| name | openhuman-owl-install-proxy |
| description | OpenHuman-optimized Owl proxy installer — automated setup of Owl proxy defense stack for OpenHuman agent platform with human-in-the-loop escalation, consent-gated tier progression, and privacy-first credential management. Use when use when installing owl proxy for openhuman platform, configuring privacy-first anti-bot defense for human-agent workflows, or setting up consent-gated proxy escalation Triggers on keywords: openhuman, owl, install, proxy, privacy, consent, human-in-the-loop.
|
| allowed-tools | Read, Write, Bash, Edit, Grep, Glob |
| user-invocable | true |
| mcp-servers | ["filesystem","github","docker"] |
OpenHuman Owl Install Proxy
context
OpenHuman-optimized Owl proxy installer — automated setup of Owl proxy defense stack tailored for the OpenHuman agent platform. Unlike the OpenCode variant, this installation emphasizes human-in-the-loop consent gates for tier escalation, privacy-first credential management with zero-knowledge encryption, and audit trails for every proxy action. Designed for environments where human oversight of automated agent actions is a requirement, not an option.
instructions
Step 1: Environment Assessment
- Verify OpenHuman platform is installed and running (
openhuman status)
- Check existing proxy and privacy configuration in
~/.openhuman/config.yaml
- Identify target AI providers and their data residency requirements (GDPR, CCPA)
- Assess compliance requirements — SOC2, HIPAA, or organizational policies
Step 2: Owl Proxy Stack Installation (Privacy-First)
- Clone and build the Owl proxy defense stack with privacy extensions
- Configure consent-gated tiers — each tier escalation requires human approval:
- Tier 1: HTTP/1.1 standard requests (auto-approved, lowest risk)
- Tier 2: HTTP/2 with header rotation (requires notification)
- Tier 3: JA3 TLS fingerprint spoofing (requires explicit consent)
- Tier 4: WebSocket browser emulation (requires explicit consent + reason)
- Tier 5: Full headless browser (requires manager-level approval)
- Set up zero-knowledge credential vault — keys encrypted client-side, never transmitted
- Configure audit logging — every proxy action logged with timestamp, tier, and consent status
Step 3: OpenHuman Integration
- Modify OpenHuman config — route agent API calls through Owl proxy
- Set up consent UI hooks — integrate with OpenHuman's approval dashboard
- Configure privacy zones — define which data types bypass proxy (PII, medical, legal)
- Test consent flow — verify escalation triggers consent prompt correctly
- Set up breach detection — alert if proxy detects unauthorized data exfiltration
Step 4: Generate Installation Report
## OpenHuman Owl Proxy Installation Report
### Environment
- OpenHuman version: [detected version]
- Compliance requirements: [GDPR/CCPA/SOC2/HIPAA]
- Data residency: [region(s)]
### Proxy Configuration
- Owl version: [installed version]
- Consent tier: enabled (gated escalation)
- Zero-knowledge vault: [status]
- Audit logging: [status]
### Consent Gates
| Tier | Protocol | Consent Level | Auto-Escalate |
|------|----------|---------------|---------------|
| 1 | HTTP/1.1 | Auto-approved | No |
| 2 | HTTP/2 | Notification | After 30s |
| 3 | JA3 | Explicit | No |
| 4 | WS | Explicit+Reason | No |
| 5 | Browser | Manager | No |
### Privacy Verification
- [ ] Zero-knowledge encryption verified
- [ ] Consent flow tested end-to-end
- [ ] Audit trail completeness verified
- [ ] Privacy zones configured and tested
- [ ] Breach detection alerts firing correctly
constraints
- NEVER auto-escalate to Tier 3+ without explicit human consent.
- NEVER store credentials in plaintext — zero-knowledge encryption is mandatory.
- NEVER disable audit logging — every proxy action must be traceable.
- ALWAYS respect data residency requirements when routing through proxy tiers.
- ALWAYS provide a human-readable explanation for each tier escalation request.
- ALWAYS maintain a separate audit trail from the OpenCode variant.
examples
Example: Privacy-First Installation
Input: "Install Owl proxy for OpenHuman with GDPR compliance and Claude provider"
Output:
## OpenHuman Owl Proxy Installation Report
### Environment
- OpenHuman version: 1.2.0
- Compliance requirements: GDPR
- Data residency: EU-West
### Proxy Configuration
- Owl version: 2.1.0-privacy
- Consent tier: enabled (gated escalation)
- Zero-knowledge vault: active (age + client-side)
- Audit logging: active (append-only, 90-day retention)
### Consent Gates
| Tier | Protocol | Consent Level | Auto-Escalate |
|------|----------|---------------|---------------|
| 1 | HTTP/1.1 | Auto-approved | No |
| 2 | HTTP/2 | Notification | After 30s |
| 3 | JA3 | Explicit | No |
### Privacy Verification
- [x] Zero-knowledge encryption verified
- [x] Consent flow tested end-to-end
- [x] Audit trail completeness verified
- [x] Privacy zones configured (PII bypass active)
- [x] Breach detection alerts firing correctly
