# 1Claw Vault [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/1clawAI/1claw-mcp  
**GitHub Stars:** 2  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/1claw-vault

## Description
HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.

## Tools
Capabilities this server exposes over MCP:

- **list_secrets** — List all secrets (metadata only — never values)
- **get_secret** — Fetch the decrypted value of a secret by path. Accepts optional `client_share` for MPC vaults.
- **put_secret** — Create or update a secret (creates a new version). Response includes `client_share` when the vault has MPC enabled.
- **delete_secret** — Soft-delete a secret at a path
- **describe_secret** — Get metadata without fetching the value
- **rotate_and_store** — Store a new value for an existing secret and return the version
- **rotate_generate** — Server-side secret rotation with generated value (length, charset configurable)
- **list_versions** — List all versions of a secret (version numbers, dates, disabled status)
- **get_env_bundle** — Fetch an env_bundle secret and parse it as KEY=VALUE JSON
- **list_child_agents** — Child agents under a parent (own key/memory/policy, subset of the parent's access; vault ≥ 0.61.30)
- **resolve_env** — Resolve environment variables for a vault and environment (returns the final KEY=VALUE set with precedence applied). When the agent has `env_auto_resolve: true`, omit `environment` and the server uses the agent's tagged environment from the JWT.
- **create_vault** — Create a new vault (auto-shared with the agent's human creator)
- **list_vaults** — List all vaults the agent can access (own + shared)
- **grant_access** — Share a vault with a user or agent (own vaults only)
- **share_secret** — Share a secret with your creator, a user/agent by ID, or create an open link
- **simulate_transaction** — Simulate a transaction via Tenderly without signing or broadcasting
- **simulate_bundle** — Simulate an ordered sequence of transactions (Tenderly bundle) without signing
- **submit_transaction** — Submit a transaction intent to be signed and optionally broadcast (EVM + Bitcoin, Solana, XRP, Cardano, Tron). Auto-generates an `Idempotency-Key` header for replay protection. Supports `xrpl_tx_json` for 30+ XRPL transaction types (Payment, TrustSet, NFTokenMint, AMMCreate, EscrowCreate, etc.).
- **sign_transaction** — Sign-only (no broadcast). EVM returns `signed_tx` hex; non-EVM returns chain-specific signed payload. Supports `xrpl_tx_json` for arbitrary XRPL transactions.
- **list_transactions** — List transaction intents for the agent.
- **get_transaction** — Get one transaction by id (optional `include_signed_tx`).
- **provision_signing_key** — Generate a multi-chain signing key for an agent. Returns public key, address, and metadata. Private key stored securely in vault.
- **list_signing_keys** — List all signing keys for an agent across all chains.
- **get_signing_key_balance** — Get native and optional token balances for an agent signing key on a chain.
- **import_signing_key** — Import an existing private key as a signing key (human-only, step-up auth).
- **sign_message** — Sign a message using EIP-191 personal_sign. Returns signature and signer address.
- **sign_typed_data** — Sign EIP-712 typed structured data. Returns signature, typed data hash, and signer address.
- **sign_digest** — Sign a client-computed 32-byte digest directly (raw/blind signing) for ERC-1271/ERC-7739 nested EIP-712 flows (e.g. Polymarket). Requires `raw_signing_enabled`; audit-logged.
- **platform_list_apps** — List all platform apps in the caller's org.
- **platform_create_app** — Register a new platform app (returns `plt_` API key). User-only.
- **platform_bootstrap_user** — Bootstrap resources (vault, agent, policies) for a connected user from a template.
- **platform_reissue_claim** — Reissue a claim URL for an already-bootstrapped connection without re-provisioning resources.
- **platform_rotate_key** — Rotate the API key for a platform app. Returns the new `plt_` key (one-time).
- **platform_list_templates** — List bootstrap templates for a platform app.
- **platform_get_fleet** — Fleet summary for a template: cohort size, version skew, drift. Read-only.
- **platform_list_fleet_agents** — The agents in a fleet, with the version each was provisioned from. Read-only.
- **platform_plan_fleet_rollout** — Plan a rollout. **Always** a dry run — it sets that itself.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "1claw-vault": {
    "command": "npx",
    "args": ["-y","@1claw/mcp"],
    "env": {
      "ONECLAW_AGENT_API_KEY": "",
      "ONECLAW_AGENT_TOKEN": "",
      "ONECLAW_VAULT_ID": "",
      "ONECLAW_LOCAL_ONLY": "",
      "ONECLAW_LOCAL_VAULT": "",
      "ONECLAW_DAEMON_SOCKET": "",
      "MCP_TRANSPORT": "",
      "PORT": ""
    }
  }
}
```

**Requires environment variables:** `ONECLAW_AGENT_API_KEY`, `ONECLAW_AGENT_TOKEN`, `ONECLAW_VAULT_ID`, `ONECLAW_LOCAL_ONLY`, `ONECLAW_LOCAL_VAULT`, `ONECLAW_DAEMON_SOCKET`, `MCP_TRANSPORT`, `PORT` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What 1Claw Vault MCP server does

1Claw Vault MCP server exposes 1Claw vault operations through Model Context Protocol. It can list secret metadata, retrieve decrypted values by path, create or update secrets, soft-delete entries, inspect versions, and rotate values. Environment-oriented tools parse `env_bundle` secrets or resolve the final variables for a vault and environment with precedence applied.

The server also supports vault creation, access grants, secret sharing, and transaction workflows. Agents can simulate individual transactions or ordered bundles through Tenderly, submit transaction intents, retrieve transaction records, and sign without broadcasting. Supported signing and submission networks include EVM, Bitcoin, Solana, XRP, Cardano, and Tron. XRPL operations can be supplied through transaction JSON for multiple transaction types.

As a 🔒 Security tool, 1Claw Vault MCP server is intended for agents that need policy-controlled access to credentials, signing keys, and transaction actions. The supplied material also identifies local security inspection tools, including an `inspect_content` mode that can run without vault credentials.

## How it works

The default transport is stdio for local clients such as Claude Desktop and Cursor. Hosted deployments can use `httpStream`; set `MCP_TRANSPORT=httpStream` and provide a port. In hosted mode, requests use a bearer token and `X-Vault-ID` header.

For stdio, the recommended authentication method is `ONECLAW_AGENT_API_KEY`. The server exchanges the `ocv_` key for a JWT, discovers the agent and vault, and refreshes the token. A legacy static JWT can be supplied with `ONECLAW_AGENT_TOKEN` together with `ONECLAW_VAULT_ID`. Each tool invocation builds its client from the current environment, so updated environment values take effect on the next call.

A local daemon mode is available through `ONECLAW_LOCAL_VAULT=true`. The daemon injects credentials into outbound requests, keeping raw secret values away from the model. `ONECLAW_LOCAL_ONLY=true` enables security inspection without vault credentials. Tool visibility is controlled by agent entitlements and optional toolset configuration rather than exposing every capability to every session.

## Setup and configuration

Install the package with Homebrew on macOS or Linux using `brew install 1clawAI/tap/1claw-mcp`, or build it from the repository with pnpm. Configure an agent API key for the normal stdio setup. Use `ONECLAW_DAEMON_SOCKET` to select a non-default Unix socket in local daemon mode.

The server uses `https://api.1claw.co` by default for the vault API. `ONECLAW_BASE_URL` can change that endpoint for DPoP-bound tokens or self-hosted deployments. `ONECLAW_DPOP=true` enables proof-of-possession token binding. `ONECLAW_MCP_TOOLSETS` narrows or opts into exposed toolsets, but cannot exceed the agent's entitlements.

## Tools and capabilities

1Claw Vault MCP server includes capabilities for:

- Secret metadata, retrieval, creation, updates, deletion, version listing, and rotation.
- Environment bundle parsing and agent-environment-aware variable resolution.
- Vault creation, vault listing, access grants, and secret sharing.
- Signing-key provisioning, listing, balance lookup, and human-only key import.
- Transaction simulation, submission, lookup, message signing, typed-data signing, and digest signing.
- Platform app listing, platform app creation, and connected-user bootstrap.

The transaction APIs include replay protection for submitted intents. Raw digest signing requires raw signing to be enabled and is audit logged.

## Limitations and notes

Secret values are fetched at call time rather than intended for long-term model-context storage. Access depends on the agent's policies, entitlements, vault binding, and, where applicable, human approval. Imported signing keys require human-only step-up authentication.

The local-only mode provides security inspection without account credentials, but it is not the full vault feature set. The local daemon mode changes where credential handling occurs; it does not imply that every tool is available without the required agent configuration. LLM traffic through Shroud is separate from the MCP server, which does not proxy those requests.

_Full upstream README: https://allmcps.com/mcp/1claw-vault/readme_