1Claw Vault

@1claw/mcp

⭐ Star [1clawAI/agent-templates](https://github.com/1clawAI/agent-templates) — ready-to-run agent templates wired to 1Claw. It is our single starred repo.

Connect Cursor, Claude Desktop, VS Code, or any MCP client to your 1claw vault. The server exposes tools for secrets, signing, execution bindings, memory, automations, and more. Values are fetched at call time and are not cached in the model's context beyond the moment they are used.

Most teams use this instead of copying API keys into agent prompts or MCP config files. You register an agent, grant policy access to specific secret paths, and point the client at mcp.1claw.co or a local stdio process. The server handles JWT exchange and refresh from a single ocv_ key.

Local-only mode: Run without vault credentials for the security inspection tools only (e.g. inspect_content). Useful with Ollama or LM Studio when you want injection detection without a 1claw account.

Local daemon mode: Point at the local 1claw daemon (ONECLAW_LOCAL_VAULT=true) so secrets never leave your machine. The daemon injects credentials into outbound HTTP requests; the model never sees the raw value.

API contract: Vault tools use the REST API from @1claw/openapi-spec. LLM traffic through Shroud is separate: agents call https://shroud.1claw.co with X-Shroud-Agent-Key and `X-Shroud-Provider` (required; e.g. openai). When the MCP server exchanges an agent API key for a JWT, that token may carry `shroud_config` for Shroud's PolicyEngine; MCP itself does not proxy LLM requests.

Transport Modes

The server supports two transport modes:

Set MCP_TRANSPORT=httpStream and PORT=8080 to run in hosted mode.

stdio and environment: The server does not cache a single vault client for the whole process. Each tool invocation builds a OneClawClient from the current process.env (ONECLAW_AGENT_API_KEY, ONECLAW_VAULT_ID, etc.), so changing env vars (or vault binding) takes effect on the next call without restarting the MCP process.

Agent environment auto-resolve (v0.52): When an agent is tagged with environment and env_auto_resolve: true, the resolve_env tool can omit environment and the Vault API uses the agent's tag from the JWT. Org setting env.enforce_agent_environment_scope blocks agents from resolving vars outside their tagged environment.

Policy engine v0.53: Access policies support policy_schema_version: 2 with expression-based tx_conditions.expression (mini DSL), expanded control-plane action_kind_in consensus triggers, and multi-chain deep decode (Solana, Bitcoin, Tron) for signing-time policy evaluation. TEE attestation is available at GET https://shroud.1claw.co/v1/shroud/attestation (returns attestation_level: none | identity | confidential | sev_snp plus confidential_claims); audit chain verification at GET /v1/audit/verify.

Graduated HITL (v0.54–0.55): Agent guardrail fields include tx_approval_policy (graduated tx thresholds → 202 awaiting_approval), typed_data_policy, simulation_failure_policy, and raw_signing_policy (deny or route to HITL via approve). Extended v0.55 fields: tx_block_unlimited_approvals, per-recipient limits, USD caps, allow_erc4337, allow_eip7702. Humans approve via dashboard or API; org freeze at POST /v1/org/freeze.

Guardrail governance & Safe (v0.56–0.57): Convention 6 execution shadow/enforce; shadow report, revisions, replay; address screening; guardrail widening approvals (202); agent Safe accounts + module registry MCP tools (list_agent_accounts, migrate_agent_to_safe, get_guardrail_shadow_report, etc.). See package README tool table.

Installation (local / stdio)

Homebrew (macOS / Linux)

brew install 1clawAI/tap/1claw-mcp

From source

cd packages/mcp

pnpm install pnpm run build

Environment Variables

\* For stdio, set `ONECLAW_AGENT_API_KEY` (recommended — auto-discovers agent ID and vault, handles token refresh). Alternatively, set ONECLAW_AGENT_TOKEN + ONECLAW_VAULT_ID for static JWT auth. Not needed when ONECLAW_LOCAL_ONLY=true or ONECLAW_LOCAL_VAULT=true.

Tools

The server ships 160 tools (add proxy_request in local daemon mode) but a session only ever sees the toolsets it is entitled to — a vault-only agent is offered ~24 tools, not 160. `inspect_content` also runs in `ONECLAW_LOCAL_ONLY=true` mode without vault credentials. Also includes the vault://secrets resource.

Split packages

Two narrower builds of this same tree are published in lockstep, for stdio deployments where the claim has to be true of the code on disk:

Same env vars and behaviour; see packages/vault/README.md and packages/guard/README.md. The hosted server at mcp.1claw.co is always the umbrella.

Toolsets

Every tool belongs to one toolset (src/toolsets.ts). Which toolsets a session gets is decided from the agent's own flags, once at admission, and re-checked every 15 minutes and after any 403 from the vault (hosted sessions then receive notifications/tools/list_changed).

Choosing toolsets explicitly. Set ONECLAW_MCP_TOOLSETS (stdio) or send X-1Claw-Toolsets (hosted) with a comma list, e.g. vault,intents,automations, or all. A selection can narrow the defaults or opt into the opt-in sets; it can never add a toolset the agent is not entitled to, and all still excludes admin and platform. inspect is always included.

When `execution_require_tee` is set the vault refuses to hand this agent secret *values* outside a TEE, so get_secret, get_env_bundle and resolve_env are hidden; put_secret, rotate_*, describe_secret, list_secrets and list_versions stay.

Degraded lookups. The server logs one line per session: toolsets=… lookup=full|jwt_only|failed. jwt_only means the agent profile could not be read and only the flags carried in the signed JWT (intents, execute, shroud) were honoured — cards, memory and directory are withheld until the next refresh. failed means not even a token was obtained; the session falls back to the agent defaults. Neither state ever widens a toolset.

stdio. The toolset is fixed when the process starts; restart the MCP server after changing an agent's flags.

| delete_secret | Soft-delete a secret at a path