Claws Out: Securing and Building with OpenClaw - Nick Taylor, Pomerium

Yeah. So, uh, like—like Phil said, I work at Pomerium, and he's not the first person to have trouble pronouncing it, so I actually convinced the marketing team to, uh, create Pomeranian stickers. So if anybody wants Pomeranian stickers, I have a bunch with me.

Um, a bit about me: I'm a dev advocate over at Pomerium, as Phil said, I'm from Canada, Hailin from Montreal, so if anybody likes poutine and bagels, feel free to chat with me after. Also, a GitHub star, Microsoft MVP, and AWS community builder, and these—you can pretty much find me everywhere at nickytonline.

Um, I was pretty happy to see this, that there's a pretty sizable instance on-prem of OpenClaw, so I was pretty happy with that, and it looks like that's the operator there.

Cool. So, uh, I don't know, I came up with a funny title, I guess, but Claw is out. Um, we're going to talk about a feature I contributed to the OpenClaw project back in February, and it's about hardening access to the control plane.

So, uh, I'm assuming everybody here is running an OpenClaw or OpenClaw Curious. Um, is anybody running a mode called trusted-proxy auth mode? You might not be, but, uh, okay. You might be on the—who's on the token auth? Okay.

Um, anyways, so at Pomerium, where I work, you know, I'm always just trying to secure things. That's just part of what I do. And I was able to secure OpenClaw, but it meant I still had to add a token for the WebSocket connection.

I had to always pair my device and stuff. And you don't really need that with a trusted proxy, like specifically the one that I work on, which is open core. It's called an Identity-Aware Proxy, so if anybody's ever used GCP, there's an IAP in there, it's called an Identity-Aware Proxy, something that came out of Google.

Essentially, you've got an identity provider, a policy engine, and a reverse proxy. So those—it's not the lethal trifecta in the sense that you usually hear, but it's a pretty solid security approach for securing internal apps. So I was like, of course, I kind of got annoyed that I had to add this token still and do the pairing every time.

I understood why they were there, but I just proposed this issue, and then at least one other person who uses Caddy chimed in and said, "Hey, that sounds like a good idea." And then Peter, Stipe was like, "Yeah, let's work on this," and he laid out, like, the criteria that he wanted to have for this feature.

So I went ahead and worked on it, and yeah, again, prior to trusted-proxy auth mode, even if you were secured by a proxy, you still had to paste in that auth token in the UI for the WebSocket connection, and also it sticks it in the query string, which obviously, like, this is really more for just only local mode, really.

And still having to pair the device, like, I don't know if people get annoyed by pairing the device, but I, you know, I'd just be on my phone after I'd just set it up, and then I was like, "Ugh, I got to go to the other thing to set it up."

So basically, you still had to do those things even if it was secured with a proxy. So it got merged in, and I felt pretty good about it, and it was nice to get some praise from Peter. It was my first contribution to the project, so it was very cool.

So what does it look like exactly, like, in the config? I'm just going to show, like, a kind of narrow part of the config here, but you have your gateway, and essentially you no longer need the token, like I mentioned.

The mode is obviously different, so it's called trusted-proxy now. And then there's some new properties you have to add. So there's trusted-proxies, and this is essentially the proxy that is gating access to the control plane, the gateway. It's the IP addresses.

It could be one or more. And aside from that, you have to have a trusted-proxy section. So you'll have a user header, which is, in my case, it's a JWT, and then there's, like, a required header section. There's some optional ones too.

It depends what you want to do. There's, like, allowed users. And in my case, I don't need the allowed users because the way Identity-Aware Proxy works is the policies dictate that. But essentially, that's kind of the big change there, and you can do this through the onboarding or if you just go back in and configure things through the TUI.

And yeah, so that just meant no more token for WebSocket connections and no longer needed to pair devices. So not only are you getting better security posture, potentially, to me it's like a UX win as well, because I really found doing these two things annoying.

Cool. I also just want to give a shout-out to a couple contributors. After I contributed this, there was a bug, and Anthony reported it, and then Sid fixed it, and it was definitely something I missed because I basically was testing this on my local environment, and I already had something paired, so I didn't run into the issue that Anthony had mentioned.

So luckily it was a small fix, and Sid got that sorted out, but just, you know, when you miss stuff, people in the community step up, so OSS for the win.

The other thing I want to mention, it's not so much about this feature, but, like, when I opened this issue, the number of the issue was 1560, and I had a PR initially that was, like, in the 1700s, and I went on vacation, and I said, "Oh, I'll get back to it when I'm back," and the original PR was closed because it was stale, and, like, literally after two weeks it went from, like, 1500 to, like, almost 16,000, so basically that's just a testament to how popular the project got, but it also meant I had to rebase quite a bit before it got merged.

So anyways, I don't know if anybody else that contributes to the project, but there's so many things going on all the time, so there's a lot of rebasing to keep your thing up to date. Cool. So let's talk about my own OpenClaw.

So this is McClaw, and he's sitting on my desk in Montrealright now. There's some snow still. I use it in Discord. I don't know where people use their OpenClaw. I had it on Telegram initially, but they don't actually—their channels aren't encrypted, so, like, all the stuff's in clear, so I work at a security company, and my CEO is like, "Yeah, don't use that."

So anyways, I'm mainly on Discord. I find it handy that way. I have WhatsApp too, but I tend to use the Discord more.

Some things I want to mention too is when I made the contribution, I actually used OpenClaw to make the contribution, which was kind of fun, but it also—I made the mistake of I used the GitHub CLI and I gave it full access, so it put up a PRright away even before I was, like, done reviewing things, so I had a little, like, "Ah," but I put it back into draft mode.

But aside from that, after the token trusted-proxy mode got merged, I just started working on something. It started getting fun to just build stuff on my phone. So I built out something called Clawspace, and, you know, it doesn't mean you need to use it, it's just, you know, it's the age of personal software.

I just had a lot of fun building it. I find it useful, and I thought it was just cool that I could build this out on my phone on Discord. But for me, I find it useful because I don't need to SSH in to see workspace files that I want to actually read or, like, edit.

So that's just a little side project I started building, and you can edit files and stuff too. Cool. So we're going to do a demo here. This is going to be live coding, so yolo. Okay. So there's an MCP track tomorrow.

I've been doing a lot of work in MCPs, so what we're going to do is we are going to build out an MCP, not a full-fledged version of something, but if you've seen the AI engineer website, they have, like, an LLMs text on theright, and there's an MCP server, and there's a few other things.

So I'm going to go ahead and just add this here.

And I'm going to go create an app. I'll explain some things here in a second.

Okay. OAuth. Okay. So this is going to go create an application in ChatGPT, but basically this is an MCP server that just has UI as well. They'll be talking about this tomorrow, but I have a template that I use for this, so it's not like I'm building this from scratch, but we're just going to register the MCP here, and then I'm just going to start building with OpenClaw.

And the thing with Agentic is you never know when it's done. It's just finishing up OAuth here.

Okay, cool. It's connected, and we can see here it's got two tools. It's got an echo tool, and it's got a search speakers tool.

So if we come here, if nobody's ever used MCP apps, basically in ChatGPT, do this for your app, and I'm going to say, like, "echo hello,"

and essentially it's going to do the tool call, but because there's UI associated to it, you're going to get some UI in here. And this is just using the standard MCP stuff that's in the spec now, so you can do stuff like change that, make it big, and stuff.

But what I want to show is, like, when I'm building this with OpenClaw, I can do stuff like this. I can say, like,

"change echoed message to AIE-EU in the echo widget." Now, it's going to take a second, but this is all web tech under the hood, so I don't know if anybody's web devs here, but essentially it's using Vite and React, so there's React refresh and Vite hot module reloading.

McClaw is on the case here, and you can see I'm in ChatGPT. I'm editing live from my workspace, the MCP, and to explain how this is working, we have the trusted-proxy auth mode. I happen to be using Pomerium in this case, so I'm using it as well to secure other things in the workspace, so I have a public URL that I've gated for the MCP, and that's how I'm able to use it in ChatGPT.

And I can go ahead and just keep working on it in here. And I don't know how other people work or build with OpenClaw, but this is kind of how I've been doing it. I find it works really well for web dev stuff.

So I'm going to go say, "update the search speaker," so let's just do this, new chat, and I'll say, "add AIE again, search speakers,"

and it's going to give a very minimal UI here because there's not much into it. So I'm going to just tell McClaw to get on the case here. And basically, if you go to that topright corner of the AIE website, there's speaker.json, and this is, like, all the speakers from the conf, and we're going to use that as, like, the source of users, and then I'm asking it to kind of give the same UI as what you kind of saw in the echo widget.

It's going to take a minute here probably because McClaw is covered in snow probably in Montreal, but cool. And so basically, once this gets done, we'll be able to filter users and just kind of, you know, see who's talking at the conference, and I'm just going to take a sip of water while McClaw is chugging along there.

Again, you never know when Agentic finishes. Okay. It's deterministically indeterminate. So this should be done in a second, and then what you're going to see is you're going to see this updated. And again, just to reiterate the flow, I'm working in workspace files in my OpenClaw.

I'm speaking to it or typing to it in Discord. This is a publicly available site, and I'm able to build it as I'm in my OpenClaw, and I like that workflow. I really don't know how other people work.

I mean, obviously I use other tools like Claude and Codex too, but you can see here

McClaw was able to get the job done, and then I can start filtering. So we could look for drilling down here, then we can find a speaker, and then we can get a bit more information, and then, like, I could say, "let's add another feature here," so let's get McClaw on the case again.

So we're going to add a more button here, and there's this send message function that you can use in MCP apps, and this is actually going to, when you click the more button that it's going to generate, this will actually make a call to the LLM, and you're going to get a response back.

So we'll give this a second.

Cool. So I added this more button, and again, like, I've been doing web dev for a while, and I always still find it magical when things just automatically update, but I'm going to go ahead and click on here, and you're going to see here that it's thinking now, so it actually made a call, added another prompt to ChatGPT here, and it's going to kind of summarize why it thinks you should check out Alessandro's talk and a bit more about it.

Now, I just really find this workflow really cool. It's only possible if you use some kind of proxy to do this. You can do this with others like Caddy with OAuth. You could do it with, well, Nginx is kind of deprecated at this point.

Well, not deprecated, but at least in Kubernetes land, the ingress controller is. But it's just a really nice way to gate stuff that is local, but you can still expose it in a secure way, and it's also just fun to build.

Like, I don't know about anybody else, but I've been really enjoying building stuff, just chatting. I remember a couple years ago, Replit, who's an AI company that's, you know, making it really easy to build stuff, I was like, "Why would I ever want to build on my phone?"

and I kind of got phone-tilled now, I guess. So it's just, you know, just having fun. I think that's part of the thing with OpenClaw. Also, just, like, use it however you want to. Like, I find that Clawspace I created super helpful.

You know, build your own tools and stuff. Definitely take security into consideration. You know, there's a bunch of people that have obviously, you know, exposed things and they didn't mean to. Like, you know, some people have deleted all their emails, et cetera.

But I don't know, I find the trusted-proxy auth mode super useful, and at least one other person does in that issue. I encourage you to check it out. Just have fun building stuff, and yeah, that's pretty much it.

My name is Nick Taylor, and that's how I build with OpenClaw.