Expose your local agent safely, then change code from your phone and watch the UI update
Claws Out: Securing and Building with OpenClaw - Nick Taylor, Pomerium · Nick Taylor
17 min total·Actually worth watching closely: ~12 min·3 must-watch clips
- 0:16 – 2:10Listen
Why he went after OpenClaw's security
The speaker introduces himself and his motivation: OpenClaw issue numbers went from about 1,500 to nearly 16,000 in two weeks, and that popularity means plenty of instances casually exposed on the internet.
This isn't a theoretical security topic - people have exposed things they didn't mean to, and some have had all their emails deleted.
Pure spoken setup over a single about-me slide; fine to listen to while doing something else.▶ Jump to 0:16Speaker · Nick Taylor - 2:10 – 3:59Skim
What an identity-aware proxy actually is
Breaks the identity-aware proxy into its three parts - identity provider, policy engine, reverse proxy - and compares a few ways to run one.
Pomerium or Caddy with OAuth both work; in Kubernetes land the Nginx Ingress controller is on its way out, so don't bet on it.
There's an architecture diagram on screen - take in how the three boxes connect; the narration mostly restates what's in the picture.▶ Jump to 2:10Speaker · Nick Taylor - 3:59 – 6:00Watch
The config with no token and no pairing
Walks field by field through the Trusted Proxy Auth Mode he contributed: the gateway mode becomes trusted proxy, you declare the IP of the proxy sitting in front of the gateway, then a user header carrying identity plus a required-header section.
Whether a request gets through is dictated by the proxy's policies, so users never paste a WebSocket token or pair a device again - security and usability both improve at once, which is rare for a security change.
The config snippet is on screen in full; the field names and nesting are copy-paste ready, so reading beats listening.▶ Jump to 3:59Speaker · Nick Taylor - 6:00 – 7:20Listen
What it's like to send a PR to a project that blew up
The story of this feature from issue to merge: main moved so fast he had to rebase repeatedly, and a bug he'd missed in his own testing was found and quickly fixed by community members.
Testing on your own machine always leaves blind spots, and covering them is the real value of open source collaboration.
A narrative stretch; the screenshots are just supporting evidence, so you can follow it without watching.▶ Jump to 6:00Speaker · Nick Taylor - 7:20 – 9:06Watch
A tool built entirely on a phone
Shows Clawspace, which he built entirely on his phone over Discord - read and edit workspace files without having to SSH in.
'Building software on your phone' sounded like a joke two years ago; now it's how he works.
Sending instructions in a phone chat window and having the file contents appear on that same small screen - the cramped but complete setup carries a conviction text can't.▶ Jump to 7:20Speaker · Nick Taylor - 9:06 – 10:32Watch
An MCP server can bring its own UI
After registering his own MCP server in ChatGPT, tool calls no longer return just text - they render an interactive interface.
MCP apps with UI are standard MCP stuff that's in the spec now, not one vendor's private extension.
The whole value is in the screen that gets rendered - what the components look like and how they sit alongside the chat only lands visually.▶ Jump to 9:06Speaker · Nick Taylor - 10:32 – 13:11Watch
Live: one edit, and the UI follows
He tells the agent in Discord to change the MCP code in his local workspace; React refresh and Vite hot module reloading push the change straight into the ChatGPT UI he's using.
That loop only holds together because of the config from earlier - it turns a local server into a gated public URL.
The rhythm of cutting between the two windows is the whole point: how short the gap is between instruction and change doesn't come across in a description.▶ Jump to 10:32Speaker · Nick Taylor - 13:11 – 16:53Watch
Wrap-up: buttons that talk back, and don't hand over every key
Demos how a button in the UI pushes a prompt back into the conversation and triggers a generation, then closes on security and personal software.
Be sparing with tool permissions - he gave the GitHub CLI full access and the agent put up a PR before he'd finished reviewing.
The button trigger in the first half is the last thing worth watching; after that it turns into takeaways you can follow by ear.▶ Jump to 13:11Speaker · Nick Taylor