Daniel Smith | Building ClawQL Agents

2.6K posts

Daniel Smith | Building ClawQL Agents banner
Daniel Smith | Building ClawQL Agents

Daniel Smith | Building ClawQL Agents

@DanielSmithDev

Building @ClawQL Agent/MCP as the API and document intelligence platform for enterprises! PlatformEng/SRE/DevOps in a love-hate relationship with Kubernetes.

Los Angeles, CA Katılım Mayıs 2016
474 Takip Edilen797 Takipçiler
Sabitlenmiş Tweet
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
mcp-grpc-transport is now on npm (v0.1.0). Pluggable gRPC transport for MCP that supports: - Full protobuf surface (ListTools, CallTool, streaming ops, pagination, cancellation) - Bidirectional Mcp.Session stream (NDJSON compatibility) - gRPC health checking + optional server reflection - TLS/mTLS via env vars - Interceptors and custom options This is the transport many teams have been waiting for, especially those already running gRPC microservices. If you’re building production MCP servers and already operate in a gRPC-heavy environment, this should feel like a natural fit. It also pairs excellently with unified MCP servers that embed optimized internal layers (like GraphQL proxies for token efficiency). Installation & basic usage is straightforward (see code snippet in comments or npm page). One-liner integration via maybeStartGrpcMcpServer({ createMcpServer }). Perfect drop-in for teams tired of JSON serialization overhead or wanting native mesh routing. Docs & examples on the npm page. Built as part of the ClawQL stack but completely generic. Try it with ClawQL (now unified single-process) or your own MCP server. Feedback, issues, and contributions welcome. Repo: github.com/danielsmithdev… npm: npmjs.com/package/mcp-gr… Feedback, bug reports, and PRs are very welcome. Let’s make MCP even more cloud-native and production-ready together. #MCP #gRPC #AI #AgenticAI #TypeScript #Kubernetes #EnterpriseAI
Daniel Smith | Building ClawQL Agents tweet media
English
1
2
5
1.3K
nader dabit
nader dabit@dabit3·
you don't have to keep your laptop open for your agents to keep running just type /handoff and send your agent to the cloud with @DevinAI (and close your laptop) from there, your agent gets: - its own Linux VM - shell, IDE, browser - full desktop Computer Use - end-to-end test recordings - ready-to-review PRs - it's own review agent you can continue your session from your phone, computer, or anywhere with an internet connection and you can send as many sessions as you'd like in parallel.
English
18
12
160
31K
dawgyg - WoH
dawgyg - WoH@thedawgyg·
he never tried to reach out to their security team. he sent 2 support emails and 1 X post, and then dropped the info 3 weeks after. He couldnt even wait 30 days, and he isnt even smart enough to try security@ before support@. anyone whos first thought is to email support@company instead of security@company is doing this for the attention, not trying to protect people.
English
2
0
24
1.8K
John Carroll
John Carroll@yeahbutnahbut·
Loving the framing of the dogpile gang. guy finds flaw, guy email's security, guy emails some others guy waits, guy drops it publicly and it's him getting all the shit. not Reframe, the people ignoring the security and support emails that have legal obligations to protect the information they hold oh you didnt buy linked in premium to run around begging staff for a response, oh you could have done all these other things SECURITY@ SUPPORT@ dickheads. citing putting the users at risk but not thinking far enough to assume that data has already gone
impulsive@weezerOSINT

if you've ever used Reframe to get sober, your private journals, your craving logs, what triggered you, how bad it got, your name, your email, all of it is sitting in a database that anyone can read without logging in i unzipped the app and found a database key in a config file. thats it. thats all it took 357,939 users exposed. disclosed april 7, no response

English
8
2
36
10.1K
dawgyg - WoH
dawgyg - WoH@thedawgyg·
this kid weezer is doing everything he can to get paid on X via engagement since he cant do anything but download random APKs and then blast companies on the platform when they dont instantly respond to him. he's an idiot
Zack Korman@ZackKorman

Security people: This behavior is completely unacceptable. I don't care that you sent a few emails and got ignored. You don't get to drop this info publicly and put these users at greater risk. He's been called out by multiple people (@rez0__) and is doubling down. Not cool.

English
8
8
121
15K
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ So my point being we don’t know how urgent he thought it was. I imaging @weezerOSINT thought it was critical that this be fixed right away and was probably shocked when they didn’t respond as urgently as he thought they should. Possibly so urgent he needed to put major pressure?
English
1
0
0
14
Zack Korman
Zack Korman@ZackKorman·
Security people: This behavior is completely unacceptable. I don't care that you sent a few emails and got ignored. You don't get to drop this info publicly and put these users at greater risk. He's been called out by multiple people (@rez0__) and is doubling down. Not cool.
Zack Korman tweet media
English
49
13
252
75.6K
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ Yup just trying to figure out the nuance. Legally there’s no mandated window for disclosure and honest attempts to disclose protect you under the CFAA from being sued. Where do we draw the line? What is considered sufficient effort? Where’s the shared responsibility model here?
English
0
0
0
11
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ Sure there are many instances where researchers follow things perfectly and companies respond well. But there are also times where grey hat behavior successfully moves an otherwise obstinate company and forces them to take things seriously. Companies shouldn’t need to be forced
English
1
0
0
20
Zack Korman
Zack Korman@ZackKorman·
No one is denying that it’s the company’s fault. Obviously you’re right about all of that. But there’s a ton of space between “two emails they maybe didn’t even see (because they’re irresponsible)” and “it took a viral tweet”. These things happen all the time and don’t end in a viral tweet because the researcher finds a way in before it gets there. And I am thankful for that, because it helps protect people.
English
1
0
1
18
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@rez0__ @ZackKorman @63green Zero trust. We all must assume they already had it. Assuming otherwise is folly and arrogance implying bad actors aren’t fast or smart enough to arrive at the conclusion on their own. Public disclosure prevents further compromise beyond the already compromised blast radius.
English
0
0
0
15
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@rez0__ @ZackKorman @63green If you’re running with a zero trust approach then you need to assume that any info you have regarding compromise is already possessed by malicious parties Being obscure or delayed in reporting means not enough pressure on company to act while tipping off malicious actors as well
English
1
0
0
30
Joseph Thacker
Joseph Thacker@rez0__·
@DanielSmithDev @ZackKorman @63green Do you think 23 day disclosure timelines make any sense? And do you think this could have been disclosed without the source of the vuln being posted? That’s my issue. Do the exact same thing but don’t say the db key was in the app
English
1
0
1
58
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ There’s no excuse needed. There’s a difference between reactive and proactive security. It shouldn’t take a post going viral for you to be proactively looking out for possible issues. This should have been found by the team not a third party and then ignored for 25 days after.
English
1
0
0
23
Zack Korman
Zack Korman@ZackKorman·
It’s not the 350k people’s fault either though. That’s the issue. Yea the company sucks but that doesn’t change the duty we owe these people. Saying it’s a lot of work, true, but so is finding this to begin with. Caring about these users means we owe that work, or owe it to hand to someone who will do that work. Saying “sorry it was too hard to get in touch” doesn’t excuse this.
English
1
0
0
23
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ He didn’t have a LinkedIn account. It’s not his fault the company doesn’t have a security contact. If a company tells me the only way to reach them is TikTok and bluesky and you need to make a video tagging them, I probably wouldn’t do that either. Best practices matter always.
English
2
0
0
44
Zack Korman
Zack Korman@ZackKorman·
@DanielSmithDev @63green @rez0__ Why wouldn’t you even try a LinkedIn message? Or a post like “hey I found something bad in reframe I need help getting in contact”. All of that is much lower risk to get this fixed. It’s because the goal wasn’t to get it fixed. It was to blast them online for attention.
English
1
0
1
41
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ I would think it depends on how sensitive the data is. There’s a balance to be had. Are you familiar with zero trust security? With that you assume you’re always possibly compromised at any given moment. We should assume that if researcher had this then malicious actors do too.
English
1
0
0
32
Zack Korman
Zack Korman@ZackKorman·
Yes and you’re absolutely right, sometimes you have no choice. Is “I sent two emails and a tweet reply saying check your email” enough to justify a full public dump? My view is definitely no. If his goal was to get it resolved without that risk, there are so many things to try prior to this. He didn’t do that because he was happy to post it publicly because, well, likes.
English
1
0
0
32
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ You’re barking up the wrong tree. I myself have exploited smart contracts that were actively vulnerable to lock them down and prevent user compromise. Sometimes the company doesn’t want to listen and you need to take action even if those actions aren’t always perceived well. Life
Daniel Smith | Building ClawQL Agents tweet media
English
1
0
2
39
Zack Korman
Zack Korman@ZackKorman·
Why do you think I am defending the company? If your data was in that list, you’d greatly prefer the researcher found a way to get through to the company without having it posted publicly, given that increases the odds of a threat actor stealing the data. You’d not say “well he tried two emails so what else could he do”
English
2
0
0
48
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@ZackKorman @63green @rez0__ Because you’re taking an illogical position whiteknighting for a company that couldn’t care less about protecting its own vulnerable and substance addicted users by following best practices. Everyone else sees how horrible it is and you’re attacking the whistleblower. Nonsense.
English
1
0
2
42
Zack Korman
Zack Korman@ZackKorman·
@63green @rez0__ This isn’t my company lol. Why does everyone think that? Are you all some bad bot army?
English
2
0
1
152
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@dabit3 I don’t think they’re here to build connections. I think they want to get as much engagement as possible to squeeze out money from the platform. Or build the account up and then sell it to a bot farm. Otherwise I don’t understand the logic behind it and can’t think of why else.
English
0
0
2
168
nader dabit
nader dabit@dabit3·
do people who run automated AI replies realize that most everyone is just blocking or muting them? what is the value proposition of doing this? they're just alienating the majority of the people who they are actually wanting to build a connection with
English
29
2
79
4.9K
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
@theScottrHall @rwdaigle gRPC with code mode and graphql internal introspection to trim both request and response payloads. Reduces token usage which of course saves cost but more importantly leads to better average performance when context doesn’t bloat. Basically how I designed @ClawQL from beginning
English
1
0
1
37
Ryan Daigle
Ryan Daigle@rwdaigle·
I was wrong MCP > CLI
English
10
1
34
50.5K
Daniel Smith | Building ClawQL Agents
Daniel Smith | Building ClawQL Agents@DanielSmithDev·
It’s a skill issue. Use @ClawQL as an MCP to add the skills. We give you memory, efficient API interaction, and full end to end document pipelines to ingest and query anything. Cache your work for temporary multi-agent access to same data. Memory_ingest anything permanently.
Daniel Smith | Building ClawQL Agents tweet media
Taelin@VictorTaelin

seriously, working with AI is MISERABLE for one and only one reason: having to re-explain the same thing "oh yeah this new session obviously doesn't know what proper case trees are, so let me explain it for the 5000th time in my life" I'm tired AGENTS.md doesn't solve this because it is impossible to fit the entire domain knowledge without nuking the context - it would be 1m+ tokens worth RAGs don't solve this, the agent won't search unknown unknowns SKILLs don't solve this unless I keep like a collection of 1750 skills with specific cuts of domain knowledge for each possible subset of my domain that I might need in a given chat, but that's a lot of manual work recursive LLMs or whatever don't solve this for the same reason, you can't dump a domain book and expect the AGENT will magically guess that it is supposed to search for a specific bit knowledge. unknown unknowns fine tuning doesn't solve this (OSS models suck and OpenAI / Anthropic gave up on user fine tuning) I honestly think a good product around fine tuning on your domain would be a major hit and an underdog lab should take this opportunity

English
0
0
0
47

Keşfet

@dabit3 @DevinAI @thedawgyg @yeahbutnahbut @ZackKorman @63green @rez0__ @weezerOSINT