Cuiar
Sign inDownload

NanoClaw + Cuiar

The key stays outside the container.

  • ncl groups config
  • Key in the OneCLI vault
  • No host mount
Set it up Get Cuiar

NanoClaw runs each agent group in its own container, with only the mounts you give it. Cuiar fits that model. The Cuiar key stays in the OneCLI vault, the site passwords stay in the Cuiar vault, and the container reaches Cuiar over HTTPS.

Ask about your bank balance in Signal. The model sees the balance. It never sees a login.

NanoClaw does not document how OneCLI sends the key. Check that the first call reaches Cuiar with an Authorization: Bearer header.

A container box with the agent inside. A request leaves the container and passes a gate outside it, where the OneCLI vault adds the key. The request reaches mcp.cuiar.com, and the bank balance comes back into the container. The key never enters the box.

Setup

Add Cuiar to one agent group.

Each agent group gets its own servers. Add Cuiar only to the groups that need it.

  1. 1

    Install NanoClaw

    Skip this when it is installed.

    git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2
cd nanoclaw-v2 && bash nanoclaw.sh
  2. 2

    Add the server

    Do not edit groups/<folder>/container.json. NanoClaw writes it again at each start.

    ncl groups config add-mcp-server --id <group-id> --name cuiar --url https://mcp.cuiar.com/mcp
ncl groups restart --id <group-id>
  3. 3

    Give the key through the vault

    set-secrets replaces the whole list, so keep the current IDs in it.

    cuiar keys create nanoclaw --scope mcp
onecli secrets create --name Cuiar --type api_key --value "$CUIAR_KEY" --host-pattern mcp.cuiar.com
onecli agents set-secrets --id "$AGENT_ID" --secret-ids "<current ids>,<new id>"
  4. 4

    Ask

    @Andy which Cuiar workspaces do I have?

Route

HTTPS out, nothing in.

The container reaches mcp.cuiar.com over HTTPS and needs no host mount. The cuiar binary is not in the container, so the other routes need extra work that NanoClaw does not document.

Remote MCPmcp.cuiar.com/mcp
Best fit
With the key from the OneCLI vault. NanoClaw does not document MCP OAuth.
Local MCPcuiar mcp
Not tested
The command runs inside the container. Installing cuiar there is not documented.
CLIcuiar exec
Not tested
Same: the container has no cuiar binary.
Routineson a schedule
Works
NanoClaw tasks run four times a day or less without a script gate. Cuiar routines email the result.

Example tasks

Private questions, one container each

  • 01

    Check the rent

    “@Andy what is in my current account, and did the rent go out?”

    Bank workspace, read only. Nothing changes.

  • 02

    Get payslips

    “Download my last three payslips from the payroll portal.”

    The PDFs land on your computer. NanoClaw replies with the net pay per month.

  • 03

    Follow a claim

    ncl tasks create --group <id> --recurrence "0 9 * * 1-5" \
  --prompt "Check the claim page on the insurer's portal. Message me on Signal only when the status changes."

  • 04

    Renew a domain

    “Renew example.org for one year.”

    Cuiar asks for approval before it pays.

  • 05

    Watch the credit file

    “On the 1st of each month, sign in read-only to the credit bureau portal. Message me only when a new inquiry or a new account shows.”

Good to know

Admin approval
When the agent adds a server itself with add_mcp_server, an admin approves it from a card in a direct message.
Schedules
A task that runs more than four times a day needs a --script gate.
Two vaults
The OneCLI vault holds the Cuiar key. The Cuiar vault holds the site passwords. The model sees neither.

Templates to run from NanoClaw

All templates

Each template page shows the run_task or create_routine call to give NanoClaw.

More agents

All AI agents

Start on the Free plan.

The MCP server, the vault and unlimited routines are free. Steps that your own agent takes use no Cuiar credits.

Get CuiarDeveloper docs