⭐ Star 1clawAI/agent-templates — ready-to-run agent templates wired to 1Claw. It is our single starred repo.
TypeScript/JavaScript client for the 1Claw Vault API.
This is the official SDK for Node.js, Next.js, and browser apps that call 1Claw over HTTP. It covers vaults, secrets, agents, policies, treasury, Intents API signing, execution bindings, platform apps, billing, and x402 payments. Types are generated from the OpenAPI spec, so request shapes stay in sync with the API.
TypeScript SDK for 1Claw Vault — secret management for AI agents
2026-11-15
Звёзды
—
Инструменты
—
Аптайм
—
Agent keys auto-exchange for JWTs and refresh before expiry. If you're wiring an AI agent in Cursor or Claude Desktop, you probably want @1claw/mcp instead. If you're building a web app or backend service in TypeScript, start here.
Install
npm install @1claw/sdk
Note: This package is ESM-only. Use it in an ESM context (e.g. "type": "module" in package.json, or .mjs files). Next.js and other bundlers handle ESM natively. Running scripts with plain node or tsx may require an ESM setup to avoid ERR_PACKAGE_PATH_NOT_EXPORTED.
Quick Start
import { createClient } from "@1claw/sdk";
const client = createClient({
baseUrl: "https://api.1claw.co",
apiKey: "ocv_...", // auto-exchanges for a JWT
});
// List vaults
const { data } = await client.vault.list();
console.log(data?.vaults);
// Store a secret
await client.secrets.set("vault-id", "OPENAI_KEY", "sk-...", {
type: "api_key",
});
// Retrieve a secret.
// Every call returns { data, error }. `data` is null whenever `error` is set,
// so `data?.value` alone turns a 403 into a silent undefined — check `error`.
const { data, error, meta } = await client.secrets.get("vault-id", "OPENAI_KEY");
if (error) {
console.error(meta?.status, error.type, error.message, meta?.requestId);
} else {
console.log(data?.value);
}
API contract: This SDK is built from the OpenAPI 3.1 spec. The canonical spec is published as @1claw/openapi-spec (YAML/JSON). Types are generated with npm run generate (openapi-typescript ../openapi-spec/openapi.yaml). Run generate after spec changes, then npm run build. Shapes such as LlmTokenBillingStatus (including optional credit_balance and billing_cycle_usage.metered_lines) come from the generated api-types.ts. For a full endpoint list, see the API reference or the spec.
Authentication
Agent JWTs issued by POST /v1/auth/agent-token may include optional claims such as shroud_enabled and shroud_config (when Shroud is on for that agent). Those are for services like Shroud that verify the JWT; the TypeScript SDK uses the token for Vault API calls and does not need to read shroud_config unless you build custom tooling.
The SDK supports four authentication modes:
// 1. User API key (exchanged for a JWT on first request)
const client = createClient({
baseUrl: "https://api.1claw.co",
apiKey: "1ck_...",
});
// 2. Agent with API key (auto-authenticates as agent)
const agent = createClient({
baseUrl: "https://api.1claw.co",
apiKey: "ocv_...",
agentId: "agent-uuid",
});
// 3. Pre-authenticated JWT
const authed = createClient({
baseUrl: "https://api.1claw.co",
token: "eyJ...",
});
// 4. Platform API key (sent as the Bearer token as-is, no exchange;
// `token: "plt_..."` works the same way)
const platform = createClient({
baseUrl: "https://api.1claw.co",
apiKey: "plt_...",
});
// Or authenticate manually:
await client.auth.login({ email: "...", password: "..." });
await client.auth.agentToken({ agent_id: "...", api_key: "..." });
await client.auth.google({ id_token: "..." });
// Password reset (public; no Bearer token — use a client without stored JWT)
await client.auth.forgotPassword({ email: "[email protected]" });
await client.auth.resetPassword({ token: "...", new_password: "..." });
// Set password (platform OIDC users who don't have one)
await client.auth.setPassword({ password: "...", password_confirm: "..." });
// Change email (sends verification code to new address)
await client.auth.changeEmail({ new_email: "[email protected]" });
await client.auth.verifyEmailChange({ code: "123456" });
prepare, sign, reportResult, get, getSession, createGrant, revokeGrant, updateSettings — x402 paywalls. Send the 402 bytes verbatim; the vault computes the digest and decides authorization. Limits are charged at signing, so reportResult releases nothing
topology, threats, summary, metrics, flows, agentTrust, stream — the control plane's telemetry. Human users only (a 1ck_ key or session JWT); agents are refused. stream() is an async iterator over SSE with Last-Event-ID resume; a {type: "gap"} event means refetch topology()
Platform bootstrap response:bootstrapUser() returns a summary object containing agent_api_key (one-time, not retrievable later) and signing_keys[] (with chain, address, and public_key for each provisioned key).
Environment Variables
Manage per-vault environment variables with environment scoping (production, preview, development) and precedence-based resolution:
// List env vars for a vault
const { env_vars } = await client.envVars.list(vaultId);
// Create an env var
const envVar = await client.envVars.create(vaultId, {
key: "DATABASE_URL",
value: "postgres://...",
environments: ["production", "preview"],
sensitive: true,
});
// Get a specific env var
const dbUrl = await client.envVars.get(vaultId, "DATABASE_URL");
// Update an env var
await client.envVars.update(vaultId, "DATABASE_URL", {
value: "postgres://new-host/...",
});
// Resolve env vars (the final KEY=VALUE set with precedence)
const { vars, sources } = await client.envVars.resolve(vaultId, "production");
// Delete an env var
await client.envVars.delete(vaultId, "DATABASE_URL");
Agent Environment Tagging (v0.52)
Tag agents with a named environment for policy scoping and env var resolution:
// Create an agent tagged for preview deployments
await client.agents.create({
name: "preview-bot",
environment: "preview",
env_auto_resolve: true,
});
// Update environment and per-environment guardrails
await client.agents.update(agentId, {
environment: "production",
environment_locked: true,
per_environment_guardrails: {
production: { max_value: "1.0", daily_limit: "10.0" },
preview: { max_value: "0.1", daily_limit: "1.0" },
},
});
// Resolve env vars — when env_auto_resolve is true on the agent JWT,
// omit environment and the server uses the agent's tag
const { vars } = await client.envVars.resolve(vaultId);
Agent JWTs include an environment claim when set. Policy conditions support environment_in for environment-scoped access.
Agent create response:agents.create() returns { agent: AgentResponse, api_key?: string }. The api_key is only present for auth_method: "api_key" and is shown once — use data.agent.id and data.api_key from the response.
Resource already exists — e.g. a duplicate vault name
RateLimitError
429
Rate limit exceeded
ValidationError
400
Invalid request body
ServerError
500+
Server-side failure
Intents API
Agents can be granted the ability to sign and broadcast on-chain transactions through the Intents API. Private keys stay in the HSM — the agent submits intent, the API signs and broadcasts.
Toggle intents_api_enabled when creating or updating an agent:
// Register an API key agent with Intents API access (default auth_method)
const { data } = await client.agents.create({
name: "defi-bot",
auth_method: "api_key", // "api_key" | "mtls" | "oidc_client_credentials"
scopes: ["keys/*", "api-keys/*"],
intents_api_enabled: true,
});
// data.api_key is only returned for auth_method: "api_key"
// All agents automatically receive an Ed25519 SSH keypair (data.agent.ssh_public_key)
// Register an mTLS agent (no API key returned)
const { data: mtlsAgent } = await client.agents.create({
name: "mtls-bot",
auth_method: "mtls",
client_cert_fingerprint: "sha256-fingerprint-hex",
});
// Register an OIDC agent (no API key returned)
const { data: oidcAgent } = await client.agents.create({
name: "oidc-bot",
auth_method: "oidc_client_credentials",
oidc_issuer: "https://accounts.google.com",
oidc_client_id: "your-client-id",
});
// Or enable it later
await client.agents.update(agentId, {
intents_api_enabled: true,
});
// Check an agent's proxy status
const agent = await client.agents.get(agentId);
console.log(agent.data?.intents_api_enabled); // true
Submitting a transaction
Once intents_api_enabled is true and the agent has a signing key stored in an accessible vault, the agent can submit transaction intents:
const txRes = await client.agents.submitTransaction(agentId, {
to: "0x000000000000000000000000000000000000dEaD",
value: "0.01", // ETH
chain: "base",
// Optional: data, signing_key_path, nonce, gas_price, gas_limit
});
console.log(txRes.data?.status); // "signed"
console.log(txRes.data?.tx_hash); // "0x..."
console.log(txRes.data?.signed_tx); // signed raw transaction hex
The backend fetches the signing key from the vault, signs the EIP-155 transaction, and returns the signed transaction hex. The signing key is decrypted in-memory, used, and immediately zeroized — it never leaves the server.
The SDK automatically generates an Idempotency-Key header (UUID v4) on each submitTransaction call, providing replay protection. Duplicate requests within 24 hours return the cached response instead of re-signing.
Sign-only mode (BYORPC)
Use signTransaction when you want the server to sign but not broadcast — for example, to submit via your own RPC (Flashbots, MEV protection, custom relayers):
const signRes = await client.agents.signTransaction(agentId, {
to: "0x000000000000000000000000000000000000dEaD",
value: "0.01",
chain: "base",
});
console.log(signRes.data?.signed_tx); // raw signed tx hex
console.log(signRes.data?.tx_hash); // precomputed keccak hash
console.log(signRes.data?.from); // derived sender address
// Broadcast yourself via ethers, viem, or raw JSON-RPC
All agent guardrails (allowlists, value caps, daily limits) are enforced exactly as for submit. The transaction is recorded for audit and daily-limit tracking with status: "sign_only".
Graduated HITL & v0.55 guardrails
Configure graduated human-in-the-loop thresholds on agents with Intents API enabled:
Disabled by default — a human must explicitly enable per-agent
Signing keys never leave the HSM — same envelope encryption as secrets
Idempotent by default — each submission includes an auto-generated Idempotency-Key header
Every transaction is audit-logged with full calldata
Revocable instantly — set intents_api_enabled: false to cut off access
TEE Enforcement (Pro+)
Lock down agents so signing and execution must happen in the hardware enclave (Shroud TEE). The vault enforces it by forwarding to Shroud, not by rejecting you.
await client.agents.update(agentId, {
intents_require_tee: true, // Only signs within the hardware enclave
execution_require_tee: true, // Only runs within the hardware enclave
});
When intents_require_tee is true:
Transaction submit/sign requests are signed inside Shroud's TEE whichever host you call — the vault forwards a request that arrives at api.1claw.co to Shroud on the agent's behalf (vault ≥ 0.61.19), so the SDK needs no special baseUrl
Direct calls to shroud.1claw.co still work and are required for DPoP-bound tokens
When execution_require_tee is true:
Execute requests run on Shroud's TEE execution surface — forced by the vault, no client routing needed
All direct secret reads by the agent are blocked — forces use of Execution Intent bindings
Both require intents_api_enabled / execution_intents_enabled to be on first.
Agent pairing with a fingerprint
An agent can enrol itself with its own Ed25519 public key. The vault returns an SSH-style SHA256: fingerprint the human compares on the approval page, and the agent collects its API key itself once approved — nothing travels by email.
To ask for specific access instead of the default starter grant (examples/** in the default vault), add requested_access. The human sees the vault, path and permissions on the approval page; if they grant it, the vault is created when missing, a policy is created on the path, and the vault is bound to the agent.
When a human owns an EVM Safe with a passkey (custody: passkey_owner) and has granted this agent an on-chain allowance (Safe Allowance Module), the agent spends within it without a touch; the module enforces the cap.
const spend = await client.agents.spendFromPasskeySafe(agentId, safeId, {
to: "0xRecipient…",
amount: "10000000000000000", // base units (0.01 ETH)
// token: "0xUSDC…" // omit for the native token
});
console.log(spend.data.tx_hash, spend.data.remaining_after);
Agent-to-Agent Delegation
Human-controlled authorization for inter-agent task delegation. Agents cannot delegate to other agents without an explicit delegation record created by a human.
// Create a delegation (human-only)
await client.agents.createDelegation(orchestratorId, {
delegate_id: subAgentId,
allowed_tools: ["delegate_task", "search_memory"],
max_daily_delegations: 100,
max_depth: 2,
delegation_mode: "caller",
expires_at: "2026-12-31T23:59:59Z",
});
// List delegations for an agent
const delegations = await client.agents.listDelegations(agentId);
// Get effective delegations (agent-callable — for runtime tool discovery)
const effective = await client.agents.getEffectiveDelegations(agentId);
// Update a delegation (human-only)
await client.agents.updateDelegation(agentId, delegationId, {
max_daily_delegations: 200,
is_active: false,
});
// Revoke a delegation (human-only)
await client.agents.revokeDelegation(agentId, delegationId);
Delegation modes: caller (delegate uses its own credentials), target (delegate uses target's config), both (either mode per invocation).
Overhead Budget and Transaction Count Limits
Protect against non-value drain attacks (ATA rent drain, XRP reserve exhaustion, Tron energy drain):
await client.agents.update(agentId, {
tx_max_per_day: 100, // Cap transactions per UTC day
tx_overhead_budget: { // Per-chain non-value cost budgets (native units)
solana: "0.5",
xrp: "100",
ethereum: "0.01",
},
solana_ata_allowlist: [ // Only these addresses may have ATAs created
"7nYzKqAqfaGEhN6oeKCQVFjduQ9qH1dWs2gVFkNKBpQF",
],
per_chain_guardrails: { // Per-chain overrides
solana: { max_per_day: 20, overhead_budget: "0.2", max_ata_creates_per_day: 5 },
},
});
// Check current spend:
const agent = await client.agents.get(agentId);
console.log(agent.data?.tx_count_today); // e.g. 42
console.log(agent.data?.tx_overhead_today_by_chain); // e.g. { "solana": "0.12" }
OAuth2 / PKCE ("Sign in with 1Claw")
The SDK provides helpers for implementing the full OAuth2 PKCE flow and managing tokens/consent:
import { generatePKCE, buildAuthorizeUrl, createClient } from "@1claw/sdk";
// 1. Generate PKCE pair
const pkce = await generatePKCE();
// 2. Build the authorize URL
const authUrl = buildAuthorizeUrl("https://1claw.co", {
clientId: "your-platform-app-slug",
redirectUri: "https://yourapp.com/callback",
scopes: ["openid", "profile", "email"],
state: "random-state",
codeChallenge: pkce.codeChallenge,
});
// 3. After redirect, exchange the code for tokens
const client = createClient({ baseUrl: "https://api.1claw.co" });
const tokens = await client.auth.exchangeOAuthCode({
code: "authorization-code-from-callback",
client_id: "your-platform-app-slug",
redirect_uri: "https://yourapp.com/callback",
code_verifier: pkce.codeVerifier,
});
// 4. Fetch user info
const userInfo = await client.auth.getUserInfo(tokens.data?.access_token);
// 5. Revoke a token (RFC 7009)
await client.auth.revokeToken({ token: "...", token_type_hint: "refresh_token" });
// 6. Revoke consent for an app (invalidates all tokens)
await client.auth.revokeConsent("platform-app-id");
OIDC Federation (Anthropic WIF, GCP STS, AWS STS)
https://api.1claw.co is a fully OpenID Connect–compliant issuer. External relying parties — Anthropic Workload Identity Federation, GCP STS, AWS STS, Stytch, etc. — can validate 1claw-issued JWTs by fetching:
GET https://api.1claw.co/.well-known/openid-configuration
GET https://api.1claw.co/.well-known/jwks.json
The SDK exposes one method to mint a federation token:
const tokenRes = await client.auth.exchangeFederatedToken({
audience: "https://api.anthropic.com",
// subjectToken? — defaults to the client's current login or apiKey
// scope? — optional space-separated subset of agent's scopes
});
const oidcJwt = tokenRes.data?.access_token; // RS256-signed; ~15 min default TTL, hard cap 1h
The acting agent must have federation_enabled: true and the audience must be on its federation_audiences allowlist (set via dashboard or client.agents.update). Every active KMS key version is published in JWKS, so verifiers reject unknown kids automatically when 1claw rotates keys.
For enterprises that require cryptographic proof that 1claw cannot access their secrets unilaterally, the SDK provides client-side CMEK utilities. Keys are generated and managed entirely on your side — only the SHA-256 fingerprint is stored on the server.
import { cmek } from "@1claw/sdk";
// Generate a 256-bit AES key (returns CryptoKey)
const key = await cmek.generateCmekKey();
// Compute fingerprint (SHA-256 hex)
const fingerprint = await cmek.cmekFingerprint(key);
// Enable CMEK on a vault
await client.vault.enableCmek(vaultId, { fingerprint });
// Encrypt a secret value before storing
const encrypted = await cmek.cmekEncrypt(key, "my-secret-value");
await client.secrets.set(vaultId, "path/to/secret", encrypted);
// Decrypt after retrieving
const res = await client.secrets.get(vaultId, "path/to/secret");
const plaintext = await cmek.cmekDecrypt(key, res.data.value);
Vaults can optionally use multi-party computation (MPC) for secret splitting. When MPC is enabled, the server holds one share and the client holds another — neither party can reconstruct the secret alone.
// Enable MPC on a vault
await client.vault.enableMpc(vaultId);
// Store a secret — response includes the client_share
const res = await client.secrets.set(vaultId, "my-key", "secret-value");
const clientShare = res.data?.client_share; // Save this securely on your side
// Retrieve a secret — pass client_share to reconstruct
const secret = await client.secrets.get(vaultId, "my-key", {
client_share: clientShare,
});
console.log(secret.data?.value);
// Disable MPC (converts back to standard encryption)
await client.vault.disableMpc(vaultId);
When MPC is enabled, set responses include a client_share field that must be stored client-side. The get method accepts an optional client_share parameter to reconstruct the full secret. Without the client share, the server returns only its share.
Agent Token Auto-Refresh
When using agent credentials (agentId + apiKey), the SDK automatically refreshes tokens 60 seconds before expiry. No manual token management needed:
const client = createClient({
baseUrl: "https://api.1claw.co",
apiKey: "ocv_...",
agentId: "agent-uuid",
});
// Tokens refresh transparently — just make API calls
The exchange response also says what the agent is entitled to (vault ≥ 0.61.17), so a tool host can shape its surface without a second call:
Changing a claim-bearing agent field (scopes, vault_ids, is_active, intents_api_enabled, shroud_enabled, execution_intents_enabled, *_require_tee, environment) via client.agents.update() revokes the agent's outstanding JWTs; the SDK's next request re-exchanges automatically.
DPoP (Proof-of-Possession)
Enable DPoP (RFC 9449) to bind tokens to the client's ephemeral keypair. When enabled, the SDK generates a P-256 ECDSA keypair at startup and attaches a DPoP proof JWT to every request — stolen tokens are unusable without the matching private key.
Forward SDK events to external systems (Splunk, Datadog)
No-op (server handles audit)
PolicyEngine
Pre-evaluate policies locally before API calls
No-op (server enforces)
Implement any interface in your own package — no PRs to the SDK needed.
Shroud Security (LLM Proxy)
Agents can route LLM traffic through Shroud, a TEE-based proxy with comprehensive security features. Configure per-agent security policies via the shroud_config object:
Every agent one bootstrap template provisioned, as one cohort. Each call acts on
all of them at once, which is why the surface is narrower than the per-agent
API: guardrails and capability flags are not bulk-patchable, and one bad field
refuses the whole patch.
const { data: fleet } = await client.platform.getFleet(appId, templateId);
console.log(`${fleet.agents_behind} of ${fleet.total_agents} behind`);
// Read the allowlist from the server rather than hard-coding it.
if (fleet.bulk_patchable_fields.includes("system_prompt")) {
await client.platform.bulkPatchFleet(appId, templateId, {
system_prompt: "You are a careful assistant.",
});
}
// A dry run changes nothing and claims no job, so job_id comes back null.
const { data: plan } = await client.platform.rolloutFleet(appId, templateId, {
dry_run: true,
});
console.log(plan.skipped_drifted, "agent(s) were hand-edited and would be skipped");
await client.platform.listFleetAgents(appId, templateId, { limit: 100 });
await client.platform.pauseFleet(appId, templateId);
v0.58 — Platform API control plane
App-scoped reads, spend-policy idempotency, and ownership transfer (plt_ auth unless noted):
What the org's agents spent on inference (vault ≥ 0.61.40), by provider, model,
agent and day, against the org's price card — plus a single dashboard-style
snapshot endpoint.
// Last 30 days by default; pass from/to/interval to change the window.
const { data: spend } = await client.spend.ai({
interval: "day",
provider: "anthropic",
});
console.log(spend.totals.cost_usd, "vs.", spend.previous.cost_usd, "previous window");
for (const row of spend.by_model) {
console.log(row);
}
// CSV export — one row per agent × provider × model. Returns a path, not a
// fetch: build the full URL yourself (e.g. `${baseUrl}${client.spend.aiCsvPath()}`).
const csvPath = client.spend.aiCsvPath({ from: "2026-09-01T00:00:00Z" });
// The price card: global list prices plus this org's overrides.
const { data: card } = await client.spend.listPrices();
// Owner/admin: override a price, or remove the override.
const { data: price } = await client.spend.setPrice({
provider: "anthropic",
modelPattern: "claude-opus-4-*",
inputUsdPerMtok: 12,
outputUsdPerMtok: 60,
});
await client.spend.deletePrice(price.id);
// Owner/admin: price any requests that arrived before a price card existed for their model.
const { data: result } = await client.spend.reprice();
console.log(`${result.repriced} request(s) priced`);
// A single snapshot across inventory, activity, spend, and health — the
// dashboard overview endpoint, `hours` default 24.
const { data: overview } = await client.org.overview(24);
console.log(overview.spend.inference_usd, overview.health);
v0.61 — One-call runtime provisioning
Agent (new or existing) + keys + default-vault grant + runtime + start, in one
call (vault ≥ 0.61.48). Every existing per-step gate (agent quota, runtime
quota, control-plane approval) still applies to this call.
const { data: provisioned } = await client.runtimes.provision({
name: "my-runtime",
template: "openclaw",
preset: "small",
// Either { id } for an existing agent, or { name } to create one — the
// create path also grants it read/write on a new default vault.
agent: { name: "my-agent" },
});
console.log(provisioned.runtime.id, provisioned.started);
if (provisioned.agent_api_key) {
// Only present when the agent was created here — shown once, store it now.
console.log("save this key:", provisioned.agent_api_key);
}
v0.63: Self-custody keys
client.keyCustody covers the HTTP side of self-custody: 2-of-3 FROST wallets
(client_tss: keygen, sign, share refresh, wrapped shares, recovery kit, restore),
Tron 2-of-3 native multisig and EVM 2-of-3 Safes (client_multisig, beta). The
device side (FROST rounds, wrapping shares under the passkey PRF, the recovery
kit) runs in the browser with @1claw/tss-wasm; these methods carry its output.
Methods that take passkeyToken send X-Passkey-Token; those that take
authConfirm send X-Auth-Confirm. Request and response types come from the
OpenAPI spec. Human users only.
const { data: chains } = await client.keyCustody.getTssChains();
// Prepare runs wallet access, sanctions, spend policy, transaction policy and
// treasury_send consensus. A consensus hold answers 202.
let res = await client.keyCustody.treasuryPrepare("solana", { to, value: "0.5" });
if (res.meta?.status === 202) {
const { pending_approval_id } = res.data as { pending_approval_id: string };
// ...once approved:
res = await client.keyCustody.treasuryPrepare("solana", {
to,
value: "0.5",
approval_id: pending_approval_id,
});
}
// Adding a second wrap needs a re-auth token for purpose "tss.key.wrap_add".
await client.keyCustody.rewrapClientShare(keyId, wrap, reauthToken);
// Kit coverage is recorded only from a kit proof.
await client.keyCustody.confirmKit(keyId, { generation, group_public_key, kit_proof });
api-types.ts is regenerated from @1claw/openapi-spec 0.61.76.
OpenAPI Types
The SDK's request types are generated from the OpenAPI 3.1 spec, published as @1claw/openapi-spec. Advanced users can access the raw generated types:
import type { paths, components, operations, ApiSchemas } from "@1claw/sdk";
// Access any schema from the spec
type Vault = ApiSchemas["VaultResponse"];
type Agent = ApiSchemas["AgentResponse"];
Regenerate types after spec changes (from the monorepo): cd packages/sdk && npm run generate — reads ../openapi-spec/openapi.yaml via openapi-typescript.
MCP Integration (AI Agents)
The SDK exposes MCP-compatible tool definitions for AI agents:
import { getMcpToolDefinitions, McpHandler } from "@1claw/sdk/mcp";
import { createClient } from "@1claw/sdk";
// Get tool definitions for your agent's tool registry
const tools = getMcpToolDefinitions();
// → 1claw_get_secret, 1claw_set_secret, 1claw_list_secret_keys, etc.
// Dispatch tool calls from your agent
const client = createClient({ baseUrl: "...", token: "..." });
const handler = new McpHandler(client);
const result = await handler.handle("1claw_get_secret", {
vault_id: "...",
key: "OPENAI_KEY",
});
With Vercel AI SDK
import { tool } from "ai";
import { z } from "zod";
import { createClient } from "@1claw/sdk";
const client = createClient({ baseUrl: "...", apiKey: "..." });
export const oneclawTools = {
getSecret: tool({
description: "Fetch a secret from the 1claw vault",
parameters: z.object({
vaultId: z.string(),
key: z.string(),
}),
execute: async ({ vaultId, key }) => {
const res = await client.secrets.get(vaultId, key);
if (res.error) return { error: res.error.message };
return { status: "available", hint: `Secret retrieved (${key})` };
},
}),
};
Списка инструментов пока нет. У удалённых серверов он появляется после первой проверки состояния.
FAQ
Вопросы
Как установить @1claw/sdk?
Скопируйте на этой странице конфигурацию stdio для Cursor, Claude Desktop, Claude Code или VS Code. Она использует установку издателя, а не прокси PlugMCP.
Нужен ли API-ключ для @1claw/sdk?
В этой записи не указано обязательных переменных окружения.
Какой транспорт использует @1claw/sdk?
@1claw/sdk работает локально через stdio.
Когда @1claw/sdk проверялся в последний раз?
Последняя проверка: 2026-11-15. TypeScript SDK for 1Claw Vault — secret management for AI agents
