@mslipper
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
Dune now has it's own AI agent co-worker called Mentat, and just like in Frank Herbert's Dune: "The Mentats in Duneare walking supercomputers, capable of storing, processing and relaying vast amounts of information."
In a few minutes I, or anyone on our team, can gain deep insights into what customers are asking for, how our product works, when we are shipping a new dataset, what adoption looks like and even build features outright!
Our Mentat agent lives natively in Slack and has access to all our tools: Linear, GitHub, Notion, Amplitude, Google Drive, meeting notes+++ It can analyse data, customer calls, put up PRs and more.
We've found that it's very important to give the agent maxim context to succeed. Especially lacking access to meeting context was initially a blocker. We therefore flipped from taking and sharing meeting notes being the exception to it being the default. Downstream we do a lot of filtering and cleaning so permissions and sensitive info is handled appropriately. Anyone is of course free to turn it off, but we find the vast majority of meetings can and should be shared context internally.
Mentat is based on @paradigm's open source Centaur agent platform. This is great because we don't get locked in to any of the AI labs and we can modify it as we see fit, including granular permissions to ensure we stay compliant and secure. We have a dedicated engineer working on this tool who also contribute to Centaur directly.
Matthew Slipper retweeted
The most interesting thing about Centaur is that it's not an AI project, it's a security project. There's very little AI here, beyond "run harness in cloud".
But there's a lot about "who can access what how when", which is the biggest barrier to AI agent deployment.
Announcing Centaur 2.0!
Centaur is frontier, agentic infrastructure that you own. Centaur is like Claude Tag, but open source and on steroids.
Centaur 2.0 can connect to everything you have access to, and can reason over it next to where you work, either in Slack, Discord, Teams or in your local Codex or Claude Code via an MCP.
But context isn't useful if it can be accessed by anyone, so we rebuilt Centaur from the ground up for security. Centaur obviously doesn't have access to secrets because we're leveraging egress proxies.
Centaur 2.0 takes that a step further enabling administrators to configure who can access what from where. This means that Centaur can have access to private information that you normally wouldn't feel comfortable giving it access to (e.g. DMs or sensitive channels and docs) but only expose it to authorized principals.
It also means you can add Centaur to external channels and leverage it as a virtual colleague that doesn't live only in your Slack, for example, but also your Slack Connect channels! This is extremely powerful as we start moving to a world where agents cross organizational boundaries.
Also in case anyone's wondering, yes we rewrote it in Rust! Centaur is now way way more stable at durably executing threads, and its workflow engine is now based on Absurd.
We have been operating Centaur since January, officially launched and Open Sourced it in May, and now we're full speed towards making it the #1 open source agentic infrastructure.
To succeed at that, I'm thrilled to welcome @mslipper to the @paradigm team who will be leading all our Applied AI work, while continuing to maintain and extend Iron Proxy as the leading secure secret access for agents. Welcome Matt, it's an honor after all these years of knowing you!
Read the full blogpost below, and apply to join our team!
Today’s the day: I've joined @paradigm to lead Centaur. First up, launch 2.0. Next, we grow the team.
Announcing Centaur 2.0!
Centaur is frontier, agentic infrastructure that you own. Centaur is like Claude Tag, but open source and on steroids.
Centaur 2.0 can connect to everything you have access to, and can reason over it next to where you work, either in Slack, Discord, Teams or in your local Codex or Claude Code via an MCP.
But context isn't useful if it can be accessed by anyone, so we rebuilt Centaur from the ground up for security. Centaur obviously doesn't have access to secrets because we're leveraging egress proxies.
Centaur 2.0 takes that a step further enabling administrators to configure who can access what from where. This means that Centaur can have access to private information that you normally wouldn't feel comfortable giving it access to (e.g. DMs or sensitive channels and docs) but only expose it to authorized principals.
It also means you can add Centaur to external channels and leverage it as a virtual colleague that doesn't live only in your Slack, for example, but also your Slack Connect channels! This is extremely powerful as we start moving to a world where agents cross organizational boundaries.
Also in case anyone's wondering, yes we rewrote it in Rust! Centaur is now way way more stable at durably executing threads, and its workflow engine is now based on Absurd.
We have been operating Centaur since January, officially launched and Open Sourced it in May, and now we're full speed towards making it the #1 open source agentic infrastructure.
To succeed at that, I'm thrilled to welcome @mslipper to the @paradigm team who will be leading all our Applied AI work, while continuing to maintain and extend Iron Proxy as the leading secure secret access for agents. Welcome Matt, it's an honor after all these years of knowing you!
Read the full blogpost below, and apply to join our team!
The best open source software comes out of tooling a company depends on: Centaur embodies the best of that. People at paradigm and @tempo use Centaur every day along with many others. Today it gets better: Permissions are now first-class in the runtime, and MCP support means Centaur goes wherever you work.
For those following iron-proxy, I’ll keep stewarding it as a standalone project, but it will come under the paradigm umbrella and it will be an integral part of Centaur’s credential management layer. And, yes, we’re hiring. If you like working across distributed systems, security, developer tools, and applied AI, DM me or apply here: jobs.ashbyhq.com/paradigm/b8….
This is really cool to see. Self-hosted sandboxes + default-deny egress is the future. Most iron-proxy users are already running agents in their own VPCs; now they can run Claude Managed Agents there too.
iron-proxy now supports MCP inspection and policy enforcement. Whitelist exactly the tools your agent needs, and audit every call.
This is where other tools like Squid fall short. They understand URLs, but not the protocols agents are actually speaking.
This is available in iron-proxy v0.23.0+. Release notes here: github.com/ironsh/iron-proxy…
Pin versions, set a minimum release age, and run an egress proxy in front of anything running potentially untrusted code. Do this now, before this happens again next week.
Seeing more and more folks opting to bring their own compute rather than using sandboxes. Boring EC2 instances / k8s pods often work just fine.
1/ Malware continues to dump secrets on GitHub. Today's Bitwarden CLI backdoor is just the latest of many examples.
Hostname allowlists can't tell good GitHub traffic from bad. You need a filter that actually understands the GitHub API. Here's how.
4/ At this point everything left looks legitimate. As a final layer of defense, add a judge transform to read the request body in flight and classify it against a policy you write in English:
5/ This matters especially for coding agents. Even if the agent gets prompt-injected into posting a "comment" full of secrets, the comment still has to pass the judge.
If your agent can reach GitHub, today's a good day to secure it.
iron.sh
New in iron-proxy v0.15: the judge transform. Give your config a prompt, and it'll evaluate matching requests against it via an LLM. Support both Anthropic and OpenAI backends.
Default-deny still applies: the judge can only reject.
Release notes: github.com/ironsh/iron-proxy…
Hat tip to @brexhq's CrabTrap, which inspired this design: github.com/brexhq/CrabTrap