1Claw Vault

What 1Claw Vault MCP server does

1Claw Vault MCP server exposes 1Claw vault operations through Model Context Protocol. It can list secret metadata, retrieve decrypted values by path, create or update secrets, soft-delete entries, inspect versions, and rotate values. Environment-oriented tools parse env_bundle secrets or resolve the final variables for a vault and environment with precedence applied.

The server also supports vault creation, access grants, secret sharing, and transaction workflows. Agents can simulate individual transactions or ordered bundles through Tenderly, submit transaction intents, retrieve transaction records, and sign without broadcasting. Supported signing and submission networks include EVM, Bitcoin, Solana, XRP, Cardano, and Tron. XRPL operations can be supplied through transaction JSON for multiple transaction types.

As a 🔒 Security tool, 1Claw Vault MCP server is intended for agents that need policy-controlled access to credentials, signing keys, and transaction actions. The supplied material also identifies local security inspection tools, including an inspect_content mode that can run without vault credentials.

How it works

The default transport is stdio for local clients such as Claude Desktop and Cursor. Hosted deployments can use httpStream; set MCP_TRANSPORT=httpStream and provide a port. In hosted mode, requests use a bearer token and X-Vault-ID header.

For stdio, the recommended authentication method is ONECLAW_AGENT_API_KEY. The server exchanges the ocv_ key for a JWT, discovers the agent and vault, and refreshes the token. A legacy static JWT can be supplied with ONECLAW_AGENT_TOKEN together with ONECLAW_VAULT_ID. Each tool invocation builds its client from the current environment, so updated environment values take effect on the next call.

A local daemon mode is available through ONECLAW_LOCAL_VAULT=true. The daemon injects credentials into outbound requests, keeping raw secret values away from the model. ONECLAW_LOCAL_ONLY=true enables security inspection without vault credentials. Tool visibility is controlled by agent entitlements and optional toolset configuration rather than exposing every capability to every session.

Setup and configuration

Install the package with Homebrew on macOS or Linux using brew install 1clawAI/tap/1claw-mcp, or build it from the repository with pnpm. Configure an agent API key for the normal stdio setup. Use ONECLAW_DAEMON_SOCKET to select a non-default Unix socket in local daemon mode.

The server uses https://api.1claw.co by default for the vault API. ONECLAW_BASE_URL can change that endpoint for DPoP-bound tokens or self-hosted deployments. ONECLAW_DPOP=true enables proof-of-possession token binding. ONECLAW_MCP_TOOLSETS narrows or opts into exposed toolsets, but cannot exceed the agent's entitlements.

Tools and capabilities

1Claw Vault MCP server includes capabilities for:

• Secret metadata, retrieval, creation, updates, deletion, version listing, and rotation.
• Environment bundle parsing and agent-environment-aware variable resolution.
• Vault creation, vault listing, access grants, and secret sharing.
• Signing-key provisioning, listing, balance lookup, and human-only key import.
• Transaction simulation, submission, lookup, message signing, typed-data signing, and digest signing.
• Platform app listing, platform app creation, and connected-user bootstrap.

The transaction APIs include replay protection for submitted intents. Raw digest signing requires raw signing to be enabled and is audit logged.

Limitations and notes

Secret values are fetched at call time rather than intended for long-term model-context storage. Access depends on the agent's policies, entitlements, vault binding, and, where applicable, human approval. Imported signing keys require human-only step-up authentication.

The local-only mode provides security inspection without account credentials, but it is not the full vault feature set. The local daemon mode changes where credential handling occurs; it does not imply that every tool is available without the required agent configuration. LLM traffic through Shroud is separate from the MCP server, which does not proxy those requests.