Hey HN,
I’ve been building Solidclaw, a small local credential broker + model proxy for OpenClaw.
I started it because I was increasingly uncomfortable with:
API keys living in random .env files
Provider keys sitting inside OpenClaw configs
Tool secrets bundled directly into plugins
Credentials duplicated across services
It felt messy and fragile — especially when experimenting with multiple providers and tools.
So Solidclaw sits in front and handles:
Keeping provider keys out of OpenClaw
Isolating tool secrets
Scoping model access via tokens
Injecting secrets only at runtime
The idea is simple: clean separation between orchestration and secrets.
Less key sprawl. Smaller blast radius. More explicit access control.
It’s very early stage and evolving fast. I’m iterating based on real usage while building AI infra tools.
If you're working with OpenClaw — or generally building local-first AI infra — I’d genuinely appreciate feedback, criticism, or ideas.
Happy to share architecture details if there’s interest.
