Matthew Slipper

applied AI @paradigm

[Matthew Slipper @mslipper]

4/ Centaur users: upgrade to v2026.10.9 and follow the release notes to roll iron-proxy pods in place. Thanks to Aabid K for reporting the MCP vulnerbaility.

[Matthew Slipper @mslipper]

1/ iron-proxy v0.53.0 is live. Please upgrade now, as it includes fixes for two security issues: a contained agent could bypass MCP tool allowlists (fixed in v0.50.0) or enforced Postgres RLS (fixed in v0.53.0).

[Matthew Slipper @mslipper]

3/ If you use RLS enforcement, check your database for functions or procedures created by proxy clients before the upgrade. The advisory explains what to look for.

[Georgios Konstantopoulos @gakonst]

btw we now let you bring your own postgres in centaur

https://t.co/8efAwoEwog

[Matthew Slipper @mslipper]

@SamBroner @gakonst Glad to hear it! If you’re not already in our community Slack DM me your email and I’ll get you and your team added.

[hagaetc @hagaetc]

Dune now has it's own AI agent co-worker called Mentat, and just like in Frank Herbert's Dune: "The Mentats in Duneare walking supercomputers, capable of storing, processing and relaying vast amounts of information."

In a few minutes I, or anyone on our team, can gain deep insights into what customers are asking for, how our product works, when we are shipping a new dataset, what adoption looks like and even build features outright!

Our Mentat agent lives natively in Slack and has access to all our tools: Linear, GitHub, Notion, Amplitude, Google Drive, meeting notes+++ It can analyse data, customer calls, put up PRs and more.

We've found that it's very important to give the agent maxim context to succeed. Especially lacking access to meeting context was initially a blocker. We therefore flipped from taking and sharing meeting notes being the exception to it being the default. Downstream we do a lot of filtering and cleaning so permissions and sensitive info is handled appropriately. Anyone is of course free to turn it off, but we find the vast majority of meetings can and should be shared context internally.

Mentat is based on @paradigm's open source Centaur agent platform. This is great because we don't get locked in to any of the AI labs and we can modify it as we see fit, including granular permissions to ensure we stay compliant and secure. We have a dedicated engineer working on this tool who also contribute to Centaur directly.

[Matthew Slipper @mslipper]

@0xkaiserkarel @gakonst Yep. https://t.co/xzBSEQ1BuE has guides on how to integrate

[Matthew Slipper @mslipper]

@0xkaiserkarel @gakonst Yes. The tools never receive any usable credentials.

[Georgios Konstantopoulos @gakonst]

The most interesting thing about Centaur is that it's not an AI project, it's a security project. There's very little AI here, beyond "run harness in cloud".

But there's a lot about "who can access what how when", which is the biggest barrier to AI agent deployment.

[Matthew Slipper @mslipper]

For those following iron-proxy, I’ll keep stewarding it as a standalone project, but it will come under the paradigm umbrella and it will be an integral part of Centaur’s credential management layer. And, yes, we’re hiring. If you like working across distributed systems, security, developer tools, and applied AI, DM me or apply here: https://t.co/JfROBAFNsN.

[Matthew Slipper @mslipper]

Today’s the day: I've joined @paradigm to lead Centaur. First up, launch 2.0. Next, we grow the team.

[Georgios Konstantopoulos @gakonst]

Announcing Centaur 2.0!

Centaur is frontier, agentic infrastructure that you own. Centaur is like Claude Tag, but open source and on steroids.

Centaur 2.0 can connect to everything you have access to, and can reason over it next to where you work, either in Slack, Discord, Teams or in your local Codex or Claude Code via an MCP.

But context isn't useful if it can be accessed by anyone, so we rebuilt Centaur from the ground up for security. Centaur obviously doesn't have access to secrets because we're leveraging egress proxies.

Centaur 2.0 takes that a step further enabling administrators to configure who can access what from where. This means that Centaur can have access to private information that you normally wouldn't feel comfortable giving it access to (e.g. DMs or sensitive channels and docs) but only expose it to authorized principals.

It also means you can add Centaur to external channels and leverage it as a virtual colleague that doesn't live only in your Slack, for example, but also your Slack Connect channels! This is extremely powerful as we start moving to a world where agents cross organizational boundaries.

Also in case anyone's wondering, yes we rewrote it in Rust! Centaur is now way way more stable at durably executing threads, and its workflow engine is now based on Absurd.

We have been operating Centaur since January, officially launched and Open Sourced it in May, and now we're full speed towards making it the #1 open source agentic infrastructure.

To succeed at that, I'm thrilled to welcome @mslipper to the @paradigm team who will be leading all our Applied AI work, while continuing to maintain and extend Iron Proxy as the leading secure secret access for agents. Welcome Matt, it's an honor after all these years of knowing you!

Read the full blogpost below, and apply to join our team!

[Matthew Slipper @mslipper]

The best open source software comes out of tooling a company depends on: Centaur embodies the best of that. People at paradigm and @tempo use Centaur every day along with many others. Today it gets better: Permissions are now first-class in the runtime, and MCP support means Centaur goes wherever you work.

[Matthew Slipper @mslipper]

@GrahamAnd3rson Glad you like it!

[Matthew Slipper @mslipper]

Huge launch. Self-hosted agent systems are the future, and egress enforcement is what makes them safe.

iron-proxy is the egress layer inside centaur. We went deep on the hard parts like OAuth brokering, HMAC signing, and Postgres MITM for RLS.

[Georgios Konstantopoulos @gakonst]

Open Sourcing Centaur: Multiplayer, self-hosted, secure agents for Slack.

Centaur has been transforming how @paradigm and @tempo invest, build and research.

Now you can run it yourself on infrastructure you control. Instructions below.

[Matthew Slipper @mslipper]

This is really cool to see. Self-hosted sandboxes + default-deny egress is the future. Most iron-proxy users are already running agents in their own VPCs; now they can run Claude Managed Agents there too.

[Claude @claudeai]

Live from Code with Claude London: we're launching self-hosted sandboxes (public beta) and MCP tunnels (research preview) in Claude Managed Agents.
Run agents inside your own perimeter, with your security controls applied by default.

[Matthew Slipper @mslipper]

@jjacky You don’t! Inject them at the network so the agent never gets the secret. We’re building this at https://t.co/86wmD5kQwS.

[Matthew Slipper @mslipper]

This is available in iron-proxy v0.23.0+. Release notes here: https://t.co/6l5HW5sbY3

[Matthew Slipper @mslipper]

iron-proxy now supports MCP inspection and policy enforcement. Whitelist exactly the tools your agent needs, and audit every call.

This is where other tools like Squid fall short. They understand URLs, but not the protocols agents are actually speaking.

[Matthew Slipper @mslipper]

Pin versions, set a minimum release age, and run an egress proxy in front of anything running potentially untrusted code. Do this now, before this happens again next week.

[Socket @SocketSecurity]

🚨 BREAKING: 84 TanStack npm packages were compromised in an ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware.

Socket flagged every malicious version within six minutes of publication. This is a developing story.