In-depth architectural comparison of the 1Claw Vault and Trustboost Pii Sanitizer MCP servers. Compare execution transports, security boundaries, tool capabilities, quality scores, and ready-to-paste client installation snippets for Claude, Cursor, Windsurf, and VS Code.
At a Glance & Executive Verdict
1Claw Vault
Security · Local stdio
Quality: 56/100 (Good) | Auth: API Key required
Trustboost Pii Sanitizer
Security · Remote HTTP/SSE
Quality: 56/100 (Good) | Auth: No auth required
Verdict Summary: Choose 1Claw Vault if you need specialized Security tools running via a local process. Choose Trustboost Pii Sanitizer if your workspace requires Security integration with remote web transport. Both servers can be configured concurrently in your client's mcpServers manifest.
Which MCP Server Should You Choose?
Choose 1Claw Vault when:
You need dedicated capabilities in the Security domain.
You prefer local stdio subprocess transport architecture.
Your security boundary fits: API Key required (Free / Open Source).
You have access to required keys: ONECLAW_AGENT_API_KEY, ONECLAW_AGENT_TOKEN, ONECLAW_VAULT_ID, ONECLAW_LOCAL_ONLY, ONECLAW_LOCAL_VAULT, ONECLAW_DAEMON_SOCKET, MCP_TRANSPORT, PORT.
You need dedicated capabilities in the Security domain.
You prefer remote streaming HTTP/SSE transport architecture.
Your security boundary fits: No auth required (Freemium).
Primary tools included: MCP tool named sanitize_pii, Server-side PII redaction with [REDACTED] replacements, Entity list with types, categories, and redacted values.
HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.
PII sanitization layer for autonomous AI agent pipelines. Detects and redacts emails, phone numbers, national IDs, private keys, and financial data before text reaches LLMs. Supports EN, ES (LATAM), PT (BR/PT), DE, JA. Solana-native payments via Helius oracle.
Category & Scope
Tools & Capabilities Breakdown
1Claw Vault Tools (37)
list_secrets
List all secrets (metadata only — never values)
get_secret
Fetch the decrypted value of a secret by path. Accepts optional `client_share` for MPC vaults.
put_secret
Create or update a secret (creates a new version). Response includes `client_share` when the vault has MPC enabled.
delete_secret
Soft-delete a secret at a path
describe_secret
Get metadata without fetching the value
rotate_and_store
Store a new value for an existing secret and return the version
Ready-to-Paste Client Configurations
Paste either (or both) of these JSON server blocks into your client config file (e.g. claude_desktop_config.json or ~/.cursor/mcp.json).
1Claw Vault is categorized under Security and uses a local stdio subprocess. In contrast, Trustboost Pii Sanitizer belongs to Security using remote streaming HTTP/SSE transport. Select 1Claw Vault when you need capabilities focused on security and Trustboost Pii Sanitizer when you require tools for security.
Server-side secret rotation with generated value (length, charset configurable)
list_versions
List all versions of a secret (version numbers, dates, disabled status)
get_env_bundle
Fetch an env_bundle secret and parse it as KEY=VALUE JSON
list_child_agents
Child agents under a parent (own key/memory/policy, subset of the parent's access; vault ≥ 0.61.30)
resolve_env
Resolve environment variables for a vault and environment (returns the final KEY=VALUE set with precedence applied). When the agent has `env_auto_resolve: true`, omit `environment` and the server uses the agent's tagged environment from the JWT.
create_vault
Create a new vault (auto-shared with the agent's human creator)
+25 more tools listed on main page
Trustboost Pii Sanitizer Tools (6)
MCP tool named sanitize_pii
Server-side PII redaction with [REDACTED] replacements
Entity list with types, categories, and redacted values
Deterministic safety scores from 0.0 to 1.0
Risk categories: CRITICAL, PRIVATE, SENSITIVE, and CLEAN
Multilingual detection across eight listed languages