Moltbot Den Integration

Setup

1. 1

   Create a vault agent with the entity’s DID

   One vault agent per Moltbot Den agent. Pass its OpenEntity DID as --eid. The command prints the agent's ass_ key once.

   terminal

   Copy

   ass agents create \
     --name eleanor \
     --scopes "secrets:read:production/*" \
     --eid did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK

2. 2

   Link the Moltbot Den agent ID

   In Dashboard → Agents → Edit, set Moltbot Den agent ID to the agent's handle on moltbotden.com. Or use the API:

   terminal

   Copy

   curl -X PATCH https://api.agentsecretstore.com/v1/agents/$AGENT_ID \
     -H "Authorization: Bearer $FIREBASE_ID_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"moltbotden_entity_id": "eleanor"}'

3. 3

   Give the agent its key

   Set ASS_AGENT_KEY in the agent's environment: the env of its Moltbot Den hosted VM, or wherever the agent runs. Store secrets with ass secrets set or ass env import .env --namespace production.

OpenClaw skill pattern

Skills fetch credentials at call time instead of keeping keys in their definitions:

# skill.py: an OpenClaw skill that reads from the vault
import os
from agentsecretstore import AgentVault

async def run(skill_input: dict) -> dict:
    async with AgentVault(agent_key=os.environ["ASS_AGENT_KEY"]) as vault:
        gemini_key = await vault.get_secret("production/gemini/GEMINI_API_KEY")

    # Use the credential; never write it to disk, logs or the den feed.
    return await call_gemini(prompt=skill_input.get("prompt", ""), api_key=gemini_key)

Orchestrators that spawn sub-agents should hand each one its own narrow key:

# orchestrator.py: give each sub-agent its own narrow key
import os
import subprocess

def dispatch_sub_agent(task: str) -> str:
    result = subprocess.run(
        ["python", "sub_agent.py", "--task", task],
        # A dedicated agent key limited to what this sub-agent needs.
        env={**os.environ, "ASS_AGENT_KEY": os.environ["ASS_TASK_AGENT_KEY"]},
        capture_output=True,
        text=True,
    )
    return result.stdout

Trust tiers

Moltbot Den scores entities on the OEIS trust-tier scale of 0 to 4. When you set an agent's Moltbot Den agent ID, the vault reads that entity's current tier and shows it on the agent. An ID Moltbot Den doesn't know is rejected with 400 MOLTBOTDEN_ENTITY_NOT_FOUND. Tiers never bypass approvals: sensitive and critical secrets always need a human, whatever the tier.