Phlogistique
Joined 14 years ago
Joined 14 years ago
You could restrict where it can go with domain allowlists but that has insufficient granularity. The same URL can serve a legitimate request or exfiltrate data depending on what's in the headers or payload: see https://embracethered.com/blog/posts/2025/claude-abusing-net...
So you need to restrict not only where the agent can reach, but what operations it can perform, with the host controlling credentials and parameters. That brings us to an MCP-like solution.
As far as I can tell, they control three parameters:
* Where the heat comes from (top, bottom, or both)
* Whether or not ventilation is activated
* The temperature
There is also a dial for temperature, but not for the other two parameters. I am not sure whether every combination is covered by the "program" dial. I am not sure whether or not my understanding is even correct.
I would say it's an 7.5 out of 10 on the nightmare bicycle scale.
That said, in a similar vein, you could probably create a bundler that takes a shell script and bundles it with busybox to create a static program.
It does some merge magic so that PR B shows the correct diff; and does so without needing to force push, so on your side you can just "git pull" and continue working.
Of course I expect this repo to become obsolete when GitHub makes their native stacking public.