you can give it real credentials without handing them to the model. every agent runs in its own sandbox, every credential lives outside it. the box is closed; you just use it.
you talk to your agent in Telegram. every chat — a dm, a group, or a topic inside a group — is its own Claude Code session, and they all share one memory.
a dm, a group, or a topic inside a group
every chat runs its own Claude Code session, keyed by chat and thread
separate working contexts, one chat-tagged memory they all read and write
start a fresh named session any time with /new, and move between them with /switch.
each agent runs in its own sandbox — its own files, its own scoped network, a tls-terminating proxy. it uses your accounts along the way without ever holding the keys. here is the whole path.
you message the agent like a person
a private tunnel to your host — no open ports
Claude Code runs sealed in its own sandbox: its own files, its own network
sealedthe reply comes back the same way.
the agent calls a service with a placeholder, not the real key
the proxy swaps in your real credential on the way out
Gmail · Linear · Notion · any API
the agent uses your credentials on every call. it can never read them — so a compromised agent still can't walk off with your keys.
the full security model covers the sandbox, credentials, network policy, and how it fails closed on a backend outage.
memory persists across every session and chat, and the agent treats it as untrusted data: what goes in is sanitized, what comes back is framed as information, never commands. recall shows when each memory formed and lets the model judge relevance, with no hidden staleness rules.
incoming memory is sanitized before it is ever stored
Hindsight by default, with an agent-managed MEMORY.md file as fallback
framed as information, not commands, and stamped with when it formed
most agents learn from every "hard-looking" turn, or never. right agent does neither. a small, cheap model watches each turn as it lands, and a smarter model only steps in to learn when a turn is actually worth it. your scheduled jobs improve the same way, and never change what you set up without telling you.
after each reply, a small, cheap model reads how that turn went. the routine ones it lets pass.
when a turn was genuinely hard, or you corrected it, a smarter model forks just that conversation, with the whole thread already in view, and writes a reusable skill. your chat keeps moving.
skills you stop using fade away, your corrections sharpen the ones you keep, and you pin the best from the dashboard.
no learning on every message, and no rigid rule like "five steps means save it". the cheap model watches every turn; the costly one runs only when it pays off, inside a daily budget you set.
one rule sits under all of it: nothing durable changes without telling you. how self-evolution works →
no separate dashboard to host, no second login. switch models, wire up MCP servers, and manage providers and the credentials behind them straight from chat. some commands open a built-in Mini App right inside Telegram, where you are already the allowed user.
| typical agent setup | right agent | |
|---|---|---|
| setup | wire the stack yourself over a weekend | curl installer, right init, right up |
| daily use | a service you operate from the cli | a bot you message in Telegram |
| control plane | a separate dashboard with its own login | slash commands and a Telegram Mini App, no second login |
| credentials | given to the agent, gateways wired by hand | held on the host, injected at the proxy, providers managed from the bot |
| isolation | opt-in, often skipped | per-agent sandbox by default |
| on failure | may fall back to a looser path | fails closed, diagnoses, retries |
| memory | replay the full history each turn | persistent, dated, model-judged recall |
| learning | you author skills and prompt-tune by hand | forks only the turns worth it and writes skills itself |
| recovery | manual fixes, often from scratch | self-heals, data is preserved |
then open a new shell and run right up, then message your bot.
one Claude subscription covers it: run as many agents as you want — cost scales with subscriptions, not agent count.