MCP server integration

The 1Claw MCP server gives an AI client just-in-time access to vault secrets over the Model Context Protocol. It exposes 141 tools (vault, Intents signing, Execution Intents bindings, treasury, approvals, automations, runtimes, memory, chat, channels, Cedar/OPA policy backends, and Safe agent accounts). The canonical setup is local stdio: npx @1claw/mcp with a single ONECLAW_AGENT_API_KEY env var; the server exchanges it for a JWT, refreshes before expiry, and auto-discovers the agent and vault. The MCP server itself enforces nothing: every call is checked against the agent's policies by the vault API.

1. 1

   Recommended: local stdio. Run the server as a process and pass only the agent API key. It exchanges the key for a JWT, auto-refreshes it, and auto-discovers the agent and vault: no agent_id, no vault ID, no manual token minting. Paste this into .cursor/mcp.json, claude_desktop_config.json, or any MCP client that supports stdio.

   json Copy

   {
     "mcpServers": {
       "1claw": {
         "command": "npx",
         "args": ["-y", "@1claw/mcp"],
         "env": { "ONECLAW_AGENT_API_KEY": "ocv_your_agent_api_key" }
       }
     }
   }

2. 2

   Mint an agent JWT. Use env vars from Lesson 1 or paste your agent_id and ocv_ key directly.

   bash Copy

   export ONECLAW_AGENT_ID="your-agent-uuid"
   export ONECLAW_AGENT_KEY="ocv_your_agent_api_key"
   export VAULT_ID="your-vault-uuid"
   
   TOKEN=$(curl -s -X POST https://api.1claw.co/v1/auth/agent-token \
     -H "Content-Type: application/json" \
     -d '{"agent_id":"'$ONECLAW_AGENT_ID'","api_key":"'$ONECLAW_AGENT_KEY'"}' | jq -r .access_token)

3. 3

   Alternative: hosted server. Only for non-IDE callers that can mint a fresh JWT per connection (the token from the previous step). Paste your $TOKEN and $VAULT_ID into the headers.

   json Copy

   {
     "mcpServers": {
       "1claw": {
         "url": "https://mcp.1claw.co/mcp",
         "headers": {
           "Authorization": "Bearer <paste your $TOKEN here>",
           "X-Vault-ID": "<paste your $VAULT_ID here>"
         }
       }
     }
   }

4. 4

   Restart the client and ask it to list your secrets. The agent calls list_secrets and returns paths and metadata, never values.

   text Copy

   List the secrets in my 1claw vault.

Your AI client is now wired to the vault, and a first list_secrets call returns metadata scoped to the agent's policies.