About 1Claw Vault
1Claw Vault is an MCP server in the Security category: hSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.
Install
claude mcp add 1claw-vault -- npx -y @1claw/mcpnpx -y @1claw/mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (36)
create_vaultCreate a new vault (auto-shared with the agent's human creator)
Parameters not published.
delete_secretSoft-delete a secret at a path
Parameters not published.
describe_secretGet metadata without fetching the value
Parameters not published.
get_env_bundleFetch an env_bundle secret and parse it as KEY=VALUE JSON
Parameters not published.
get_secretFetch the decrypted value of a secret by path. Accepts optional `client_share` for MPC vaults.
Parameters not published.
get_signing_key_balanceGet native and optional token balances for an agent signing key on a chain.
Parameters not published.
get_transactionGet one transaction by id (optional `include_signed_tx`).
Parameters not published.
grant_accessShare a vault with a user or agent (own vaults only)
Parameters not published.
import_signing_keyImport an existing private key as a signing key (human-only, step-up auth).
Parameters not published.
list_secretsList all secrets (metadata only — never values)
Parameters not published.
Show all 36 tools
list_signing_keysList all signing keys for an agent across all chains.
Parameters not published.
list_transactionsList transaction intents for the agent.
Parameters not published.
list_vaultsList all vaults the agent can access (own + shared)
Parameters not published.
list_versionsList all versions of a secret (version numbers, dates, disabled status)
Parameters not published.
platform_bootstrap_userBootstrap resources (vault, agent, policies) for a connected user from a template.
Parameters not published.
platform_create_appRegister a new platform app (returns `plt_` API key). User-only.
Parameters not published.
platform_get_fleetFleet summary for a template: cohort size, version skew, drift. Read-only.
Parameters not published.
platform_list_appsList all platform apps in the caller's org.
Parameters not published.
platform_list_fleet_agentsThe agents in a fleet, with the version each was provisioned from. Read-only.
Parameters not published.
platform_list_templatesList bootstrap templates for a platform app.
Parameters not published.
platform_plan_fleet_rolloutPlan a rollout. **Always** a dry run — it sets that itself.
Parameters not published.
platform_reissue_claimReissue a claim URL for an already-bootstrapped connection without re-provisioning resources.
Parameters not published.
platform_rotate_keyRotate the API key for a platform app. Returns the new `plt_` key (one-time).
Parameters not published.
provision_signing_keyGenerate a multi-chain signing key for an agent. Returns public key, address, and metadata. Private key stored securely in vault.
Parameters not published.
put_secretCreate or update a secret (creates a new version). Response includes `client_share` when the vault has MPC enabled.
Parameters not published.
resolve_envResolve environment variables for a vault and environment (returns the final KEY=VALUE set with precedence applied). When the agent has `env_auto_resolve: true`, omit `environment` and the server uses the agent's tagged environment from the JWT.
Parameters not published.
rotate_and_storeStore a new value for an existing secret and return the version
Parameters not published.
rotate_generateServer-side secret rotation with generated value (length, charset configurable)
Parameters not published.
share_secretShare a secret with your creator, a user/agent by ID, or create an open link
Parameters not published.
sign_digestSign a client-computed 32-byte digest directly (raw/blind signing) for ERC-1271/ERC-7739 nested EIP-712 flows (e.g. Polymarket). Requires `raw_signing_enabled`; audit-logged.
Parameters not published.
sign_messageSign a message using EIP-191 personal_sign. Returns signature and signer address.
Parameters not published.
sign_transactionSign-only (no broadcast). EVM returns `signed_tx` hex; non-EVM returns chain-specific signed payload. Supports `xrpl_tx_json` for arbitrary XRPL transactions.
Parameters not published.
sign_typed_dataSign EIP-712 typed structured data. Returns signature, typed data hash, and signer address.
Parameters not published.
simulate_bundleSimulate an ordered sequence of transactions (Tenderly bundle) without signing
Parameters not published.
simulate_transactionSimulate a transaction via Tenderly without signing or broadcasting
Parameters not published.
submit_transactionSubmit a transaction intent to be signed and optionally broadcast (EVM + Bitcoin, Solana, XRP, Cardano, Tron). Auto-generates an `Idempotency-Key` header for replay protection. Supports `xrpl_tx_json` for 30+ XRPL transaction types (Payment, TrustSet, NFTokenMint, AMMCreate, EscrowCreate, etc.).
Parameters not published.
Ask AI
Ask AI about 1Claw Vault
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.