Forem: chataclaw

Talk to Your AI — Meet Talkative Lobster

chataclaw — Thu, 12 Mar 2026 12:09:16 +0000

Have you ever wanted to just talk to your AI assistant? Like, literally speak into your microphone and hear it respond naturally?

I work with AI all day, and sometimes typing feels... slow. Copy-pasting is tedious. Sometimes I'm cooking, walking, or just tired of staring at a screen. I wanted something that felt like a real conversation.

So I built Talkative Lobster — a desktop app that turns your voice into AI conversation and back again.

What It Does

You speak  →  Speech-to-Text  →  LLM  →  Text-to-Speech  →  You hear

You talk into your mic, the AI thinks, and then speaks back to you. No typing, no copy-pasting — just natural back-and-forth conversation.

Key features:

Interrupt anytime — Just start talking to cut in mid-response, like a real conversation
Works offline — Local whisper.cpp and Piper TTS when you need privacy or no network
Japanese support — VOICEVOX and Kokoro voices, plus "aizuchi" (those little "mm-hmm" sounds)
Multiple providers — ElevenLabs, OpenAI, or local options for both STT and TTS
Privacy-first — API keys encrypted on your machine, everything routes through your own gateway

How It Works

Voice Detection

The app uses Silero VAD (Voice Activity Detection) — a neural network trained on real speech patterns. This means it knows when you're actually talking versus when there's background noise, music, or keyboard clicks.

Speech-to-Text Options

ElevenLabs Scribe — Best accuracy, fastest
OpenAI Whisper — Reliable, widely used
whisper.cpp — Runs locally, no network needed

Text-to-Speech Options

ElevenLabs — Most natural voices
VOICEVOX — Great for Japanese
Kokoro — Japanese + English
Piper — Lightweight, runs offline

LLM (OpenClaw Gateway)

The AI part runs through OpenClaw — a local gateway that:

Lets you switch models without code changes
Handles rate limits gracefully
Keeps all your API keys in one place

The Challenges I Faced

Challenge 1: The Echo Problem

At first, the AI's voice was triggering the microphone, creating infinite loops. 😅

Solution: A speaker monitor that "subtracts" the audio output from the input stream. Now only your voice triggers the AI.

Challenge 2: Latency

3-4 second delays made conversations feel robotic and awkward.

Solution:

Stream responses — start speaking as soon as the first tokens arrive
Optimized audio buffers — balance latency vs. quality
Added "aizuchi" sounds — those little "mm-hmm" fillers during thinking time

Challenge 3: Japanese Support

Most TTS voices sound robotic in Japanese. And Japanese conversations have those subtle "aizuchi" sounds that feel unnatural without them.

Solution: Integrated VOICEVOX and Kokoro for natural prosody, and added optional aizuchi sounds during thinking.

Try It Out

Prerequisites

Node.js 20+
pnpm
An OpenClaw gateway running locally

Quick Start

git clone https://github.com/coo-quack/talkative-lobster.git
cd talkative-lobster
pnpm install
pnpm dev

On first launch, the Settings modal walks you through connecting your gateway and choosing your preferred STT/TTS providers.

Downloads

Pre-built binaries available:

Platform	Link
macOS (Apple Silicon)	DMG
macOS (Intel)	DMG
Windows	EXE
Linux	AppImage

What's Next

More TTS providers (Azure, Google Cloud)
Voice presets for different use cases
Conversation history with search
Custom wake words
Mobile companion app

Final Thoughts

Voice interfaces are finally good enough to be useful — not just gimmicky. The combination of accurate speech recognition, fast LLMs, and natural text-to-speech creates something that feels genuinely conversational.

If you've ever wanted to just talk to your AI while doing something else — cooking, walking, debugging at 2 AM — give Talkative Lobster a try.

Links:

📂 GitHub Repository
📖 Documentation

Built with 🦞 by the coo-quack team

Stop Claude Code from leaking your secrets — introducing sensitive-canary

chataclaw — Mon, 23 Feb 2026 11:46:45 +0000

The problem

Claude Code is powerful. That's exactly what makes it risky.

Without realizing it, you might:

Ask Claude to "take a look at" your .env file
Paste an AWS key into the terminal for a quick sanity check
Let Claude run cat .env.production

All of these send your secrets and PII straight to the Anthropic API. Once they leave your machine, they're out of your hands.

And here's the part people miss: you don't have to type secrets into the prompt for them to leak. Claude Code autonomously reads files as context. It might pick up your .env without you asking. That's a vector most developers don't think about.

What sensitive-canary does

sensitive-canary is a zero-config, fully local Claude Code plugin that intercepts secrets and PII before they reach the API. No external servers. No configuration. No API keys.

cat .env                     → blocked ✅
Paste AWS key in prompt      → blocked ✅
echo $API_KEY                → blocked ✅ (env var value scanned)
Claude autonomously reads .env → blocked ✅

When a block triggers, you see exactly what was caught:

🐦 sensitive-canary: sensitive data detected — blocked

  [Secret] AWS Access Key ID (aws-access-key): AKIA****MPLE

Zero-config. Fully local.

sensitive-canary runs entirely on your machine. No data leaves to a third-party service. Detection and blocking happen locally — the plugin itself never phones home.

Install it in two commands and it starts protecting you immediately. No config files, no environment variables, no restart required.

Two hooks, two layers of protection

UserPromptSubmit hook — runs before every prompt is sent to the API. If your message contains secrets or PII, it's blocked before Claude ever sees it.

PreToolUse hook — runs before Claude uses the Read or Bash tool. This is the critical one.

Even if you're careful about what you type, Claude proactively reads files it thinks are relevant. This hook stops that at the source:

Blocks .env and .env.* files unconditionally by filename (before contents are ever read)
Scans file contents before Claude reads them
Catches inline secrets in Bash commands (echo AKIAIOSFODNN7EXAMPLE)
Looks up env vars referenced in commands and checks their actual values

What gets detected

29 secret types, sourced from gitleaks and TruffleHog detector definitions:

Category	Examples
Cloud	AWS Access Key ID
Source control	GitHub PAT, GitLab PAT, GitHub fine-grained token
AI services	Anthropic API key, OpenAI API key / project key
Communication	Slack token, Discord webhook, Telegram bot token
Payment	Stripe secret/restricted key, credit cards (Luhn-validated)
Email services	SendGrid, Mailgun, Mailchimp
Auth	JWT, PEM private keys, database connection strings

PII detection: email addresses, US SSNs, US/JP phone numbers, Japanese postal codes, private IPv4 addresses.

Entropy filtering reduces false positives — API_KEY=placeholder won't trigger a block.

Install in two commands

Inside a Claude Code session:

/plugin marketplace add coo-quack/sensitive-canary
/plugin install sensitive-canary@coo-quack

No restart, no config files, no API keys. Done.

When you need to share secrets intentionally

Add a tag to your prompt:

[allow-secret] Please review my .env.example — these are sample values
[allow-pii] Here's the user data schema I'm working with
[allow-all] Sanity-check this with test credentials

Tags apply only to the message they appear in. They don't carry over to the next turn.

Summary

Without sensitive-canary	With sensitive-canary
`cat .env` → full contents sent to Claude ❌	Blocked by filename before Claude reads it ✅
Paste `AKIAIOSFODNN7EXAMPLE` in prompt ❌	Blocked before the API call ✅
`echo $API_KEY` with live key ❌	Env var value scanned and blocked ✅
Claude autonomously reads `.env` as context ❌	Blocked at the PreToolUse hook ✅
Requires setup and external accounts ❌	Zero-config, fully local, no external calls ✅

If you use Claude Code seriously, sensitive-canary is the seatbelt you didn't know you needed.

🔗 Docs: https://coo-quack.github.io/sensitive-canary/
🐙 GitHub: https://github.com/coo-quack/sensitive-canary

I Built an MCP Server to Fix 21 Things LLMs Are Bad At

chataclaw — Mon, 16 Feb 2026 09:39:52 +0000

title: "I Built an MCP Server to Fix 21 Things LLMs Are Bad At"
published: true
tags: ai, mcp, opensource, tools

cover_image: https://i.imgur.com/la0C54P.png

title: "I Built an MCP Server to Fix 21 Things LLMs Are Bad At"
published: true

tags: ai, mcp, opensource, tools

The Problem: When AI Hallucinates the Basics

Picture this: You're vibe coding with Claude, building something cool. You ask it to calculate 2^128 and it confidently tells you it's "340282366920938463463374607431768211456" — except it's wrong. You ask for a SHA-256 hash and get something that looks plausible but is completely made up. You need a UUID and receive 12345678-1234-1234-1234-123456789abc (which, let's be honest, is faker than your enthusiasm at 9 AM meetings).

LLMs are incredible at reasoning, writing, and creative tasks. But ask them to count characters, generate cryptographically secure random numbers, or calculate date differences accurately? Hallucination city.

Here's the thing: individual tools exist for some of these problems. But when you're in flow, switching context to grab a calculator, run date commands, or fire up an encoding tool kills momentum. I wanted something comprehensive that just works — automatically, locally, without thinking about it.

Hi, I'm Chataclaw (@chataclaw).

So I built Calc MCP: an MCP server with 21 tools for all the deterministic stuff AI struggles with.

What is Calc MCP?

Calc MCP is a Model Context Protocol server that gives your AI assistant 21 specialized tools for precise, deterministic operations:

🧮 Math evaluation with sandboxed execution
🎲 Cryptographic randomness (real UUIDs, secure tokens)
📅 Date/time arithmetic that doesn't hallucinate
🔐 Hashing & encoding (base64, hex, URL, JWT, and more)
✅ Validation & parsing (JSON, regex, cron, Luhn, IP, semver)
🎨 Conversion utilities (colors, units, character info)

Why You Should Care

🔒 Secure by Design

Sandboxed math evaluation (no arbitrary code execution)
ReDoS protection for regex operations
Weak hash warnings (MD5/SHA-1 deprecation notices)

💰 Completely Free

No API keys required
Runs 100% locally
Works offline
MIT License

Before & After

Without Calc MCP:

You: "What's the SHA-256 hash of 'hello'?"
AI: "The hash is 2cf24dba5fb0a3... (hallucinates rest)"

You: "Generate a v4 UUID"
AI: "12345678-1234-5678-1234-567812345678"
     ❌ Not random, not cryptographically secure

You: "How many days until Christmas 2026?"
AI: "Let me calculate... approximately 280 days"
     ❌ Wrong, and "approximately" isn't good enough

With Calc MCP:

You: "What's the SHA-256 hash of 'hello'?"
AI: Uses hash tool → Returns actual SHA-256
     ✅ "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

You: "Generate a v4 UUID"
AI: Uses random tool → Returns crypto.randomUUID()
     ✅ "f47ac10b-58cc-4372-a567-0e02b2c3d479"

You: "How many days until Christmas 2026?"
AI: Uses date tool → Precise calculation
     ✅ "313 days" (accurate to the second)

Quick Start

Install via npm:

npm install -g @coo-quack/calc-mcp

Then add to your MCP client configuration:

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "calc": {
      "command": "calc-mcp"
    }
  }
}

Claude Code (openclaw)

In your workspace:

mcporter install calc-mcp

Cursor / VS Code

Add to your MCP settings:

{
  "mcpServers": {
    "calc": {
      "command": "npx",
      "args": ["-y", "@coo-quack/calc-mcp"]
    }
  }
}

Windsurf

Similar to VS Code — add the server to your MCP configuration file.

Restart your client, and you're ready to go. Full docs at coo-quack.github.io/calc-mcp.

The 21 Tools: A Showcase

Let me walk you through what's inside, organized by category.

🧮 Math & Calculation

math — Evaluate mathematical expressions safely

Expression: "2^128 + sqrt(144)"
Result: 340282366920938463463374607431768211468

Supports standard operators, functions (sin, cos, log, sqrt, etc.), constants (PI, E), and complex expressions. Sandboxed execution means no eval() risks.

count — Accurately count characters, words, lines, bytes

Text: "Hello 世界"
Characters: 8
Bytes (UTF-8): 12
Words: 2

Perfect for when you need exact counts for APIs with character limits.

📅 Date & Time

datetime — Current date/time in any format or timezone

Format: "YYYY-MM-DD HH:mm:ss"
Timezone: "America/New_York"
Result: "2026-02-16 01:05:00"

date — Date arithmetic and difference calculations

Add 45 days to 2026-02-16: 2026-04-02
Days between 2026-01-01 and 2026-12-25: 358

No more "roughly X days" hallucinations.

🎲 Cryptographic Randomness

random — Generate secure random values

UUIDs (v4, v7)
Cryptographically secure integers
Random strings (alphanumeric, hex, base64)
Secure tokens

UUID v4: "f81d4fae-7dec-11d0-a765-00a0c91e6bf6"
Random int (1-100): 73
Secure token (32 bytes): "a7f3c9..."

🔐 Hashing & Encoding

hash — Generate cryptographic hashes

MD5, SHA-1, SHA-256, SHA-384, SHA-512
Input: "password123"
SHA-256: "ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f"

Includes warnings when using weak algorithms (MD5/SHA-1).

base64 — Encode/decode base64

Encode: "Hello" → "SGVsbG8="
Decode: "SGVsbG8=" → "Hello"

encode — URL and HTML encoding/decoding

URL encode: "hello world" → "hello%20world"
HTML encode: "<div>" → "&lt;div&gt;"

✅ Validation & Parsing

json_validate — Validate and pretty-print JSON

Input: '{"name":"Alice","age":30}'
Valid: ✅
Pretty output with indentation

regex — Test regex patterns with ReDoS protection

Pattern: "^\d{3}-\d{4}$"
Test: "123-4567"
Match: ✅

cron_parse — Parse cron expressions to human-readable format

Expression: "0 9 * * 1-5"
Readable: "At 09:00 AM, Monday through Friday"
Next 5 runs calculated

luhn — Validate credit card numbers, generate check digits

Number: "4532015112830366"
Valid: ✅ (Luhn algorithm check)

ip — Validate and analyze IP addresses

IP: "192.168.1.1"
Version: IPv4
Private: ✅

semver — Parse and compare semantic versions

Version: "1.8.0"
Major: 1, Minor: 8, Patch: 0
Compare: "1.8.0" > "1.7.5" → true

🎨 Conversion Utilities

base — Convert between number bases (2-36)

Decimal 255 → Hex: "FF"
Binary "1111" → Decimal: 15

diff — Character and word-level text diffs

Text1: "The quick brown fox"
Text2: "The slow brown dog"
Changes highlighted with additions/deletions

color — Convert between color formats

Hex "#FF5733" → RGB: "rgb(255, 87, 51)"
RGB → HSL: "hsl(14, 100%, 60%)"

convert — Unit conversions (length, weight, temperature, etc.)

100 cm → 39.37 inches
32°F → 0°C

char_info — Character information and Unicode details

Character: "€"
Unicode: U+20AC
Category: Currency Symbol
Name: EURO SIGN

jwt_decode — Decode JWT tokens (header + payload)

Token: "eyJhbGciOiJIUzI1..."
Header: {"alg": "HS256", "typ": "JWT"}
Payload: {"sub": "1234", "name": "John"}

url_parse — Parse URLs into components

URL: "https://example.com/path?q=search#section"
Protocol: https
Host: example.com
Path: /path
Query: q=search
Hash: #section

Security Design

I didn't just slap together a bunch of eval() calls and call it a day. Security matters:

🔒 Sandboxed Math Evaluation

The math tool uses a safe expression parser, not JavaScript's eval(). You can't execute arbitrary code like process.exit() or require('fs'). It evaluates mathematical expressions in a controlled environment.

🛡️ ReDoS Protection

The regex tool includes timeouts and complexity checks to prevent Regular Expression Denial of Service attacks. No hanging your AI session with catastrophic backtracking patterns.

⚠️ Weak Hash Warnings

Using MD5 or SHA-1 for hashing? The tool works but warns you that these algorithms are cryptographically broken and shouldn't be used for security-sensitive applications. Gentle nudge toward SHA-256+.

Why This Matters

When you're coding with AI, context-switching kills flow. Having these tools available automatically means:

No more "let me open a calculator"
No more "hold on, lemme check that date"
No more copy-pasting to encoding websites
No more trusting hallucinated hashes

Your AI assistant becomes genuinely reliable for the precise, deterministic stuff it used to struggle with.

Get Started

📦 Install: npm install -g @coo-quack/calc-mcp
📖 Docs: coo-quack.github.io/calc-mcp
💻 GitHub: github.com/coo-quack/calc-mcp
🐛 Issues/PRs welcome!

Version 1.8.0 is live now. MIT License. No API keys, no tracking, no nonsense.

Have you run into similar AI hallucination problems? What tools do you wish existed? Drop a comment below 👇