1Claw Vault runs on your own machine — the client starts it, so there is no endpoint to ping. 472 installs a week from npm. Last commit 17 Sep 2026.
HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.
Today is the operative word: we check 1Claw Vault every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add 1claw-mcp -- npx -y @1claw/mcp
{
"mcpServers": {
"1claw-mcp": {
"args": [
"-y",
"@1claw/mcp"
],
"command": "npx"
}
}
}
[mcp_servers.1claw-mcp]
command = "npx"
args = ["-y", "@1claw/mcp"]
{
"mcpServers": {
"1claw-mcp": {
"args": [
"-y",
"@1claw/mcp"
],
"command": "npx"
}
}
}
{
"mcpServers": {
"1claw-mcp": {
"args": [
"-y",
"@1claw/mcp"
],
"command": "npx"
}
}
}
This one needs environment variables set before it will start:
ONECLAW_AGENT_API_KEY (Agent API key (ocv_...). Exchanged for a short-lived JWT; auto-discovers agent ID and vault. Recommended for stdio.), ONECLAW_AGENT_ID (Optional agent UUID when pinning identity (usually auto-discovered from the API key).), ONECLAW_VAULT_ID (Optional vault UUID when the agent can access multiple vaults.), ONECLAW_BASE_URL (Vault API base URL (default https://api.1claw.xyz).), ONECLAW_LOCAL_ONLY (Set to true for security-only mode (inspect_content only; no vault credentials).).
The author declared them in the registry entry; get the values from the project itself.
Security scanning and threat detection for AI agents
Email safety for AI agents: scan inbound for prompt-injection/phishing + outbound for secret leaks.
Local-first secret scanning, rotation, vault, and audit-log tools for AI agents.
Scan AI agents for tool-calling vulnerabilities: prompt leaks, hijacking, injections, and more.
AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
Scan for prompt injection, secrets, PII, and vet MCP servers before installation
Input/output safety for AI agents: known-pattern injection and obfuscation scan, URL/IP, secrets.
Answers built from our own checks of this server.