1Claw Vault
Gives Claude secure, just-in-time access to secrets stored in the 1claw HSM-backed vault without persisting credentials in context. Exposes list_secrets, get_secret, put_secret, and rotation tools, plus transaction signing and simulation via Tenderly integration. Includes standalone prompt injection and threat scanning tools that work in local-only mode without vault credentials, useful for self-hosted LLM setups. Supports DPoP token binding to prevent credential theft. Vault operations hit the 1claw Agent API with automatic JWT refresh from your agent API key. Also provisions multi-chain signing keys and handles EIP-191 and EIP-712 message signing. Reach for this when your agent needs production secrets, wallet operations, or security scanning without storing sensitive material in prompts.
- GitHub stars
- 4
- tools
- 48
- auth
- Secret needed
- transport
- STDIO
- env vars
- 5
- last updated
- Aug 24, 2026
Tools
48 toolsPublic tool metadata for what this MCP can expose to an agent.
list_secretsList all secrets (metadata only — never values)
List all secrets (metadata only — never values)
No parameter schema in public metadata yet.
get_secretFetch the decrypted value of a secret by path. Accepts optional `client_share` for MPC vaults.
Fetch the decrypted value of a secret by path. Accepts optional `client_share` for MPC vaults.
No parameter schema in public metadata yet.
put_secretCreate or update a secret (creates a new version). Response includes `client_share` when the vault has MPC enabled.
Create or update a secret (creates a new version). Response includes `client_share` when the vault has MPC enabled.
No parameter schema in public metadata yet.
delete_secretSoft-delete a secret at a path
Soft-delete a secret at a path
No parameter schema in public metadata yet.
describe_secretGet metadata without fetching the value
Get metadata without fetching the value
No parameter schema in public metadata yet.
rotate_and_storeStore a new value for an existing secret and return the version
Store a new value for an existing secret and return the version
No parameter schema in public metadata yet.
rotate_generateServer-side secret rotation with generated value (length, charset configurable)
Server-side secret rotation with generated value (length, charset configurable)
No parameter schema in public metadata yet.
list_versionsList all versions of a secret (version numbers, dates, disabled status)
List all versions of a secret (version numbers, dates, disabled status)
No parameter schema in public metadata yet.
get_env_bundleFetch an env_bundle secret and parse it as KEY=VALUE JSON
Fetch an env_bundle secret and parse it as KEY=VALUE JSON
No parameter schema in public metadata yet.
list_child_agentsChild agents under a parent (own key/memory/policy, subset of the parent's access; vault ≥ 0.61.30)
Child agents under a parent (own key/memory/policy, subset of the parent's access; vault ≥ 0.61.30)
No parameter schema in public metadata yet.
resolve_envResolve environment variables for a vault and environment (returns the final KEY=VALUE set with precedence applied).
Resolve environment variables for a vault and environment (returns the final KEY=VALUE set with precedence applied).
No parameter schema in public metadata yet.
create_vaultCreate a new vault (auto-shared with the agent's human creator)
Create a new vault (auto-shared with the agent's human creator)
No parameter schema in public metadata yet.
list_vaultsList all vaults the agent can access (own + shared)
List all vaults the agent can access (own + shared)
No parameter schema in public metadata yet.
grant_accessShare a vault with a user or agent (own vaults only)
Share a vault with a user or agent (own vaults only)
No parameter schema in public metadata yet.
share_secretShare a secret with your creator, a user/agent by ID, or create an open link
Share a secret with your creator, a user/agent by ID, or create an open link
No parameter schema in public metadata yet.
simulate_transactionSimulate a transaction via Tenderly without signing or broadcasting
Simulate a transaction via Tenderly without signing or broadcasting
No parameter schema in public metadata yet.
simulate_bundleSimulate an ordered sequence of transactions (Tenderly bundle) without signing
Simulate an ordered sequence of transactions (Tenderly bundle) without signing
No parameter schema in public metadata yet.
submit_transactionSubmit a transaction intent to be signed and optionally broadcast (EVM + Bitcoin, Solana, XRP, Cardano, Tron).
Submit a transaction intent to be signed and optionally broadcast (EVM + Bitcoin, Solana, XRP, Cardano, Tron).
No parameter schema in public metadata yet.
sign_transactionSign-only (no broadcast). EVM returns signed_tx hex; non-EVM returns chain-specific signed payload.
Sign-only (no broadcast). EVM returns signed_tx hex; non-EVM returns chain-specific signed payload.
No parameter schema in public metadata yet.
list_transactionsList transaction intents for the agent.
List transaction intents for the agent.
No parameter schema in public metadata yet.
get_transactionGet one transaction by id (optional include_signed_tx).
Get one transaction by id (optional include_signed_tx).
No parameter schema in public metadata yet.
provision_signing_keyGenerate a multi-chain signing key for an agent. Returns public key, address, and metadata.
Generate a multi-chain signing key for an agent. Returns public key, address, and metadata.
No parameter schema in public metadata yet.
list_signing_keysList all signing keys for an agent across all chains.
List all signing keys for an agent across all chains.
No parameter schema in public metadata yet.
get_signing_key_balanceGet native and optional token balances for an agent signing key on a chain.
Get native and optional token balances for an agent signing key on a chain.
No parameter schema in public metadata yet.
import_signing_keyImport an existing private key as a signing key (human-only, step-up auth).
Import an existing private key as a signing key (human-only, step-up auth).
No parameter schema in public metadata yet.
sign_messageSign a message using EIP-191 personal_sign. Returns signature and signer address.
Sign a message using EIP-191 personal_sign. Returns signature and signer address.
No parameter schema in public metadata yet.
sign_typed_dataSign EIP-712 typed structured data. Returns signature, typed data hash, and signer address.
Sign EIP-712 typed structured data. Returns signature, typed data hash, and signer address.
No parameter schema in public metadata yet.
sign_digestSign a client-computed 32-byte digest directly (raw/blind signing) for ERC-1271/ERC-7739 nested EIP-712 flows. Requires raw_signing_enabled; audit-logged.
Sign a client-computed 32-byte digest directly (raw/blind signing) for ERC-1271/ERC-7739 nested EIP-712 flows. Requires raw_signing_enabled; audit-logged.
No parameter schema in public metadata yet.
platform_list_appsList all platform apps in the caller's org.
List all platform apps in the caller's org.
No parameter schema in public metadata yet.
platform_create_appRegister a new platform app (returns plt_ API key). User-only.
Register a new platform app (returns plt_ API key). User-only.
No parameter schema in public metadata yet.
platform_bootstrap_userBootstrap resources (vault, agent, policies) for a connected user from a template.
Bootstrap resources (vault, agent, policies) for a connected user from a template.
No parameter schema in public metadata yet.
platform_reissue_claimReissue a claim URL for an already-bootstrapped connection without re-provisioning resources.
Reissue a claim URL for an already-bootstrapped connection without re-provisioning resources.
No parameter schema in public metadata yet.
platform_rotate_keyRotate the API key for a platform app. Returns the new plt_ key (one-time).
Rotate the API key for a platform app. Returns the new plt_ key (one-time).
No parameter schema in public metadata yet.
platform_list_templatesList bootstrap templates for a platform app.
List bootstrap templates for a platform app.
No parameter schema in public metadata yet.
platform_get_fleetFleet summary for a template: cohort size, version skew, drift. Read-only.
Fleet summary for a template: cohort size, version skew, drift. Read-only.
No parameter schema in public metadata yet.
platform_list_fleet_agentsThe agents in a fleet, with the version each was provisioned from. Read-only.
The agents in a fleet, with the version each was provisioned from. Read-only.
No parameter schema in public metadata yet.
platform_plan_fleet_rolloutPlan a rollout. Always a dry run — it sets that itself.
Plan a rollout. Always a dry run — it sets that itself.
No parameter schema in public metadata yet.
platform_create_templateCreate a bootstrap template (vault, agents, policies, signing keys).
Create a bootstrap template (vault, agents, policies, signing keys).
No parameter schema in public metadata yet.
platform_list_usersList connected users for a platform app (status, resources, claim state).
List connected users for a platform app (status, resources, claim state).
No parameter schema in public metadata yet.
platform_grant_accessGrant a platform app access to vaults/agents for a connected user.
Grant a platform app access to vaults/agents for a connected user.
No parameter schema in public metadata yet.
platform_list_grantsList active resource grants for a platform connection.
List active resource grants for a platform connection.
No parameter schema in public metadata yet.
platform_siwe_challengeIssue a SIWE nonce for wallet-native platform user provisioning (plt_).
Issue a SIWE nonce for wallet-native platform user provisioning (plt_).
No parameter schema in public metadata yet.
platform_get_connectionGet connection detail: status, claim state, entitlements, wallet address.
Get connection detail: status, claim state, entitlements, wallet address.
No parameter schema in public metadata yet.
platform_connection_usagePer-connection LLM inference spend for the current UTC month.
Per-connection LLM inference spend for the current UTC month.
No parameter schema in public metadata yet.
platform_list_entitlementsList on-chain entitlement evaluations for a connection.
List on-chain entitlement evaluations for a connection.
No parameter schema in public metadata yet.
platform_preview_templateDry-run template spec with {{params.*}} / {{subject.*}} substitution.
Dry-run template spec with {{params.*}} / {{subject.*}} substitution.
No parameter schema in public metadata yet.
platform_transfer_ownershipTransfer a platform app to another org (step-up auth).
Transfer a platform app to another org (step-up auth).
No parameter schema in public metadata yet.
platform_delete_appSoft-delete a platform app and release its slug.
Soft-delete a platform app and release its slug.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
ONECLAW_AGENT_API_KEYsecretAgent API key (ocv_...). Exchanged for a short-lived JWT; auto-discovers agent ID and vault. Recommended for stdio.
ONECLAW_AGENT_IDOptional agent UUID when pinning identity (usually auto-discovered from the API key).
ONECLAW_VAULT_IDOptional vault UUID when the agent can access multiple vaults.
ONECLAW_BASE_URLVault API base URL (default https://api.1claw.xyz).
ONECLAW_LOCAL_ONLYSet to true for security-only mode (inspect_content only; no vault credentials).
Readme
@1claw/mcp
⭐ Star 1clawAI/agent-templates — ready-to-run agent templates wired to 1Claw. It is our single starred repo.
Connect Cursor, Claude Desktop, VS Code, or any MCP client to your 1claw vault. The server exposes tools for secrets, signing, execution bindings, memory, automations, and more. Values are fetched at call time and are not cached in the model's context beyond the moment they are used.
Most teams use this instead of copying API keys into agent prompts or MCP config files. You register an agent, grant policy access to specific secret paths, and point the client at mcp.1claw.co or a local stdio process. The server handles JWT exchange and refresh from a single ocv_ key.
Local-only mode: Run without vault credentials for the security inspection tools only (e.g. inspect_content). Useful with Ollama or LM Studio when you want injection detection without a 1claw account.
Details
- Repository
- github.com/1clawai/1claw-mcp
- Website
- 1claw.xyz
- Categories
- AI & LLM Tools, Search & Web Crawling
- Package
@1claw/mcp- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
Related AI & LLM Tools MCP servers
View all
Neuromcpadelelo13/neuromcpSemantic memory for AI agents with hybrid search, knowledge graph, and consolidation4stars
Lune Researchretrogradelabs/lune-mcp-serverSearch peer-reviewed papers and research methodology guidance from your AI agent.4stars
EchoVault Memorygo-ports/echovaultLocal-first memory for coding agents; stores decisions, bugs, and context across sessions.4stars
Wso2 Docs Mcp Serveriamvirul/wso2-docs-mcp-serverSemantic search over WSO2 docs (APIM, IS, MI, Choreo, Ballerina) via RAG and pgvector.4stars
Memographindhar01/memographGraph-based memory system for LLMs with knowledge graphs and semantic search.4stars