1Claw Vault MCP server

@1claw/mcp

⭐ Star 1clawAI/agent-templates — ready-to-run agent templates wired to 1Claw. It is our single starred repo.

<!-- mcp-name: io.github.1clawAI/1claw-mcp -->

Connect Cursor, Claude Desktop, VS Code, or any MCP client to your 1claw vault. The server exposes tools for secrets, signing, execution bindings, memory, automations, and more. Values are fetched at call time and are not cached in the model's context beyond the moment they are used.

Most teams use this instead of copying API keys into agent prompts or MCP config files. You register an agent, grant policy access to specific secret paths, and point the client at mcp.1claw.co or a local stdio process. The server handles JWT exchange and refresh from a single ocv_ key.

Local-only mode: Run without vault credentials for the security inspection tools only (e.g. inspect_content). Useful with Ollama or LM Studio when you want injection detection without a 1claw account.

Local daemon mode: Point at the local 1claw daemon (ONECLAWLOCALVAULT=true) so secrets never leave your machine. The daemon injects credentials into outbound HTTP requests; the model never sees the raw value.

API contract: Vault tools use the REST API from @1claw/openapi-spec. LLM traffic through Shroud is separate: agents call https://shroud.1claw.co with X-Shroud-Agent-Key and X-Shroud-Provider (required; e.g. openai). When the MCP server exchanges an agent API key for a JWT, that token may carry shroudconfig** for Shroud's PolicyEngine; MCP itself does not proxy LLM requests.

Transport Modes

The server supports two transport modes:

Set MCP_TRANSPORT=httpStream and PORT=8080 to run in hosted mode.

stdio and environment: The server does not cache a single vault client for the whole process. Each tool invocation builds a OneClawClient from the current process.env (ONECLAWAGENTAPIKEY, ONECLAWVAULT_ID, etc.), so changing env vars (or vault binding) takes effect on the next call without restarting the MCP process.

Agent environment auto-resolve (v0.52): When an agent is tagged with environment and envautoresolve: true, the resolveenv tool can omit environment and the Vault API uses the agent's tag from the JWT. Org setting env.enforceagentenvironmentscope blocks agents from resolving vars outside their tagged environment.

Policy engine v0.53: Access policies support policyschemaversion: 2 with expression-based txconditions.expression (mini DSL), expanded control-plane actionkindin consensus triggers, and multi-chain deep decode (Solana, Bitcoin, Tron) for signing-time policy evaluation. TEE attestation is available at GET https://shroud.1claw.co/v1/shroud/attestation (returns attestationlevel: none | identity | confidential | sevsnp plus confidentialclaims); audit chain verification at GET /v1/audit/verify.

Shortened. The full README is on GitHub.