Transcription
Cloudbot has proven to be very unsafe for your data and has led to thousands of data leaks. That's why I decided to build my own secure bot and give it away to you for free. It's able to run any task and solve its own problems 24/7. It can even examine and improve its own codebase based on experiences. In this video, I'm going to show you exactly how you can set it up. We'll cover why this architecture is actually secure, then how to use it without risking your own API keys or sensitive information. If you want a secure agent running for you 24/7 in the next few minutes, make sure to stick around to the end of the video. Let's get into it.
All right, let's go ahead and go through a quick practical example and then I'll go through some other important items as well. And then during this simple example here, I'm going to be able to show you behind the scenes how this agent works so you can get a better understanding. I'm going to do the first example here through Telegram. You can connect to it other ways, but if you've ever talked to an agent before, it's very similar. Send it a message and it will respond back. And so the first example I'm going to show here is something that I actually want to build for myself is creating my own financial adviser. and more specifically a financial adviser that does daily market research before the market opens. And so I've got this simple prompt here, create a financial adviser. Put all the related files in a specific folder so we can keep organized. We're going to create one file here that stores what the financial adviser should do. We're going to create a template for what that report each day should actually look like. And then we're going to actually produce that report each day. So I'm just going to take this jump over to Telegram here and I'm just going to put this in here. Just like that.
This bot already has an understanding of what the system looks like. So, it can go ahead and help us build out a plan. If you've ever used cloud code, it's very similar to that. So, it's going to take what we put in and actually build a plan that you can tweak or modify. This looks pretty close to what we were asking and it's just putting all of that into more detail. And then it just asks, hey, can you go ahead and approve this job? So, we can go ahead and just say yes. So, as soon as we do that, what the system is going to do is it's going to create that job. So, we have this process here where it actually creates the job. We can see this job here was created 13 seconds ago. These were other jobs that I created. So, one of the things you're seeing here is that not only do we use git to store the actual bot, but we're actually storing the logs and we're also getting using GitHub to trigger the action. So, if we come over here, we can actually see that it created the job. I'm going to go into logs here and we can see this was the job that was created right now. So, if we go in here, we can actually see the job. So, it's keeping track of the job and all of the logs that the agent creates and it's putting them back into Git. That way, when the bot runs again, it can always look at previous jobs and it can also look at the output of those jobs and it can also see the work that the bot did before in order to resolve any issues. So, if I come over here to the actions here, you can see we already have a process running here and it looks like it already completed. So, if we jump over to pull requests, you're going to see here that the job was just finished and we can actually see all of the files that it changed here. So, the first thing that you're going to notice is that we have a lot more transparency about what the bot is doing and all of the modifications that it's actually doing. Now, some of the concepts I'm talking about here around pull requests and GitHub actions. These are not complicated topics, but it will require you to understand Git a little bit, but we'll talk more and more about that as we go.
So again, if we come back into the job and we look at the files changed, we can see in the operating system folder, which is where we keep all of our main agent files, these different MD files describe how the agent should function. And so now the bot created this financial adviser inside of the operating system and then these three supporting files like we asked in the beginning of the job. And then it also added a repeating daily task to the cron job. And if you've never heard that term cron job, it just means scheduled tasks. And so you can see here we added a scheduled task for daily financial research. It put in a very specific schedule. And if you're interested in knowing a little bit more about this formatting here for scheduling your jobs, just go ahead and ask Chad GBT or Claude about how to schedule jobs in the formatting there. But essentially, it's just saying, hey, read the file at operating system financial adviser financial adviser and complete the tasks described there. So if we come over to the financial adviser, you're going to see here that we have the instructions on building the report on what it should be there. And then if we go to the template, the template has what the actual report should look like. And then it looks like it already created a a final report. And then here at the top here, what you're seeing is all of the output from the agent itself, which shows how it was able to figure things out, the thought process there. And what's important about this is that now that the actual logs of the agent are in GitHub, we can write additional jobs that will come and analyze the logs and see where the bot is struggling or where it's doing well. And then we can actually have it improve itself based off of the actual logs. So when we launch another agent, it would be very easy for it to analyze previous jobs to improve itself because it's all integrated within Git.
And then if we come back to Telegram, we're going to see that here we created the job. And then once it's done, it actually gives us a report on what it did and links back to it. So I can just click this and it's going to take us right back to where we were. It's going to show us that the status is open. So this concept of a pull request, it's really a feature that is used by developers when they're working together. And if I created a bunch of features and I wanted to push that into the existing tool, I would create a pull request so that somebody else could review it, make sure everything is okay, and then they could check it back in again. Now, this is something that's configurable. So, if you want the bot just to check things in without any sort of approval, that's totally possible. I just started things out with default settings that are more secure. Now, another thing that's cool about this is that because all of the configuration is actually stored inside of GitHub, if I wanted to make manual changes to any of these files, it's totally possible. So, if I actually come back to this pull request here and let's go ahead and approve it. So if I squash and merge here, don't worry so much about the terminology, but I'm just saying take all of the code that we have just created and actually merge it back in to the main branch so that the bot can actually use these new features. Cuz as of right now, the work we just did in this pull request is sitting to be reviewed. The bot doesn't know anything about it yet. So to kind of prove that, if we go over here to operating system, notice we're not seeing the financial advisor folder yet. But if we go ahead and just accept and squash the merge and then we refresh, we're going to see the financial advisor. And I can come in here and I can actually edit these files manually if I'd like right here from GitHub. Just like that.
Now, I do want to show you another way that you can actually trigger jobs. And what I'm going to do is I'm going to trigger the job that we just created cuz it's not going to run until 6:00 tomorrow. So, I'd like to see the actual report. And in order to trigger that job, I'm going to use a feature that allows you to make external requests from an API. So the popebot is sitting right here. We can talk to it through telegram like we are, but we can also just send it API calls with a job and it will execute it. So if we look here in the operating system and we go again to this cron jobs, we've got a bunch of cron jobs here as examples, but each of these are scheduled tasks. You can notice that most of these are turned off. False. We do have one here that's enabled. It just runs every minute and it just tests to make sure that the cron is actually running. And then if we scroll down, we can see our financial research cron is now actually running. And this is the command that we run in order to make that happen. So I'm just going to copy this and I'm going to jump over to Postman. Now Postman is simply a application that allows you to make API calls to an API. And so what we're going to do is I'm going to send a job to my bot. And we're just going to put this, which is what we use to trigger it. And I will hit send. And it says unauthorized. So, I'm going to jump over to Visual Studio where I can grab the API key that was generated to protect my agent. Put that in the headers here and we'll send it again. Created the job. You're going to notice it's doing the same thing again. If we come back to the popebot, you see we have a new job running 25 seconds ago. If we come over to GitHub actions, we're going to see that the job is running as we saw before. First, it checks out the image and then it goes ahead and starts the job. So now this bot is going to be running the financial advisor we just created. So it's going to be going through all of this and then it's going to create this report. And then if we jump over to Brave Search and we look at our usage, we can see the activity inside of Brave Search. So we know it's working.
All right. So it looks like that job finished. It took about 3 minutes. So if we come back, we'll see a new pull request right here. And this time it has three files that have changed. You're always going to see two new files. We have the job itself and then we have the log. So, this is all of the work that it did to do all the searches and to figure everything out and then to pull together all of the research and then it built this financial report. So, it did all the searches and then put this report together and then dropped it back into the repository so that the bot can then use that information in other tasks. And you can see here that the Telegram bot has also responded back to us saying that that job is complete and they also provide links and a summary of what happened. If your agent also has issues, it's also going to talk a little bit about the struggles it's been having as well. That way, you're understanding how the bot is working and what's going well and what's not, so you can always improve things.
Now, from here, I'm going to go ahead and show you how to install the Pope bot. If you come to GitHub and you go to the Pope and you scroll down to the installation instructions, there are a few things that you do need to have installed. This particular tool might be new to you. It's really cool, so I'm excited to show you what it does, but you'll need to have all of these first. And then you'll want to fork this repository. You'll just click this button and it's going to open up a fork. I can't fork my own repository. So, you're going to go through here. Make sure to select a private repository. Go through that process and then you're going to have your own Popebot at your own username after you do that. And so, then we can go to step two. I'm going to copy this command. Again, you're going to put your username there. I'm going to jump to my terminal. I'm going to make a temp directory because I already have the popebot downloaded in that directory. And I'm going to do the command straight there. Going to paste the command. And I'm going to come here and change my name and you're going to change it to wherever you forked it to, Stephen G. Pope. Once that's done, you just continue to follow the instructions. Go ahead and CD into your bot. Then you're going to run this command here, npm run setup. And this is going to do all of the setup for your bot. And if you run into any challenges or issues along the way, make sure to let me know.
So the first thing it's going to do is just check all the prerequisites to make sure you have those installed. And then what it wants is your GitHub personal access token. That's what allows it to create all these different jobs and trigger all these different processes. And if you just allow it, it'll just open up the pages that you need. So if you just click yes, it'll open up this here. I'm going to create a token called delete me so that I don't leave this here. And then for repository access, you're going to want to change this to the popebot. So you just give it access just to one repository. And by the way, all of the different permissions you need are listed in the install here. So we need actions content metadata is already going to be there and pull requests. So we'll add actions content and also pull requests. For actions it's read only content we need both so that the bot's able to update the repository and then the bot also needs to be able to read and write the pull requests as well. So we'll just generate that token and we'll generate and then we can just copy this back into the install. And then it needs an anthropic key. So again, it will just open this up for you. You can create the new key. We'll call it delete me. You can call yours the popebot. It's also going to ask for OpenAI and Grock. They are optional. But if you add OpenAI, then your Telegram bot will be able to listen to voice messages. So I'm going to go ahead and just say yes. It'll open up the page, make it easy for us. Create the new key. Delete me. And then for Grock, I'm going to say no. And then it's going to ask for your Brave Search API key. This is what allowed it to do all the web searches that we just did. Now again, you can get a free account here. Create a new key. Subscription free. Copy that. And I'll put in the key. Now it's setting everything up. It's logging into all the sites and putting in everything that we need. And we'll talk a little bit more about these different security features in a bit.
And then it wants to set up Telegram. So we'll say yes. So now we need to create our bot on Telegram. And I'm just continuing to use Telegram from the web here because it's easy. You're going to want to search for bot father. If you just type bot father, you're going to see it comes up right here. And if you just type newbot, it's going to walk you through the process. It just wants a name. So I'm just going to put popebot demo. Then it wants a username. So I'm going to go pop demo. And it has to end with underscorebot. Then it's going to give us this access token. We can just take that drop it here. All right. So, we're almost there now. Now, we need to start two particular processes. One is the actual event handler. That is the process that allows us to chat with our bot through Telegram or send it the request through the web hook. So, if we take this command, I'm going to jump into another terminal here and I'm going to get back into the popebot. So now I'm just going to run that command and then I'm going to run over to another terminal and I'm going to run this command here. And you should have already pre-installed this and I'm just going to take this and I'm going to run it.
Now let me explain quickly what this is doing. So when you're running on your local computer and we've got the cloud here, Telegram is trying to go through the cloud and get to our computer. But there is a wall here that makes that impossible. So what this tool allows you to do is you start it here. Enro is actually running a process here inside of our computer. We're connected essentially like this. And so when that message comes into Telegram, it knows that it can send it to this URL and then our app can use it. Now, when you launch it in production and your app is sitting in the cloud, you won't need this. But for local testing, this is a really cool way of accepting web hooks even when you're on a local host. So this is a cool tool for you in your development on any platform. Once you have this, you just take this copy it and we'll just drop it right here. It's going to do all the setup for us. It's putting all the stuff into GitHub. And now all we have to do here is just take this verify. We're going to jump over to Telegram. We're going to click this link here which is going to open up a new conversation. We'll start it. And then we're going to send this verify basically helping us verify the security so that Telegram knows to only accept messages from us. So then it gives you the chat ID. Just click that, copy it, and you just drop this right back here. And then as soon as you finish that, you're good to go. So now I can just type, "Hey," it's always going to respond back with a thumbs up, so you know you got it. If you don't get a thumbs up, you know, you're not going to get a message like this as well. But this is how you know it's working. And when you're on mobile as well, when you send a message, it's also going to show you up here that it's typing. So when you're doing a long process, it's kind of nice because you'll get the thumbs up so that you know that the bot got the message. And then from there on out, while it's processing, even if it's a 30 secondond request, you're going to see that it's typing to kind of know that it's still working. And then once this is here, then you can come back and start building out your agent like I did here. If you wanted to take this, all you would need to do is simply type this in here, and it's going to go through that same process that we went through before to set up your financial advisor. You can see here it's coming back with the plan, and then you can modify the plan or go ahead and accept it and move on.
All right, so let's talk a little bit about security and how we keep your credentials safe. So when it comes to the popebot, if you remember the general flow here, we have a chat and then we create the job. And so this job is actually running inside of a container running on Docker. And so when you request a job, it spins up this isolated server. And this server has no credentials inside of it to start. The credentials are not stored in your GitHub repository and they're not stored in the job. They're actually stored in GitHub secrets. and the install process automatically put all of these in here. But if I come down here to secrets and variables and we come down to actions, we can see we have these repository secrets. And now if I were to try to open this and look, we're not going to be able to see what's inside. So there's no way to get access to these directly. So when that container is created, what ends up happening is that GitHub sends these credentials into it in real time so that the bot can actually use them. So we have a few different secrets here. We have the GitHub token. That's so we can check everything out from GitHub without having to do it manually. We have this web hook secret so that when GitHub is finished with something it can send it back to our event handler which is the process which is handling the chat and that's why we were able to get an update. Remember if we come back to Telegram we get this update that the job is done. It looks like I cleared it out. We got to look at this one. Right. So we get this job response right. So in order for GitHub to be able to send that back to our chatbot, it needs to know this secret. Otherwise, the chatbot is going to reject it. So that's how we keep our event handler secure. And then inside of the bot, so we've got our chat interface here, right? And this is launching the jobs once the job is live. And then GitHub is inserting the credentials into this job. So they're inserted at runtime. You can't access the definition of this bot and find the credentials or anything like that. I know it gets a little technical but then inside of the bot itself we've got two things that we pass it llm secrets and secrets. It gets a little complicated but just to help you understand is that we have this bot that's running. Okay, it's got an outer container and then inside of that there's this process called pi that's running. This is the part of the bot that actually has access to the LLM. So there's stuff happening here. For instance, we need to pass an API key to the LLM. So, we've got security credentials here and then we've got credentials that the LLM is actually able to see. The most important part is what is the LLM able to see? And there are some times where the LLM is going to need credentials if you have it doing scraping on the web and it's moving around the web automatically. It's going to need potentially usernames and passwords to log into various sites. So, you can't get away from not giving the LLM certain secrets, but it doesn't need them all, right? It doesn't need the GitHub token. it doesn't need the anthropic API key and so we can put those in the secrets itself. So these are secrets that the bot needs to work but we don't want the LLM to have access to it cuz it's the credentials that the LLM has where it's making its own decisions where it could expose some of those different things potentially. But let's be clear, we want the LLM to be able to go around and do things. So this is just making it clear here are secrets that we need in order for the container to run and then here are the ones that we actually give to the LLM. And so for right now, like the main one that's here is just the anthropic API key. That's the only one that I'm actually storing here right now. And then in LLM secrets, we have the Brave Search API key because once the LLM starts to do its work, it needs that key in order to get access to Brave Search. And just to point out here that this is the secrets tab. There are also other variables here as well that get set during the process. These are some more advanced features that we'll we'll cover. By default, it's going to put in default values that work just fine.
Now, I did want to point out that the instructions I gave you today are for local. So, we installed it locally on our computer. There's no reason why you can't run it this way and play around with it and actually build it out and use it. But, I do have some production instructions that are coming that are going to be super easy as well. But, it's nice to be able to launch this very quickly, have it up and running, test it.
So, now in terms of the road map, some of the things that I want to do from here is number one, I want to improve the memory. So, I want to create a a better system for keeping track of all of the different conversations that are created. in that context and then I want to make sure that it's available to all the chats that might be connected to the bot. Right here I'm using Telegram but there's no reason why we can't have Slack or any other chat interface as well. So I want to update the memory so that that is persistent and works across all the different channels. Then I also want to add more common skills. So intentionally when you install the bot it doesn't have a lot configured so that you're able to build whatever you want from it. But I do want to create a repository or plugins or something with a lot of common skills that you can just install and have on your bot and have it make your bot more powerful. Although you really don't need these because the bot is able to create those on its own.
Now, if you want to contribute, make sure to check out the popebot. You can file issues here as well. Let me know how things are going. But if you want to go way more in depth and get personal help from me, make sure to jump into the no code architects community. We'll be discussing the bot here. I'll be sharing what I'm building. Other people will do the same. And then we'll also talk about where we want to take it from here. In the classroom, there's also a course on vibe coding, how to make money with AI, and a quick start guide with a bunch of templates to NADN. I'd love to see you inside the community. Either way, I hope you enjoyed this video. Hope you enjoy the Pope. Let me know what you think and I'll see you on the next.