@1claw/mcp

⭐ Star 1clawAI/agent-templates — ready-to-run agent templates wired to 1Claw. It is our single starred repo.

Connect Cursor, Claude Desktop, VS Code, or any MCP client to your 1claw vault. The server exposes tools for secrets, signing, execution bindings, memory, automations, and more. Values are fetched at call time and are not cached in the model's context beyond the moment they are used.

Most teams use this instead of copying API keys into agent prompts or MCP config files. You register an agent, grant policy access to specific secret paths, and point the client at mcp.1claw.co or a local stdio process. The server handles JWT exchange and refresh from a single ocv_ key.

Local-only mode: Run without vault credentials for the security inspection tools only (e.g. inspect_content). Useful with Ollama or LM Studio when you want injection detection without a 1claw account.

Local daemon mode: Point at the local 1claw daemon (ONECLAW_LOCAL_VAULT=true) so secrets never leave your machine. The daemon injects credentials into outbound HTTP requests; the model never sees the raw value.

API contract: Vault tools use the REST API from @1claw/openapi-spec. LLM traffic through Shroud is separate: agents call https://shroud.1claw.co with X-Shroud-Agent-Key and X-Shroud-Provider (required; e.g. openai). When the MCP server exchanges an agent API key for a JWT, that token may carry shroud_config for Shroud's PolicyEngine; MCP itself does not proxy LLM requests.

Transport Modes

The server supports two transport modes:

Mode	Use case	Auth
stdio (default)	Local — Claude Desktop, Cursor	Env: ONECLAW_AGENT_API_KEY (recommended; auto-discovers agent + vault) or ONECLAW_AGENT_ID + key; or ONECLAW_AGENT_TOKEN + ONECLAW_VAULT_ID
httpStream	Hosted at mcp.1claw.co	Per-request headers: Authorization: Bearer <token>, X-Vault-ID

Set MCP_TRANSPORT=httpStream and PORT=8080 to run in hosted mode.

stdio and environment: The server does not cache a single vault client for the whole process. Each tool invocation builds a OneClawClient from the current process.env (ONECLAW_AGENT_API_KEY, ONECLAW_VAULT_ID, etc.), so changing env vars (or vault binding) takes effect on the next call without restarting the MCP process.

Agent environment auto-resolve (v0.52): When an agent is tagged with environment and env_auto_resolve: true, the resolve_env tool can omit environment and the Vault API uses the agent's tag from the JWT. Org setting env.enforce_agent_environment_scope blocks agents from resolving vars outside their tagged environment.

Policy engine v0.53: Access policies support policy_schema_version: 2 with expression-based tx_conditions.expression (mini DSL), expanded control-plane action_kind_in consensus triggers, and multi-chain deep decode (Solana, Bitcoin, Tron) for signing-time policy evaluation. TEE attestation is available at GET https://shroud.1claw.co/v1/shroud/attestation (returns attestation_level: none | identity | confidential | sev_snp plus confidential_claims); audit chain verification at GET /v1/audit/verify.

Graduated HITL (v0.54–0.55): Agent guardrail fields include tx_approval_policy (graduated tx thresholds → 202 awaiting_approval), typed_data_policy, simulation_failure_policy, and raw_signing_policy (deny or route to HITL via approve). Extended v0.55 fields: tx_block_unlimited_approvals, per-recipient limits, USD caps, allow_erc4337, allow_eip7702. Humans approve via dashboard or API; org freeze at POST /v1/org/freeze.

Guardrail governance & Safe (v0.56–0.57): Convention 6 execution shadow/enforce; shadow report, revisions, replay; address screening; guardrail widening approvals (202); agent Safe accounts + module registry MCP tools (list_agent_accounts, migrate_agent_to_safe, get_guardrail_shadow_report, etc.). See package README tool table.

Installation (local / stdio)

Homebrew (macOS / Linux)

brew install 1clawAI/tap/1claw-mcp

From source

cd packages/mcp
pnpm install
pnpm run build

Environment Variables

Variable	Required	Default	Description
ONECLAW_AGENT_API_KEY	stdio*	—	Recommended. Agent API key (ocv_...). Server exchanges it for a JWT, auto-discovers agent ID and vault, and refreshes the token automatically.
ONECLAW_LOCAL_ONLY	No	false	Set to true for security-only mode (no vault credentials needed).
ONECLAW_LOCAL_VAULT	No	false	Set to true to use the local daemon instead of the cloud API.
ONECLAW_DAEMON_SOCKET	No	~/.config/1claw/daemon.sock	Path to the local daemon Unix socket (local daemon mode only).
ONECLAW_AGENT_ID	No	—	Agent UUID. Optional with ONECLAW_AGENT_API_KEY (auto-discovered from key).
ONECLAW_AGENT_TOKEN	stdio*	—	Legacy. Static Bearer JWT (expires in ~1 h, no auto-refresh).
ONECLAW_VAULT_ID	No	—	UUID of the vault. Auto-discovered when using ONECLAW_AGENT_API_KEY.
ONECLAW_DPOP	No	false	Set to true to enable DPoP (RFC 9449) proof-of-possession. Binds agent tokens to the MCP client's ephemeral P-256 keypair so stolen tokens are unusable without the matching private key.
ONECLAW_BASE_URL	No	https://api.1claw.co	Vault API base URL. Intents tools (simulate_transaction, submit_transaction, etc.) call this host; for TEE signing, point it at Shroud or Intents (e.g. https://shroud.1claw.co or https://intents.1claw.co) if your deployment routes signing there. Required when the agent has intents_require_tee or execution_require_tee enabled — those flags reject direct Vault calls (403), so ONECLAW_BASE_URL must point to Shroud. Self-hosted: your Vault/Shroud URL.
MCP_TRANSPORT	No	stdio	Transport mode: stdio or httpStream.
PORT	No	8080	HTTP port (httpStream mode only).

* For stdio, set ONECLAW_AGENT_API_KEY (recommended — auto-discovers agent ID and vault, handles token refresh). Alternatively, set ONECLAW_AGENT_TOKEN + ONECLAW_VAULT_ID for static JWT auth. Not needed when ONECLAW_LOCAL_ONLY=true or ONECLAW_LOCAL_VAULT=true.

Tools

The server exposes 138 tools when vault credentials are configured (add proxy_request in local daemon mode). inspect_content also runs in ONECLAW_LOCAL_ONLY=true mode without vault credentials. Also includes the vault://secrets resource.

Tool	Description
list_secrets	List all secrets (metadata only — never values)
get_secret	Fetch the decrypted value of a secret by path. Accepts optional client_share for MPC vaults.
put_secret	Create or update a secret (creates a new version). Response includes client_share when the vault has MPC enabled.
delete_secret	Soft-delete a secret at a path
describe_secret	Get metadata without fetching the value
rotate_and_store	Store a new value for an existing secret and return the version
rotate_generate	Server-side secret rotation with generated value (length, charset configurable)
list_versions	List all versions of a secret (version numbers, dates, disabled status)
get_env_bundle	Fetch an env_bundle secret and parse it as KEY=VALUE JSON
resolve_env	Resolve environment variables for a vault and environment (returns the final KEY=VALUE set with precedence applied). When the agent has env_auto_resolve: true, omit environment and the server uses the agent's tagged environment from the JWT.
create_vault	Create a new vault (auto-shared with the agent's human creator)
list_vaults	List all vaults the agent can access (own + shared)
grant_access	Share a vault with a user or agent (own vaults only)
share_secret	Share a secret with your creator, a user/agent by ID, or create an open link
simulate_transaction	Simulate a transaction via Tenderly without signing or broadcasting
simulate_bundle	Simulate an ordered sequence of transactions (Tenderly bundle) without signing
submit_transaction	Submit a transaction intent to be signed and optionally broadcast (EVM + Bitcoin, Solana, XRP, Cardano, Tron). Auto-generates an Idempotency-Key header for replay protection. Supports xrpl_tx_json for 30+ XRPL transaction types (Payment, TrustSet, NFTokenMint, AMMCreate, EscrowCreate, etc.).
sign_transaction	Sign-only (no broadcast). EVM returns signed_tx hex; non-EVM returns chain-specific signed payload. Supports xrpl_tx_json for arbitrary XRPL transactions.
list_transactions	List transaction intents for the agent.
get_transaction	Get one transaction by id (optional include_signed_tx).
provision_signing_key	Generate a multi-chain signing key for an agent. Returns public key, address, and metadata. Private key stored securely in vault.
list_signing_keys	List all signing keys for an agent across all chains.
get_signing_key_balance	Get native and optional token balances for an agent signing key on a chain.
import_signing_key	Import an existing private key as a signing key (human-only, step-up auth).
sign_message	Sign a message using EIP-191 personal_sign. Returns signature and signer address.
sign_typed_data	Sign EIP-712 typed structured data. Returns signature, typed data hash, and signer address.
sign_digest	Sign a client-computed 32-byte digest directly (raw/blind signing) for ERC-1271/ERC-7739 nested EIP-712 flows (e.g. Polymarket). Requires raw_signing_enabled; audit-logged.
platform_list_apps	List all platform apps in the caller's org.
platform_create_app	Register a new platform app (returns plt_ API key). User-only.
platform_bootstrap_user	Bootstrap resources (vault, agent, policies) for a connected user from a template.
platform_reissue_claim	Reissue a claim URL for an already-bootstrapped connection without re-provisioning resources.
platform_rotate_key	Rotate the API key for a platform app. Returns the new plt_ key (one-time).
platform_list_templates	List bootstrap templates for a platform app.
platform_get_fleet	Fleet summary for a template: cohort size, version skew, drift. Read-only.
platform_list_fleet_agents	The agents in a fleet, with the version each was provisioned from. Read-only.
platform_plan_fleet_rollout	Plan a rollout. Always a dry run — it sets that itself.