw project back in February, and it's about hardening access to the control plane.

So, uh, I'm assuming everybody here is running an OpenClaw or OpenClaw-curious. Um, is anybody running, uh, a mode called trusted-proxy auth mode? You, you might not be, but, uh ...

Okay. You might be on the ... Who's on the token, uh, auth-

Me.

Okay. Um, anyways, so at Pomerium where I work, um, you know, I'm always just trying to secure things. That's just part of what I do. And I was able to secure OpenClaw, but it meant I still had to add a token, uh, for the WebSocket connection.

I had to always pair my device and stuff. And you don't really need that with a, a trusted proxy, like specifically the one that I work on, which is OpenCore.

It's called an identity-aware proxy. So if anybody's ever used GCP, uh, there's a IAP in there. It's called an identity-aware proxy, something that came out of Google. Uh, essentially you've got an identity provider, a policy engine, and a reverse proxy, so those, uh, it's not the lethal trifecta in the sense that you usually hear, but, uh, it's

a pretty solid security approach for securing internal apps. So I was like, of course, I, I, I kinda got annoyed that I had to add this token still and do the pairing every time.

Uh, I understood why they were there, but, uh, I just proposed this issue, and then, uh, at least one other person who uses Caddy, uh, chimed in and said, "Hey, that's, uh, sounds like a good idea."

And then Peter, uh, stipe, was like, "Yeah, let's, let's work on this," and he laid out, like, the criteria that he wanted to have for this feature. So I went ahead and worked on it.

And yeah, again, prior to trusted-proxy auth mode, even if you were secured by a proxy, you still had to paste in that auth token in the UI for the WebSocket connection, and also it sticks it in the query string, which, uh, obviously, like this is really more for just only local mode really.

Um, and still having to pair the device, like, uh, I don't know if people get annoyed by pairing the device, but, uh, I, you know, I'd, I'd just be on a, my phone after I just set it up, and then I was like, "Oh, I gotta go to the other thing to set it up," so.

Um, basically you still had to do those things even if it was secured with, uh, a proxy.

So got merged in, and, uh, I felt pretty good about it, and, uh, it was nice to get some praise from Peter. It was, uh, my first contribution to the project, so it was very cool.

So what does it look like exactly, like in the config? Uh, I'm just gonna show like a, kind of a narrow part of the config here. But you have your gateway, and essentially you no longer need the token, like I mentioned.

Uh, the mode is obviously different, so it's called trustedProxy now. And then there's some new properties you have to add. So there's trustedProxies, and this is essentially the proxy that is gating access to the control plane, the, uh, the gateway.

Um, it's the IP addresses. Uh, it could be one or more. And aside from that, you have to have a trustedProxy section. So you'll have a userHeader, which is in, in my case, uh, it's a JWT, uh, J-W-T.

Um, and then there's like a requiredHeaders section. There's some optional ones too. It depends what you wanna do. There's like allowUsers, and in my case I don't need the allowUsers because the way a, a identity-aware proxy works is the policies dictate that.

Um, but essentially that's w- kind of the, the big change there, and you can do this through the onboarding or if you just go back in and, uh, configure things through the TUI.

And yeah, so that just meant no more token for WebSocket connections and no longer needed to pair devices. So not only are you, uh, getting, uh, better security posture potentially, uh, to me it's like a UX win as well, 'cause, uh, I really found doing these two things annoying.

Um, cool. Uh, I also just wanna give a shout-out to a couple contributors. After I ch- contributed this, um, there was a bug and Anthony reported it, and then, uh, Sid fixed it, and, uh, it was definitely [laughs] something I missed because I basically was testing this on my local environment, and I already had something paired, so I

didn't run into the issue that, uh, Anthony had mentioned. So, uh, luckily, uh, it was a small fix and, uh, Sid got that sorted out. But just, uh, you know, when you miss stuff, uh, people in the community step up, so OSS for the win.

The other thing I want to mention, it's not so much about this feature, but like when I open this issue, um, the number of the issue is [REDACTED:generic_id], and I had a, a PR initially that was like in the 1700s.

And I went on vacation and I said, "Oh, I'll get back to it [laughs] when I'm back." And the original PR was closed 'cause it was stale and like literally after two weeks it went from like 1,500 to like almost 16,000.

So, um, basically, that's just a testament to how popular the project got, but it also meant I had to, uh, rebase quite a bit [laughs] before it got merged. So anyways, I don't know if anybody else that contributes to the project, but there's so many things going on all the time, so there's a lot of, uh, rebasing to

keep your thing up to date. Cool. So, uh, let's talk about my own OpenClaw. So this is McClaw, and he's sitting on my desk in Montreal right now. There's some snow still.

Um, I use it in Discord. I don't know where people use their OpenClaw. I had it on Telegram initially, but they don't actually, um,

uh... Their, their, uh, channels aren't encrypted, so like all the stuff's in clear. So I work at a security company, and my CEO is like, "Yeah, don't use that."

So anyways, uh, I'm mainly on Discord. I find it use- uh, handy that way. I have WhatsApp too, but, uh, I tend to use the Discord more.

Um, some things I wanna mention too is when I made the contribution, I actually used OpenClaw to make the contribution, which was kind of fun. Um, but it also...

Uh, I made the mistake of, uh, I used the GitHub CLI, and I gave it full access, so it put up a PR right away even before I was like done reviewing things.

Uh, so I had a little like, "Ah," but, uh, put it back into draft mode. Um, but aside from that, um, after the, uh, token, uh, trusted proxy mode got merged, I just started working on something.

It started getting fun to just build stuff on my phone. So I built out something called Clawspace and, you know, doesn't, doesn't mean you need to use it. It's just, you know, it's the age of personal software.

I just had a lot of fun building it. I find it useful, and I thought it was just cool that I could build this out on my phone on Discord.

Um, but for me, I find it useful because I don't need to SSH in to see workspace files that I wanna actually read or like edit. Uh, so, um, that's just a little side project I started building, and you can edit files and stuff too.

Cool. So we're gonna do a demo here. This is gonna be, uh, live coding, [laughs] so YOLO.

Okay. So, uh, there's a MCP track tomorrow. Uh, I've been doing a lot of work in MCPs. So what we're gonna do is we are going to build out an MCP, uh, not a full-fledged version of something.

But if you've seen the, uh, AI engineer website, they have like an LLMs text on the right, and there's a MCP server, and there's a few other things. So I'm gonna go ahead and just add this here.

And I'm gonna go create an app. I'll explain some things here in a second.

Okay. And OAuth. Okay. So this is gonna go create an application in ChatGPT. Uh, but basically, this is, uh, an MCP server that just has UI as well. They'll, they'll be talking about this tomorrow.

But, uh, I have a template that I use for this, so it's not like I'm building this from scratch. But we're just gonna register the MCP here, and then I'm just gonna start building with OpenClaw.

And the thing with agentic is you never know when it's done. It's just finishing up OAuth here.

Okay, cool. It's connected, and we can see here it's got two tools. It's got a echo tool, and it's got a searchSpeakers tool.

So if we come here, if nobody's ever used MCP apps, basically in ChatGPT, you do this for your app. And I'm gonna say like, "Echo hello."

And essentially, it's going to do the tool call, but because there's UI associated to it, you're gonna get some UI in here. And this is just using the standard MCP stuff that's in the spec now.

Um, so you can do stuff like change that, make it big and stuff. But what I wanna show is like when I'm building this with OpenClaw, I can do stuff like this.

I can say like, uh, ba, ba, ba, "Change

echoed message to AIE EU in the echo widget."

Now, it's gonna take a second, but, um, this is all web tech under the hood, so I don't know if anybody's, uh, web devs here. But essentially, it's using Vite and React, so there's React Refresh and Vite hot module reloading.

McClaw is on the case here, and you can see I'm in ChatGPT. I'm editing live from my workspace, the MCP. And, and to explain how this is working, uh, we have the trusted proxy auth mode.

Uh, I happen to be using Pomerium in this case, so I'm using it as well to secure other things in the workspace. So I have a public URL that I've gated for the MCP, and that's how I'm able to use it in ChatGPT.

And I can go ahead and just keep working on it in here. And I don't know how other people work or build with, uh, OpenClaw, but this is kinda how I've been doing it.

I find it works really well for web dev stuff. So I'm gonna go say update the searchSpeakers. So let's just do this, a new chat, and I'll say, "@AIE" again,

"searchSpeakers."

And it's gonna give, uh, a very minimal UI here 'cause, uh, there's not much into it. Uh, so I'm gonna just tell McClaw to get on the case here.

And basically, if you go to that top right corner of the AIE, uh, website, there's a speaker.JSON, and this is, like, all the speakers from the conf. And we're gonna use that as, like, the source of users, and then I'm asking it to kinda give the same UI as what you kinda saw in the Echo widget.

Uh, it's gonna take a minute here probably 'cause, uh, McClaw is covered in snow probably in Montreal, but, uh, cool. And so basically once this gets done, uh, we'll be able to filter users and just kind of, you know, see who's talking, um, at the conference.

And I'm just gonna take a sip of water while McClaw is chugging along there.

Again, you never know when agentic finishes. Okay, it's determininst- deterministically an indeterminate. So this should be done in a second, and then what you're gonna see is you're gonna see this updated.

And again, just to reiterate the flow, I- I'm, I'm working in workspace files in my OpenClaw. I'm speaking to it or typing to it in Discord. Uh, this is a publicly available site, uh, and I'm able to build it as I'm in my OpenClaw.

And I like that workflow. I really don't know how other people work. I mean, obviously I use other tools like Claude and, and Codex too. Um, but you can see here, um,

McClaw was able to get the job done, and then I can start filtering. So we could look for drilling down here, then we can find a speaker, and then we can get a bit more information.

And then, like, I could say, let's add another feature here. So let's get McClaw on the case again.

So we're gonna add a More button here, and there's this send message function that you can use in MCP apps. And this is actually going to, uh, when you click the but- the More button that it's gonna generate, this will actually make a call to the LLM to, a- and you're gonna get a response back.

Uh, so we'll give this a second. Cool. So I added this More button in.

Uh, again, like I've been doing web dev for a while, and I, I always still find it magical when things just automatically update. But I'm gonna go ahead and click on here, and you're gonna see here that it's thinking now.

So it actually made a call, uh, added another, uh, prompt to ChatGPT here, and it's gonna kinda summarize why it thinks you should check out Alessandro's talk and a bit more about it.

Now, I just really find this workflow really cool. It's only possible if you use some kind of proxy to do this. Uh, you can do this with others like, uh, Caddy with OAuth.

You could do it with, uh, well, NGINX is kinda deprecated at this point. Or not deprecated, but, uh, at least in Kubernetes land, the Ingress Controller is. Um, but it's just a really nice way to gate stuff that is local, but you can still expose it in a secure way.

Um, and it's also just fun buil- Like, I don't know about anybody else, but I've been really enjoying building stuff, just chatting. Uh, I remember a couple years ago, uh, Replit, um, who's, who's a AI company that's, you know, making it really easy to build stuff.

I was like, "Why would I ever wanna build on my phone?" And, uh, I kinda got, uh, phone-tilled now, I guess. So, um, just fu- you know, just having fun.

I think that's part of the thing with OpenClaw. Also, just, like, use it however you want to. Like, I, I find that Clawspace I created super helpful. Uh, you know, build your own tools and stuff.

Um, definitely take security into consideration. Uh, you know, there's a bunch of people that have obviously, you know, exposed things and they didn't mean to. Like, you know, some people have deleted all their emails, et cetera.

Um, but I don't know. I, I find the trusted proxy auth mode super useful and at least one other person [laughs] does in the, in the, in that issue. Um, I encourage you to check it out.

Uh, just have fun building stuff. And yeah, that's, uh, pretty much it. My name is Nick Taylor, and that's how I build with OpenClaw. [audience applauding] [upbeat music]