NanoClaw opens remote MCP while hardening chat identity

nanocoai/nanoclaw PR #3221 is the inspected primary source: “feat(providers): remote Streamable HTTP MCP servers for codex and opencode.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nanocoai/nanoclaw PR #3221 was created 2026-08-10T11:39:29Z and was closed at inspection; its title is “feat(providers): remote Streamable HTTP MCP servers for codex and opencode.” - nanocoai/nanoclaw PR #3229 was created 2026-08-10T20:25:00Z and was open at inspection; its title is “fix(telegram): generate pairing codes with a CSPRNG, not Math.random().” - nanocoai/nanoclaw PR #3224 was created 2026-08-10T17:16:24Z and was open at inspection; its title is “fix(session-db): preserve inbound messages across platform ID reuse.” - The repository reported 30488 stars, 879 open issues, default branch main, and last push 2026-08-11T16:39:45Z. - The latest tagged-release baseline checked was v2.1.54 published 2026-08-01T20:46:31Z.

What changed

nanocoai/nanoclaw PR #3221 reports: Problem PR #3092 teaches the engine and the Claude provider to accept remote Streamable HTTP MCP servers ({ type: 'http', url } entries in mcpServers). The codex and opencode payloads on this branch still assume stdio-only McpServerConfig: an http entry reaching them throws at config-write time (tomlBasicString(config.command) on a missing command in the codex TOML writer; [cfg.command,...cfg.args] spread of undefined in the opencode mapper), so a codex or opencode group with a remote server configured breaks on wake. The change types.ts: twin-patch the frozen McpServerConfig to trunk's discriminated union, exactly the shape after #3092 + #3220 (stdio arm with optional args/env/pluginRoot; http arm with url + optional headers). Install skills do not materialize this file; the patch keeps the registry tree self-consistent and identical to what the payload compiles against on trunk. codex-app-server.ts: the TOML writer emits url for http servers, plus an http_headers sub-table when headers are present (header keys quoted, since legal HTTP header names admit characters bare TOML keys reject). Stdio emission unchanged; args/env access now guards the widened optionality. The

nanocoai/nanoclaw PR #3229 reports: Type of Change [x] **Fix** - bug fix or security fix to source code Description What generateCode() in src/channels/telegram-pairing.ts mints pairing codes with Math.random(). This switches it to crypto.randomInt and widens the space from 4 to 6 digits. Why The pairing code **is** the authentication for this flow: presenting a valid code binds the sender's Telegram identity to an agent group — and on a fresh install promotes them to global owner (if (!hasAnyOwner()) grantRole({ role: 'owner' })). Two properties combine badly: 1. **Math.random() is not cryptographically secure.** V8's xorshift128+ state can be recovered from a handful of observed outputs, after which subsequent values are predictable. 2. **Codes do not expire** (by design, per the comment in the file) — a predicted code stays valid until consumed or invalidated. MAX_ATTEMPTS_PER_RECORD correctly bounds blind guessing, but does nothing against prediction — a predicted code succeeds on the first attempt. This matters most for multi-user installs.** Pairing is the onboarding path for every person sharing one bot, and codes are minted repeatedly from the same PRNG stream.

nanocoai/nanoclaw PR #3224 reports: Summary Preserve inbound messages when a platform reuses an identifier in a long-lived session database. Root cause Some platforms can restart or reuse their message-ID space. The existing primary-key insert then threw on the reused ID, and the inbound message was logged and dropped before it could be stored. Changes Treat an exact replay of an existing message as idempotent. Store a distinct colliding message under a deterministic #N suffix. Keep the host-owned even seq invariant and continue surfacing real sequence conflicts. Add regression coverage for collision handling, replay idempotency, and sequence monotonicity. Validation pnpm exec vitest run src/db/session-db.test.ts — 8 passed pnpm exec tsc --noEmit — passed Prettier check passed Fixture platform identifiers are synthetic. Fixes #3226 Related: #3075 (same insert, duplicate-delivery variant on Matrix)

Why it matters

Remote tools widen the trust boundary just as chat identifiers and pairing codes determine who can invoke them. Transport growth must not outrun authentication, replay protection or message ownership. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.

Current

The primary record was closed when captured on 2026-08-12. The tagged-release baseline was v2.1.54 published 2026-08-01T20:46:31Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nanocoai/nanoclaw/pull/3221. Supporting records are https://github.com/nanocoai/nanoclaw/pull/3229 and https://github.com/nanocoai/nanoclaw/pull/3224. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Authenticate every remote MCP endpoint, generate pairing codes with a CSPRNG and expiry, and key inbound custody by stable channel identity rather than a reusable platform ID alone. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.