Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y @1claw/[email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add 1claw-cli -- npx -y @1claw/cli@0.62.0รันในเทอร์มินัล
{ "mcpServers": { "1claw-cli": { "command": "npx", "args": [ "-y", "@1claw/[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
⭐ Star 1clawAI/agent-templates — ready-to-run agent templates wired to 1Claw. It is our single starred repo.
Command-line interface for 1Claw.
Use the CLI when you want vault and agent operations from a terminal, a CI pipeline, or a shell script. Create vaults, rotate secrets, provision agents, set policies, submit transactions, and import files without opening the dashboard.
CLI for 1Claw — secrets management for AI agents and humans
.env1claw setup auto-configures Cursor, Claude Desktop, VS Code, and other MCP clients in one pass. 1claw env run injects secrets into a subprocess so your app reads them from the environment at runtime, not from a committed file. Auth works via browser device flow, email/password, or ONECLAW_TOKEN / ONECLAW_API_KEY in CI.
HTTP surface: Commands call the Vault REST API. The contract lives in @1claw/openapi-spec (openapi.yaml / openapi.json).
brew install 1clawAI/tap/1claw
npm install -g @1claw/cli
Or use directly with npx:
npx @1claw/cli login
1claw login
Opens your browser to 1claw.co/cli/verify where you confirm the login code. The CLI polls for approval and stores the token locally in ~/.config/1claw/.
1claw login --email
Prompts for email and password. Supports MFA if enabled on your account.
Set environment variables — no login command needed:
export ONECLAW_TOKEN="your-jwt"
# or
export ONECLAW_API_KEY="1ck_..."
1claw login # Authenticate via browser
1claw setup # Login + POST /v1/onboarding/provision + configure MCP clients
1claw import .env # Import secrets from a .env file into your vault
Auto-detect and configure AI clients (Claude Desktop, Cursor, VS Code, Zed, Windsurf, Claude Code, Continue.dev) to use the 1Claw MCP server for runtime secret access.
1claw setup # Interactive: login, onboarding provision (vault + agent + ** policy), configure clients
1claw setup --client cursor # Configure only Cursor
1claw setup --agent-key ocv_... # Use a specific agent API key (skips provisioning)
1claw setup --project # Write MCP config to current project instead of global
1claw setup --skip-auth # Skip authentication check
1claw setup --local # Configure for local daemon mode (no cloud)
When you choose "Create a new agent", setup provisions everything end-to-end:
secrets/* for the agentvault_idsThe generated credential is stored as ONECLAW_AGENT_API_KEY in the selected
MCP client's configuration, so the MCP process receives it when the AI client
starts. setup does not print the one-time key to the terminal. Those
configuration files contain a secret and are written with owner-only (0600)
permissions.
If you provide an existing key (--agent-key or "Enter an existing key"), provisioning is skipped — the assumption is those resources already exist.
Import secrets from a local .env file into a 1Claw vault.
1claw import .env # Import all keys from .env
1claw import .env.production \
--prefix prod/ # Add a path prefix to all keys
1claw import .env --dry-run # Preview what would be imported
1claw import .env --force # Overwrite existing secrets
1claw import .env --vault <id> # Import to a specific vault
Handles standard .env syntax: KEY=value, single/double-quoted values, export prefix, comments, and multiline values.
1claw login # Browser-based login
1claw login --email # Email/password login
1claw forgot-password # Request password reset email (no login required)
1claw reset-password # Set new password from email token (no login required)
1claw set-password # Set a password (platform users who don't have one)
1claw change-email # Change your email address (sends verification code)
1claw logout # Clear stored credentials
1claw whoami # Show current user info
# OIDC federation (RFC 8693 token exchange)
1claw auth federated-token \
--audience https://api.anthropic.com # Mint short-lived RS256 JWT for an external relying party
1claw auth federated-token \
-a https://api.anthropic.com --raw # Just the access_token, for `export` / pipes
1claw auth federated-token \
-a https://api.anthropic.com \
--subject-token "$ONECLAW_AGENT_API_KEY" # Override the default subject token (current login or env)
Password reset only applies to email/password accounts (not Google/SSO-only). After reset, open the link in the email (dashboard) or pass --token to reset-password.
set-password is for Platform API users provisioned via OIDC who don't have a password yet. change-email sends a 6-digit verification code to the new address and prompts you to enter it inline.
auth federated-token uses your current 1claw credential as the subject_token and asks 1claw (an OIDC issuer at https://api.1claw.co) for a short-lived RS256 JWT scoped to the audience. The acting agent must have federation_enabled = true and the audience must be on its federation_audiences allowlist (set in the dashboard or via agents.update). Pair with --raw for shell pipelines, e.g. Anthropic Workload Identity Federation:
ANTHROPIC_OIDC=$(1claw auth federated-token -a https://api.anthropic.com --raw)
# exchange ANTHROPIC_OIDC at Anthropic's WIF endpoint for an sk-ant-oat01-... token
1claw vault list # List all vaults
1claw vault create my-vault # Create a vault
1claw vault get <id> # Get vault details
1claw vault delete <id> # Delete a vault
1claw vault link <id> # Set default vault for this machine
1claw vault unlink # Remove default vault
1claw secret list # List secrets (metadata only)
1claw secret list --prefix api-keys/ # Filter by prefix
1claw secret get <path> # Fetch decrypted value
1claw secret get <path> --quiet # Raw value only (for piping)
1claw secret set <path> <value> # Create/update a secret
1claw secret set <path> --type password # With explicit type
echo "sk_live_..." | 1claw secret set <path> --stdin # From stdin
1claw secret delete <path> # Soft-delete
1claw secret rotate <path> <new-value> # New version
1claw secret describe <path> # Metadata without value
1claw env pull # Pull secrets as .env format
1claw env pull -e production # Pull for a specific environment
1claw env pull --format json # As JSON
1claw env pull --format shell # As export statements
1claw env pull -o .env.local # Write to file
1claw env push .env # Push .env file to vault
1claw env push .env -e staging # Push to a specific environment
1claw env run -- npm start # Run with secrets injected
1claw env run -e production -- npm start # Run with a specific environment
1claw env run --prefix config/ -- ./deploy.sh # Only inject matching secrets
1claw env run --no-cache -- npm start # Skip local cache, always fetch from API
Manage per-vault environment variables with environment scoping and precedence-based resolution.
1claw env ls # List all env vars
1claw env ls production # List env vars for a specific environment
1claw env add DATABASE_URL # Add env var (prompts for value)
1claw env add DATABASE_URL production # Add env var scoped to an environment
1claw env add API_KEY --sensitive # Mark as sensitive (write-only)
1claw env rm DATABASE_URL # Remove env var
1claw env rm DATABASE_URL preview # Remove env var from a specific environment
1claw env environments ls # List environments for the vault
1claw env environments add staging # Create a custom environment
1claw env environments rm staging # Delete a custom environment
The -e, --environment flag is available on env pull, env push, and env run to scope operations to a specific environment.
Cache secrets locally in an AES-256-GCM encrypted file for offline env run. The encryption key is derived from your authentication token.
1claw env cache # Download and cache secrets locally
1claw env cache --ttl 3600 # Cache with 1-hour TTL (default: 300s)
1claw env cache-status # Show cache age, vault ID, secret count
1claw env cache-clear # Delete the local cache
When a valid cache exists, env run uses it automatically instead of calling the API. Use --no-cache on env run to bypass. Cache is stored at ~/.config/1claw/env-cache.enc (mode 0600).
1claw agent list # List agents
1claw agent create my-agent # Create agent (api_key auth)
1claw agent create my-agent \
--token-ttl 300 \ # 5-minute token TTL
--vault-ids <uuid1>,<uuid2> # Restrict to specific vaults
1claw agent get <id> # Agent details + SSH public key
1claw agent update <id> \
--token-ttl 600 \ # Update TTL
--vault-ids <uuid> \ # Update vault binding
--shroud true \ # Enable/disable Shroud LLM proxy
--intents-api true \ # Enable/disable Intents API
--execution-intents true \ # Enable/disable Execution Intents (Pro+)
--execution-guardrails '{"allowed_hosts":["api.example.com"]}'
1claw agent delete <id> # Delete an agent
1claw agent children <parent-id> # Child agents (vault ≥ 0.61.30)
1claw agent create-child <parent-id> summariser-7 \
--scopes secrets:read --namespaces child:doc-7 # Sub-agent: own key/memory/approval policy, subset of the
# parent's vaults+scopes, inherits its policies, free of the agent cap
1claw agent router-keys <id> # sk-shroud-v1 router keys (vault ≥ 0.61.31)
1claw agent create-router-key <id> --name sdk \
--max-streams 5 # Static Bearer for a stock OpenAI/Anthropic SDK pointed at
# the Shroud gateway; shown once; revoke lands within 60 s
1claw agent revoke-router-key <id> <key-id>
1claw agent tool-bindings <id> # Rehydration policy (vault ≥ 0.61.33)
1claw agent bind-secret <id> providers/stripe/api-key http_request \
--arg /headers/Authorization --hosts api.stripe.com # The enclave may put this secret only here
1claw agent unbind-secret <id> <binding-id>
1claw agent token <id> --api-key ocv_... # Exchange the agent's API key for a JWT
1claw agent token <id> --quiet # Raw token (key from ONECLAW_AGENT_API_KEY or a prompt)
1claw agent enroll my-agent \
--email [email protected] # Self-enroll (no auth needed)
1claw agent enroll my-agent --pair # Pair: prints an SSH-style fingerprint the human
# compares on the approval page; collects the API
# key here on approval (no key in email)
1claw agent create my-agent \
--shroud \ # Enable Shroud LLM proxy
--execution-intents \ # Enable Execution Intents (Pro+)
--intents-require-tee \ # TEE-only signing (Pro+)
--execution-require-tee \ # TEE-only execution (Pro+)
--tx-to-allowlist 0x... \ # Transaction guardrails
--tx-max-value 0.1 \
--tx-daily-limit 1.0 \
--tx-allowed-chains sepolia,base \
--tx-max-per-day 100 \ # Daily count cap
--tx-overhead-budget '{"solana":"0.5"}' \ # Non-value cost budget
--solana-ata-allowlist addr1,addr2 # ATA creation restriction
1claw agent create prod-agent \
--environment production \ # Tag agent with named environment
--environment-locked \ # Lock tag after creation
--env-auto-resolve # Auto-fill env resolve from tag
1claw agent update <id> \
--environment preview \ # Change environment tag
--per-environment-guardrails '{"production":{"tx_max_value":"1.0"}}'
When Intents API is enabled, configure graduated human-in-the-loop thresholds and extended hard guardrails:
1claw agent create my-agent --intents-api \
--tx-approval-policy '{"require_above_native":{"ethereum":"0.1"},"require_for_new_recipients":true}' \
--typed-data-policy approve \ # EIP-712 → HITL (deny|approve)
--simulation-failure-policy approve \ # Tenderly revert → HITL
--raw-signing-policy approve \ # Raw digest → HITL (allow|deny|approve)
--tx-block-unlimited-approvals \
--tx-max-value-usd 1000 \
--tx-daily-limit-usd 5000 \
--allow-erc4337 \
--allow-eip7702 \
--address-screening-policy deny # off | deny | approve (recipient screening)
1claw agent update <id> \
--tx-approval-policy '{"require_for_unlimited_approvals":true}' \
--clear-auto-suspended # Clear circuit-breaker suspension (owner/admin)
# Org emergency stop (owner/admin)
curl -X POST https://api.1claw.co/v1/org/freeze -H "Authorization: Bearer $ONECLAW_TOKEN"
curl -X POST https://api.1claw.co/v1/org/unfreeze -H "Authorization: Bearer $ONECLAW_TOKEN"
Matching transactions return 202 awaiting_approval with an approval_id. Approve via dashboard or 1claw approval decide <id> approve.
The CLI's agent create always uses auth_method=api_key (default; returns an ocv_ API key). To register an mtls or oidc_client_credentials agent, use the SDK or POST /v1/agents directly — those auth methods don't generate an API key.
All agents automatically receive an Ed25519 SSH keypair for future A2A messaging. The public key is shown in agent get output.
1claw connector presets # Catalogue: gmail, slack, github, stripe, hubspot, … + event_sources
1claw connector list <agent-id> # Installed on an agent, and whether each is signed in
1claw connector install <agent-id> gmail \
--scopes https://www.googleapis.com/auth/gmail.readonly # Narrow scopes; prints the sign-in URL
1claw connector install <agent-id> api-token \
--name crm --host api.example.com --token $TOKEN # Any HTTPS API with a pasted token
1claw connector subscribe <agent-id> <binding-id> gmail.message.received # Polled event source →
# automation events (trigger_type: event); first poll primes
1claw connector subscriptions <agent-id> # State, emitted count, last error
1claw connector poll <agent-id> <sub-id> # Poll now
1claw connector unsubscribe <agent-id> <sub-id>
Human-controlled inter-agent delegation. Create, manage, and revoke delegation permissions between agents.
1claw agent delegation create <agent-id> \
--delegate <delegate-agent-id> \
--tools "delegate_task,search_memory" \
--daily-limit 100 \
--depth 2 \
--mode caller \
--expires 2026-12-31T23:59:59Z # Create a delegation
1claw agent delegation list <agent-id> # List delegations
1claw agent delegation get <agent-id> <delegation-id> # Get details
1claw agent delegation update <agent-id> <delegation-id> \
--daily-limit 200 --active false # Update
1claw agent delegation revoke <agent-id> <delegation-id> # Revoke
Delegation modes: caller (delegate uses own credentials), target (delegate uses target's config), both.
Convention 6 shadow mode, revision history, and dry-run replay for agent/binding guardrail changes:
1claw guardrails shadow-report # Would-deny violations (owner/admin)
1claw guardrails shadow-report --since 2026-01-01T00:00:00Z
1claw guardrails revisions # Audit trail of guardrail edits
1claw guardrails replay <agent-id> \
--draft-guardrails '{"tx_max_value_eth":"0.1"}' \
--days 7
Widening agent or binding guardrails may return 202 with an approval_id. Approve via 1claw approval decide, then resubmit with --approval-id <uuid> on agent update or agent binding update.
Execution bindings support Convention 6 shadow mode via --execution-enforcement log|enforce on agent create / agent update.
Counterfactual Safe accounts derived from agent EOA owners. On-chain deploy/module broadcast is stubbed (501) pre-Guard audit.
1claw agent accounts list <agent-id>
1claw agent accounts migrate <agent-id> --chain ethereum [--deprecate-eoa]
1claw agent accounts deprecate-eoa <agent-id> --chain ethereum
1claw safe module-registry ethereum # Public Guard + Zodiac addresses
1claw safe sync-allowances # Org admin: compile allowance drift report
Step-up policies for treasury wallet send/swap/export. Configured per user via API; embedded clients call GET /v1/treasury/wallets/auth-policy.
# Via API (SDK/dashboard) — not yet a dedicated CLI subcommand:
# PUT /v1/auth/human-factor-auth { "policy": { "require_passkey": true } }
# Passkey tx-assert: POST /v1/auth/passkeys/tx-assert/begin { "tx_digest", "action": "send"|"swap" }
Treasury sends accept X-Auth-Confirm (password) or X-Passkey-Token (from tx-assert ceremony).
Lease short-lived Bankr wallet API keys from your org's partner key (BANKR_PARTNER_KEY on Vault). Privileged — agents need explicit policy on agents/{id}/bankr/* in __agent-keys. Human callers receive api_key once; agent tokens omit it.
1claw agent bankr-key lease <agent-id> # Default 15 min TTL
1claw agent bankr-key lease <agent-id> --ttl 600 --wallet wlt_abc123
1claw agent bankr-key list <agent-id> # Active leases (no secrets)
1claw agent bankr-key revoke <agent-id> <lease-id>
Order prepaid and gift cards via x402 micropayments. The agent's USDC signing key on Base pays Laso; the PAN/CVV are never exposed to the agent.
# Order a prepaid card ($5 USD)
1claw card order <agent-id> --kind prepaid --amount 5.00
# Order a gift card
1claw card order <agent-id> --kind gift_card --amount 25.00 --server-id <laso-server-id>
# List cards (masked — last4 only)
1claw card list
# Get card status
1claw card get <card-id>
# Reveal card details (human-only, requires password re-auth)
1claw card reveal <card-id>
# Void a card (blocks future reveals)
1claw card void <card-id>
# Refresh balance from issuer
1claw card refresh <card-id>
# Import a card manually (human-only)
1claw card import --pan 4111111111111111 --cvv 123 --exp-month 12 --exp-year 2028 --brand visa --currency USD
Ordering guardrails (human-set per agent):
1claw agent update <agent-id> --cards-enabled true
1claw agent update <agent-id> --card-max-order-usd 100
1claw agent update <agent-id> --card-daily-limit-usd 500
Manage named credential handles and execute HTTP/GraphQL intents through the Vault proxy. Requires Pro+ tier and execution_intents_enabled on the agent.
# Enable on an agent
1claw agent update <agent-id> --execution-intents true
1claw agent update <agent-id> --execution-guardrails '{"allowed_hosts":["api.example.com"],"max_duration_ms":30000}'
# Bindings (human-only create/update/delete)
1claw agent binding create <agent-id> \
--name github-api --type http \
--config '{"base_url":"https://api.github.com","auth_type":"bearer"}' \
--credential '{"token":"ghp_..."}'
# Use a vault secret as a live-pointer credential (resolved at execution time)
1claw agent binding create <agent-id> \
--name stripe-api --type http \
--config '{"base_url":"https://api.stripe.com","auth_type":"bearer"}' \
--vault-ref <vault-id>:secrets/stripe-key
1claw agent binding list <agent-id>
1claw agent binding get <agent-id> <binding-id>
1claw agent binding update <agent-id> <binding-id> --guardrails '{"allowed_paths":["/repos/*"]}'
1claw agent binding update <agent-id> <binding-id> --vault-ref <vault-id>:secrets/new-key
1claw agent binding test <agent-id> <binding-id>
1claw agent binding rotate-credential <agent-id> <binding-id> --credential '{"token":"ghp_new"}'
1claw agent binding delete <agent-id> <binding-id>
# Execute (agent or human token with execution_intents claim)
1claw agent binding execute <agent-id> \
--binding github-api --intent-type http \
--params '{"method":"GET","path":"/user"}'
# Local proxy: run a vendor CLI/SDK through a binding with no key on this machine.
# Each request becomes an execute call; the tool's own credential is dropped, the
# vault injects the binding's. 403 on a policy refusal, 502 if the vault is unreachable.
# The proxy prints a per-run token; the tool must present it where its real key
# would go (Authorization: Bearer or X-API-Key) — anything else on the host gets 401.
# Pin it with --token or ONECLAW_PROXY_TOKEN; --no-auth turns the check off.
1claw agent binding proxy bankr --agent-key "$AGENT_ID:$AGENT_KEY" --port 8787 --token "$PROXY_TOKEN"
# export BANKR_API_URL=http://127.0.0.1:8787
# export BANKR_API_KEY=$PROXY_TOKEN # the proxy token, never forwarded upstream
# rm -f ~/.bankr/config.json
# Same thing against the local daemon (offline, local vault + `daemon policy`):
1claw daemon policy add bankr-api-key --hosts api.bankr.bot --inject-as header --header-name X-API-Key
1claw daemon proxy bankr-api-key --base-url https://api.bankr.bot --port 8787 --token "$PROXY_TOKEN"
1claw agent binding executions <agent-id> # Audit log
Use --config-file, --guardrails-file, --credential-file, or --params-file instead of inline JSON when needed.
Credential sources: Bindings support two credential modes:
--credential '{"token":"..."}' — the value is stored in the __agent-keys vault.--vault-ref <vault-id>:<path> — references an existing vault secret. The credential is resolved at execution time and always uses the latest version. Useful for secrets that rotate independently or are shared across multiple bindings.You cannot use both --credential and --vault-ref on the same command.
Submit, sign, and inspect on-chain transactions for agents with Intents API enabled.
1claw agent tx submit <agent-id> \
--to 0xRecipient \
--value 0.01 \
--chain sepolia # Sign + broadcast
1claw agent tx submit <agent-id> \
--to 0xRecipient \
--value 0.01 \
--chain sepolia \
--simulate # Simulate before signing
1claw agent tx sign <agent-id> \
--to 0xRecipient \
--value 0.01 \
--chain sepolia # Sign only (no broadcast)
1claw agent tx list <agent-id> # List recent transactions
1claw agent tx get <agent-id> <tx-id> # Get transaction details
Common options for submit and sign:
list and get accept --include-signed-tx to include the raw signed transaction in the response.
Non-EVM chains (Bitcoin, Solana, XRP, Cardano, Tron) use the same submit / sign commands with chain-specific flags instead of --to / --value:
# Solana devnet — native SOL transfer (sign-only)
1claw agent tx sign <agent-id> \
--chain solana-devnet \
--to <recipient-base58> \
--value 0.001
# Bitcoin testnet — fee rate optional (sat/vByte)
1claw agent tx submit <agent-id> \
--chain bitcoin-testnet \
--to <bech32-address> \
--value 0.00001 \
--fee-rate-sat-per-vbyte 5
# XRP — simple Payment with optional destination tag
1claw agent tx submit <agent-id> \
--chain xrp-testnet \
--to r... \
--value 1 \
--destination-tag 12345
# XRP — arbitrary XRPL transaction type via --xrpl-tx-json
# Supports 30+ types: TrustSet, OfferCreate, NFTokenMint, AMMCreate, EscrowCreate, etc.
1claw agent tx submit <agent-id> \
--chain xrp \
--xrpl-tx-json '{"TransactionType":"TrustSet","LimitAmount":{"currency":"USD","issuer":"rIssuer...","value":"100"}}'
# Tron — optional fee limit (sun)
1claw agent tx submit <agent-id> \
--chain tron-shasta \
--to T... \
--value 1 \
--fee-limit-sun 10000000
# Cardano preprod — optional TTL (slots)
1claw agent tx submit <agent-id> \
--chain cardano-preprod \
--to addr_test1... \
--value 1.5 \
--ttl 3600
Supported non-EVM chain names match the chain registry (bitcoin, bitcoin-testnet, solana, solana-devnet, xrp, xrp-testnet, cardano, cardano-preprod, tron, tron-shasta). SPL (Solana) and TRC-20 (Tron) token transfers accept --token-mint and --token-decimals.
Manage per-agent multi-chain signing keys. Keys are generated server-side and stored in the vault — the private key never leaves the HSM.
1claw agent keys list <agent-id> # List all signing keys
1claw agent keys create <agent-id> \
--chain ethereum # Provision a key (secp256k1)
1claw agent keys create <agent-id> \
--chain solana # Provision a key (ed25519)
1claw agent keys rotate <agent-id> \
--chain ethereum # Rotate key (new version)
1claw agent keys delete <agent-id> \
--chain ethereum # Deactivate key
1claw agent export-signing-key <agent-id> \
--chain ethereum # Export private key (requires password)
Export requires re-authentication via your account password. The private key is displayed once and audit-logged.
Supported chains: ethereum, bitcoin, solana, xrp, cardano, tron. The curve is determined by the chain.
agent sign)Sign messages, typed data, or raw transactions using the agent's multi-chain signing key.
# EIP-191 personal_sign
1claw agent sign <agent-id> \
--intent-type personal_sign \
--message 0x48656c6c6f # Hex-encoded message
# EIP-712 typed data
1claw agent sign <agent-id> \
--intent-type typed_data \
--typed-data ./permit.json # JSON file with EIP-712 payload
# Raw transaction (all EIP-2718 types: legacy, EIP-1559, EIP-4844, EIP-7702)
1claw agent sign <agent-id> \
--intent-type transaction \
--to 0xRecipient \
--value 0.01 \
--chain base \
--tx-type 2 # EIP-1559
Common options for agent sign:
Multi-chain wallet generation for human users (replaces CDP embedded wallets). Private keys are stored in a per-org __treasury-keys vault with tier-appropriate MPC custody.
1claw treasury generate # Generate wallets for all supported chains
1claw treasury generate \
--chains ethereum,solana,bitcoin # Generate for specific chains only
1claw treasury list # List your treasury wallets (custody + backup state)
1claw treasury get <chain> # Get wallet details for a chain
1claw treasury tss-chains # Chains enabled for self-custody wallets in this org
1claw treasury safes list # Your 2-of-3 multisig Safes (EVM)
1claw treasury safes retire <safe-id> # Retire a Safe that was never deployed and holds nothing
1claw treasury balance <chain> # Get native + token balances
1claw treasury balance ethereum \
--tokens 0xA0b8...eB48,0x6B17...71d0 # Include ERC-20 token balances
1claw treasury send <chain> \
--to 0xRecipient --amount 10000000000000000 # Send native currency: wei on EVM (requires password)
1claw treasury send solana \
--to <address> --amount 0.5 # Non-EVM amounts are in major units
1claw treasury send ethereum \
--to 0xRecipient --amount 100000000 \
--token 0xA0b8...eB48 # ERC-20 transfer (amount in token base units)
1claw treasury swap <chain> \
--sell-token native --buy-token 0xA0b8... \
--amount 0.1 # Swap via DEX aggregator
1claw treasury export <chain> --password <pw> # Export private key (audit-logged, requires password)
1claw treasury rotate <chain> # Rotate key (new keypair, old deactivated)
1claw treasury deactivate <chain> # Deactivate wallet for a chain
Supported chains: ethereum, bitcoin, solana, xrp, cardano, tron. Available on all tiers (counts toward wallet quota).
send and swap require re-authentication via account password (prompted interactively or via --password). Both operations are audit-logged. When the org requires consensus for treasury sends, the API answers with a pending approval; re-run send with --approval-id <id> once it is approved.
send, export and rotate work on server-custody wallets. Self-custody wallets (custody client_tss, the 2-of-3 keys; client_multisig, Tron multisig) and multisig Safes need your passkey, so they are created, backed up and spent from the dashboard. The API refuses export and rotate on them; a self-custody key leaves 1Claw only through its recovery kit and the offline oneclaw-recover tool.
Create, sign, and execute Safe multisig transaction proposals.
1claw treasury proposal create <treasury-id> \
--to 0xRecipient --value 1000000000000000 \
--safe-tx-hash 0x... --nonce 7 # Create a proposal (value in wei)
1claw treasury proposal list <treasury-id> # List proposals
1claw treasury proposal list <treasury-id> \
--status pending # Filter by status
1claw treasury proposal get <treasury-id> <id> # Get proposal + signatures
1claw treasury proposal sign <treasury-id> <id> \
--signature 0x... --signer-address 0xOwner \
--decision approve # Approve with EIP-712 signature
1claw treasury proposal execute <treasury-id> <id> # Force-execute if threshold met
1claw treasury proposal cancel <treasury-id> <id> # Cancel pending proposal
1claw policy list # List policies for default vault
1claw policy create \
--principal-type agent \
--principal-id <uuid> \
--path "api-keys/*" \
--permissions read,write # Create a policy
1claw policy delete <id> # Remove a policy
1claw policy-backend get # Show backend, mode, scope, circuit breaker
1claw policy-backend set --mode shadow # Stay in shadow mode (default)
1claw policy-backend set --backend builtin+cedar --mode enforce
1claw policy-backend shadow-report # Divergence report (shadow vs builtin)
1claw cedar-policy create --name read-only --file ./policy.cedar
1claw cedar-policy test --principal-type agent --principal-id <uuid> \
--action read --resource-path api-keys/stripe --vault-id <uuid>
1claw opa-policy create --name baseline --rego-file ./policy.rego [--entrypoint oneclaw/allow]
1claw opa-policy test --principal-type agent --principal-id <uuid> \
--action read --resource-path api-keys/stripe --vault-id <uuid>
1claw sub-org create acme [--isolation-mode full|shared_billing]
1claw sub-org list
1claw sub-org get <id> # Includes granted permissions
1claw sub-org add-user <id> --email [email protected] --role member
1claw sub-org grant <id> --permission <perm>
1claw sub-org revoke <id> <perm>
1claw contract-abi list # List org contract ABIs
1claw contract-abi create --chain ethereum \
--address 0x... --abi-file ./erc20.json # Register an ABI
1claw contract-abi delete <id> # Remove from registry
1claw pending-approval list # List pending approvals
1claw pending-approval get <id> # Details + signatures
1claw pending-approval approve <id> --decision approve --payload-hash <hash> [--credential-type passkey]
1claw pending-approval execute <id> # Execute approved action (human)
1claw pending-approval cancel <id> # Cancel pending approval
1claw share create <secret-id> --link # Open share link
1claw share create <secret-id> --to user:<id> # Share with a user
1claw share create <secret-id> --to agent:<id> # Share with an agent
1claw share create <secret-id> --to [email protected] \
--expires 2026-12-31T00:00:00Z # Invite by email (default expiry: 7 days)
1claw share list # List outbound shares
1claw share list --inbound # List inbound shares
1claw share accept <id> # Accept a share
1claw share decline <id> # Decline a share
1claw share revoke <id> # Revoke a share
1claw billing status # Plan, usage, limits
1claw billing credits # Credit balance
1claw billing usage # Detailed usage table
1claw billing ledger # Credit transaction history
1claw audit list # Recent audit events
1claw audit list --vault <id> # Filter by vault
1claw audit list --action secret.read # Filter by action
Register and manage event webhooks for your org.
1claw webhook create \
--url https://example.com/hook \
--events wallet.transfer.sent,proposal.created # Register webhook
1claw webhook create \
--url https://example.com/hook \
--events agent.transaction.broadcast \
--description "tx feed" # Prints the signing secret once; verify deliveries with it
1claw webhook list # List all webhooks
1claw webhook get <id> # Get webhook details
1claw webhook update <id> \
--active false # Disable a webhook
1claw webhook update <id> \
--events proposal.signed,proposal.executed # Change event subscriptions
1claw webhook delete <id> # Delete a webhook
Supported events: wallet.transfer.sent, wallet.transfer.received, proposal.created, proposal.signed, proposal.executed, proposal.cancelled, agent.transaction.broadcast, agent.transaction.signed, signing_key.rotated, policy.created, policy.updated, policy.deleted.
1claw proxy # Start a local OpenAI-compatible proxy → Shroud (default :11434)
1claw proxy --port 8080 # Use a specific port (auto-falls-forward if busy)
1claw proxy --provider anthropic # Force a provider instead of auto-detecting from model
1claw proxy --shroud-url https://shroud.1claw.co # Override Shroud endpoint
1claw proxy -v # Verbose: log each proxied request
1claw proxy is for letting tools that only know how to talk to localhost:11434 (e.g. Ollama-compatible clients) hit Shroud transparently. Auth is taken from --agent-key (agent_id:api_key or just ocv_…) or ONECLAW_AGENT_API_KEY. If the preferred port is busy, the CLI scans up to 32 higher ports automatically.
1claw mfa status # Check 2FA status
1claw mfa enable # Set up TOTP 2FA
1claw mfa disable # Turn off 2FA
Manage platform apps for developers building multi-tenant applications on top of 1Claw.
1claw platform create my-app my-slug # Register a new platform app (returns plt_ key)
1claw platform list # List all platform apps in your org
1claw platform get <app-id> # Get platform app details
1claw platform update <app-id> --name new-name # Update app settings
1claw platform delete <app-id> # Delete a platform app
1claw platform rotate-key <app-id> # Rotate the plt_ API key
1claw platform rotate-webhook-secret <app-id> # Rotate the webhook HMAC secret
1claw platform reissue-claim <connection-id> # Reissue a claim URL (no re-provisioning)
1claw platform app-stats <app-id> # Connection/bootstrap/grant statistics
1claw platform marketplace # Browse the public platform marketplace
# Pay an x402 paywall. The vault decides what may be signed; this holds the
# connection and nothing else.
1claw pay --agent <id> https://api.example.com/premium # passkey per payment
1claw pay --agent <id> --mode session https://api.example.com/premium # one touch, a capped window
# USDC/USDT on Base, Optimism, Avalanche, BNB Chain and Solana. An asset the
# registry does not know is refused rather than priced by guess.
#
# Enable it first (human only) — pay is off until someone turns it on:
# PATCH /v1/agents/{id}/pay/settings {"pay_enabled":true,"pay_max_usd":"1.00"}
# and the agent needs an Ethereum signing key funded with USDC on Base.
#
# Try it without spending anything — examples/x402-pay-cli has a mock paywall:
# node paywall.mjs & ONECLAW_PAY_DEV=1 1claw pay --agent any http://localhost:4022/premium
# Fleets — every agent one template provisioned, as one cohort.
# Each of these acts on all of them at once, so the mutating ones confirm
# first and print how many agents they are about to touch.
1claw platform fleet status <app-id> <template-id> # Version skew and drift
1claw platform fleet agents <app-id> <template-id> # List them (--drifted to filter)
1claw platform fleet patch <app-id> <template-id> \
--set system_prompt="You are..." # Guardrails/capability flags refused
1claw platform fleet rollout <app-id> <template-id> \
--dry-run # Plan; changes nothing, claims no job
1claw platform fleet rollout <app-id> <template-id> # Apply; skips hand-edited agents
1claw platform fleet pause <app-id> <template-id> # Deactivate the whole cohort
1claw platform upsert-user \
--email [email protected] # Provision or find a user (platform-only)
1claw platform upsert-user \
--subject-token <jwt> # Provision via OIDC subject token
# Resource grants (user-side delegation to platform apps)
1claw platform grant <connection-id> \
--vault-ids <id1> <id2> \
--agent-ids <id3> # Grant access to vaults/agents
1claw platform grant <connection-id> \
--vault-ids <id> \
--permissions read,write \
--allowed-paths "secrets/*" \
--expires-at 90d # Grant with restrictions
1claw platform list-grants <connection-id> # List active grants
1claw platform revoke-grant <connection-id> <grant-id> # Revoke a grant
# Template management
1claw platform templates list <app-id> # List templates for an app
1claw platform templates create <app-id> <name> \
--spec ./template.json # Create a template from JSON spec
# Connected users
1claw platform users list <app-id> # List connected users for an app
1claw platform connected-apps # List apps connected to your account
# Delegation (operate on connected-user resources)
1claw platform resources <connection-id> # List platform-managed resources
1claw platform delegation-log <connection-id> # View delegation audit log
1claw platform exec --connection <id> -- \
agent list # Run a CLI command in delegated context
# Audit
1claw platform audit <app-id> # View platform audit events
# Platform API expansion (v0.57+)
1claw platform siwe-challenge # SIWE nonce for wallet-native user provisioning (plt_ auth)
1claw platform connection <connection-id> # Connection detail, claim status, entitlements
1claw platform connection <connection-id> --usage # Per-connection LLM inference spend (UTC month)
1claw platform connection <connection-id> --entitlements # On-chain entitlement evaluations
1claw platform template-preview <app-id> <template-id> \
--parameters '{"agent_name":"demo"}' # Dry-run template with {{params.*}} substitution
# Platform control plane (v0.58+)
1claw platform transfer-ownership <app-id> \
--target-org-id <uuid> # Transfer app to another org (step-up auth)
1claw platform connection-spend-policy <connection-id> # Effective spend policy (plt_ auth)
1claw platform connection-spend-policy-set <connection-id> \
--policy ./spend-policy.json # PUT spend policy (optional --idempotency-key)
1claw platform connection-approvals <connection-id> [--status pending]
1claw platform connection-approval-decide <connection-id> <approval-id> \
--decision approved # Mobile approval queue (plt_ auth)
1claw platform connection-pending-approvals <connection-id>
1claw platform connection-pending-approval-decide <connection-id> <approval-id> \
--decision approve --payload-hash <sha256> # Consensus pending approval vote
1claw platform connection-runtime-get <connection-id> <runtime-id>
1claw platform connection-passkey-enroll-begin <connection-id>
1claw platform connection-runtime-create <connection-id> --name my-rt --agent-id <uuid>
1claw platform connection-agent-chat <connection-id> <agent-id> \
--message "Hello" # Connection-scoped chat (402 on billing errors)
# Platform connection operations (v0.59.3–0.59.4)
1claw platform connection-signing-keys <connection-id> \
--agent-id <uuid> # List agent signing keys (public metadata)
1claw platform connection-signing-key <connection-id> ethereum \
--agent-id <uuid> # Single-chain address lookup
1claw platform connection-signing-key-deactivate <connection-id> ethereum \
--agent-id <uuid>
1claw platform connection-agent-patch <connection-id> <agent-id> \
--intents --system-prompt "You are a DeFi bot." # Enable Intents without re-bootstrap
# Connection portfolio, automations, memory, pending-approval create — use SDK or curl:
# GET .../portfolio, POST .../pending-approvals, GET/POST .../automations,
# GET/PUT/DELETE .../memory/{namespace}/{key}, POST /v1/shroud/inspect-content
Human-in-the-loop approval workflow for agent actions.
1claw approval list # List pending approval requests
1claw approval list --status approved # Filter by status
1claw approval get <id> # Get approval request details
1claw approval decide <id> approve # Approve a pending request
1claw approval decide <id> reject --reason "Not needed" # Reject with a reason
1claw approval decide <id> approve \
--reauth-token <token> # Risk tier 2+ needs a re-auth token (purpose approval.decide)
Manage registered mobile companion app devices.
1claw device list # List registered devices
1claw device revoke <device-id> # Revoke a device
Create, manage, and trigger automation workflows for agents.
1claw automation list # List all automations
1claw automation create my-automation \
--agent-id <uuid> \
--trigger cron \
--cron "*/15 * * * *" \
--workflow '{"steps":[{"type":"http","action":"execute_http","url":"https://api.example.com/check"}]}'
1claw automation get <id> # Get automation details
1claw automation update <id> --name new-name # Update automation
1claw automation trigger <id> # Manually trigger
1claw automation runs <id> # List recent runs
1claw automation get-run <id> <run-id> # Get details for a specific run
1claw automation delete <id> # Delete automation
Agent-scoped create (agent JWT only; simple manual/webhook workflows):
1claw agent automation create <agent-id> my-reminder \
--workflow '{"steps":[{"type":"log","message":"done"}]}' \
--api-key ocv_...
# Or: ONECLAW_AGENT_TOKEN=... 1claw agent automation create <agent-id> ...
workflow_spec is required on create (--workflow JSON or @file). For cron
triggers, --cron is required. Dashboard schedule is accepted by the API as
an alias for cron.
diff, apply)One YAML file describes vaults, agents, policies, connectors and execution-intent bindings; the server reconciles it (there is no client-side logic — the CLI parses YAML, posts it, and renders the answer).
1claw diff -f chart.yaml # what would change, read-only
1claw apply -f chart.yaml # create what is missing, in dependency order
apiVersion: 1claw/v1
kind: Chart
metadata: { name: inbox-swarm }
spec:
vaults: [{ name: inbox-vault }]
agents:
- name: inbox-triage
connectors: [{ preset: gmail }]
bindings:
- name: crm
binding_type: http
config: { base_url: https://crm.example.com }
guardrails: { allowed_hosts: [crm.example.com] } # required, non-empty
credential: { vault_ref: inbox-vault, path: crm/token } # a pointer, never a value
policies:
- { vault_ref: inbox-vault, principal_ref: agent:inbox-triage, paths: [integrations/**], permissions: [read] }
Per-resource results: created, patched (agent description/system_prompt
only), unchanged, skipped (drifted, or waiting on a vault/agent consensus
queued this run), refused (a change apply will not make in place — guardrails,
policy permissions, binding config), awaiting_approval, failed. A connector
install prints its sign-in URL; OAuth consent is the only human step. Apply writes
.1claw/apply-state.json so the next run can tell drift from a first apply. Nothing
is ever deleted.
Deploy and manage cloud runtime containers for agents.
1claw runtime list # List all runtimes
1claw runtime create my-runtime \
--agent-id <uuid> \
--template python \ # python, node, hermes, openclaw, openclaude, opencode, claude-code, codex, amp, binary
--preset small # small 0.5 vCPU/512 MB · medium 1 vCPU/2 GB · large · *-cc (TEE); Pro+ includes one small/medium free
1claw runtime create bot --agent-id <uuid> --template binary \
--env BINARY_URL=https://github.com/acme/bot/releases/download/v1/bot-linux-amd64 \
--env BINARY_SHA256=<sha256> # A compiled program, pinned
1claw runtime slug-check my-bot # Is {slug}.run.1claw.co available?
1claw runtime get <id> # Get runtime details + status
1claw runtime update <id> --idle-timeout 600 # Update idle timeout
1claw runtime start <id> # Start a stopped runtime
1claw runtime stop <id> # Stop a running runtime
1claw runtime logs <id> # Get recent logs
1claw runtime logs <id> --tail 100 # Last 100 lines
1claw runtime delete <id> # Delete runtime
1claw runtime slug-check my-agent # Check slug availability
Interactive shell (dashboard Terminal tab) uses
POST /v1/runtimes/{id}/shell/session with step-up auth (password, TOTP,
passkey, or reauth token). Enabling shell on a running runtime may require
stop/start, or the server auto-reconciles the sidecar on connect.
Store and retrieve agent memory (scratch, durable, semantic).
1claw memory put <agent-id> user-prefs '{"theme":"dark"}' -n context [--ttl 3600]
1claw memory get <agent-id> user-prefs -n context
1claw memory namespaces <agent-id> # List namespaces
1claw memory list <agent-id> -n context # List entries in a namespace
1claw memory delete <agent-id> user-prefs -n context
1claw memory search <agent-id> -n context -q "user preferences for dark mode" [--top-k 10]
Browse the public agent directory and manage agent discoverability.
1claw directory search # Browse all discoverable agents
1claw directory search --query "trading bot" # Search by keyword
1claw directory search --tags defi,solana # Filter by tags
1claw directory card <agent-id> # View an agent's public card
1claw config list # Show all config
1claw config get api-url # Get a value
1claw config set output-format json # Set default output
Store secrets locally in an encrypted vault — no cloud required. Secrets are encrypted at rest with AES-256-GCM using a passphrase-derived key (scrypt, N=2^17, r=8).
Files written before v0.59.10 used PBKDF2 at 100k iterations. They still open, and are rewritten with scrypt the next time the vault is saved — a vault in use upgrades itself. The change matters because this file sits on your disk and its whole security is the passphrase: 100k SHA-256 rounds is a few milliseconds on a GPU, while scrypt at these parameters costs ~128MB and a few hundred milliseconds per guess.
1claw local init # Create local vault with passphrase
1claw local add STRIPE_KEY # Add secret (prompted, masked)
1claw local list # List secret names (never values)
1claw local get STRIPE_KEY # Retrieve a value
1claw local rm STRIPE_KEY # Remove a secret
1claw local import .env # Import .env file into local vault
1claw local export -o .env # Export as .env format
1claw local sync -v <vault-id> # Push local secrets to cloud vault
1claw local sync --pull -v <id> # Pull cloud secrets into local vault
1claw local status # Show vault info (count, sync status)
1claw local destroy # Permanently delete local vault (prompts)
1claw local destroy --force # Delete without the confirm prompt
1claw local reset # Alias for destroy
Vault file: ~/.config/1claw/local-vault.enc (0600 permissions, safe to back up).
Forgot your passphrase? The vault is encrypted with a passphrase-derived key, so there is no recovery of the contents. To start over, run 1claw local destroy --force (no passphrase required — it also stops any running daemon holding the old vault), then 1claw local init.
browser)Let an agent log into a site without ever giving it the password. The agent drives the browser; the bridge types the secret.
# Hosted — pair a machine, define what may be typed where
1claw browser pair laptop --public-key "<bridge public key>"
1claw browser devices # revoked devices are listed, not hidden
1claw browser revoke <device-id> # what makes a leaked credential stop working
1claw browser binding create acme-login \
--vault <vault-id> --path acme/password \
--login-url https://app.acme.example/login \
--hosts app.acme.example # exact match; wildcards are refused
1claw browser binding list
1claw browser binding rm <binding-id>
# Local file — no 1Claw account needed
export ONECLAW_BRIDGE_VAULT_PASSPHRASE='…' # never a flag: argv shows up in ps
1claw browser vault init ~/.1claw/bridge.json
printf '%s' 'the-password' | 1claw browser vault add ~/.1claw/bridge.json \
--id acme --url https://app.acme.example/login --hosts app.acme.example
1claw browser vault list ~/.1claw/bridge.json # ids and rules, never a secret
# Run it
1claw browser start --vault ~/.1claw/bridge.json --chrome /path/to/chrome
This replaces 1claw-vault, which shipped with @1claw/browser-bridge. That
binary still works and prints a pointer; it goes in the next minor. It is the
same file and the same format — 1claw browser vault reads and writes through
the bridge's own implementation rather than a second copy.
The local-file subcommands need @1claw/browser-bridge installed (an optional
dependency) and no account. The hosted subcommands need an account and no
extra install.
The daemon serves secrets over a Unix socket and injects them into HTTP requests without exposing values to the AI model. This provides a trust boundary: the model knows which secret to use and where to send it, but never sees the raw value.
# Start the daemon (unlocks vault, listens on socket)
1claw daemon start
# Run the agent as its own Unix user: it can reach the daemon (mode 0660, this
# group) but not your ~/.config/1claw, where the CLI's cloud session token lives.
1claw daemon start --socket-group agents
# Manage per-secret policies (which hosts can receive each secret)
1claw daemon policy add STRIPE_KEY --hosts api.stripe.com --inject-as bearer
1claw daemon policy add OPENAI_KEY --hosts api.openai.com,*.openai.com --inject-as bearer
1claw daemon policy list
1claw daemon policy remove STRIPE_KEY
# Check daemon status
1claw daemon status
# Stop the daemon
1claw daemon stop
Configure AI clients to use the daemon instead of the cloud API:
1claw setup --local
This sets ONECLAW_LOCAL_VAULT=true and ONECLAW_DAEMON_SOCKET in the MCP config, so the MCP server connects to the local daemon instead of api.1claw.co. The model uses proxy_request to make API calls with secrets injected — the secret value never enters the model's context.
AI Client (Claude, Cursor, etc.)
└─ MCP Server (@1claw/mcp, local mode)
└─ Unix Socket (/~/.config/1claw/daemon.sock)
└─ 1claw Daemon (holds decrypted vault in memory)
├─ Policy Engine (per-secret host allowlist)
└─ Secret Proxy (injects credentials into HTTP requests)
init --docker)1claw init --docker provisions a secure agent runtime inside a Docker container in one command. The container ships with the 1Claw MCP server and a lightweight chat UI. Crucially, the container never receives the agent API key — the host daemon injects credentials over a read-only Unix-socket mount, preserving the same trust boundary as local daemon mode.
1claw init --docker # Basic secure agent (chat LLM via Shroud)
1claw init --docker --module=ampersend # With x402 payments
1claw init --docker --module=ampersend,onchain --port 8080
1claw init --docker --llm-provider anthropic --llm-model claude-3-5-haiku-latest
1claw init --docker --local # Fully offline — no cloud account, no LLM
1claw init --docker --list-modules # List available modules
When the cloud is reachable, init provisions an agent + vault + read policy and stores the agent key in your local vault (the daemon injects it toward *.1claw.co). With --local, nothing touches the cloud. The base image is built from bundled assets if it isn't already present, so the flow works offline.
In cloud mode (not --local), the embedded chat UI is wired to an LLM through Shroud — type a message and it routes via the host daemon, which injects the X-Shroud-Agent-Key header (the container never sees the key). Shroud inspects the prompt (redaction, PII, injection detection) and forwards to the provider.
--llm-provider (default openai) and --llm-model (default per provider, e.g. gpt-4o-mini).--local mode has no LLM (no cloud agent → no Shroud credential); only the /help, /secrets, /info, and /proxy slash commands work.Where does the provider key come from? Shroud resolves it in this order — pick whichever you prefer:
# Bill model usage to 1Claw (no provider key):
1claw init --docker # then enable LLM Token Billing
# Provider key stored in your 1Claw vault (Shroud auto-fetches):
1claw init --docker --llm-api-key sk-... # --llm-key-store cloud (default)
# Provider key stored in the local CLI vault (daemon injects, container never sees it):
1claw init --docker --llm-api-key sk-... --llm-key-store local
1claw init --docker --llm-api-key-secret openai-key # reuse an existing local secret
In every case the container never receives the provider key — it's resolved server-side by Shroud (cloud vault / token billing) or injected by the host daemon (local BYOK).
Every runtime is layered on the bundled base image 1claw/agent:stable:
1claw/agent:stable ← base image (bundled with the CLI)
├── node + the 1Claw MCP server (1claw-mcp)
├── chat UI (zero-dependency Node server on :3000)
├── entrypoint.sh ← decides how credentials are brokered
└── healthcheck.sh ← drives the container's health status
│
▼ (only when --module is used)
1claw-custom-<hash>:latest ← FROM 1claw/agent:stable + one RUN/COPY/ENV block per module
org.1claw.base-version label. When the CLI ships new base assets, init notices the stale label and rebuilds 1claw/agent:stable automatically.init --docker, cloud and --local) → the host daemon brokers every credential over the read-only socket mount; the key never enters the container.1claw deploy) → it requires ONECLAW_AGENT_API_KEY directly (from a Secret Manager mount)./app/modules/*/startup.sh, then launches the chat UI (the container's health anchor) in the foreground. Modules drop their startup.sh via a copy entry (see below).init sets ONECLAW_MODE, ONECLAW_DAEMON_SOCKET, ONECLAW_CONTAINER_MODULES, and (when an LLM is wired) the ONECLAW_SHROUD_* vars, and bind-mounts ~/.config/1claw/daemon.sock → /run/1claw/daemon.sock:ro.A module is a composable container extension declared by a module.yaml manifest. Each bundled module lives in its own directory inside the CLI (src/modules/<name>/) alongside any assets it copies in. When you pass --module=<name>, the CLI reads the manifest(s), resolves them into an ordered set, and generates a Dockerfile of the form FROM 1claw/agent:stable followed by one layer block per module.
Manifest schema (module.yaml):
Resolution rules (resolveModules): requested names are loaded, then depends are pulled in recursively; the full set is checked for mutual conflicts (hard error); finally the set is topologically sorted (dependencies precede dependents) with cycle detection. The ordered name@version list is hashed (FNV-1a) to name the custom image 1claw-custom-<hash>:latest, so identical module sets reuse the same reproducible image.
Bundled modules:
1claw init --docker --list-modules # Print the catalog
1claw init --docker --module=ampersend,onchain # Compose two (deps + order auto-resolved)
Modules are bundled with the CLI, so adding one means dropping a directory into src/modules/ (then rebuilding/publishing the CLI):
src/modules/my-tool/module.yaml:name: my-tool
version: 1.0.0
description: My custom agent capability.
author: you
docker:
apk: [ripgrep] # optional Alpine packages
packages: ["my-agent-sdk@latest"] # optional global npm installs
copy:
- src: startup.sh # files live next to module.yaml
dest: /app/modules/my-tool/startup.sh
env:
MY_TOOL_ENABLED: "true"
required_secrets:
- path: integrations/my-tool/api-key
description: API key for my-tool (injected by the daemon)
optional: true
depends: [] # e.g. [onchain] to require another module
conflicts: [] # e.g. [other-tool] to forbid combining
copy (e.g. a startup.sh) in the same directory. A startup.sh is executed once at container boot — use it for one-time setup; keep secrets out of it (resolve them through the daemon at runtime).1claw init --docker --module=my-tool. The CLI stages modules/my-tool/* into the build context and emits the RUN/COPY/ENV layers.Don't want to modify the CLI? Use 1claw eject to export the generated Dockerfile, the module asset tree, and a docker-compose.yaml (daemon socket pre-wired), then edit the Dockerfile freely and build/publish it yourself with 1claw publish --context ./out --tag <user>/<image>:tag. This is the supported path for fully custom images.
spawn)1claw spawn creates a framework-specific AI agent from a pre-built template. Each template ships a Dockerfile, starter code, and entrypoint pre-wired with 1Claw MCP and Shroud. After spawn, an interactive browser chat UI opens at http://localhost:<port> (default 3000) so you can send test messages immediately. The container follows the same daemon-socket security model as init --docker — the container never sees raw API keys.
1claw spawn langchain # LangChain agent with Shroud LLM routing
1claw spawn crewai --llm-api-key sk-... # CrewAI multi-agent crew with your API key
1claw spawn openai-agents --local # OpenAI Agents SDK, fully offline
1claw spawn --list # List all available templates
1claw spawn --refresh # Force-refresh templates from GitHub
When the health check passes, spawn prints the local URL and opens your browser to the shared chat UI. Framework logic runs on an internal port; the UI forwards POST /chat to your agent or falls back to Shroud through the host daemon /proxy.
Python:
TypeScript:
Templates support the same three LLM authentication methods as init --docker:
# BYOK — provider key stored in 1Claw vault (Shroud auto-fetches):
1claw spawn langchain --llm-api-key sk-...
# BYOK — provider key stored in local vault (daemon injects):
1claw spawn langchain --llm-api-key sk-... --llm-key-store local
# Token Billing — enable in Dashboard, no provider key needed:
1claw spawn langchain
# Anthropic WIF — OIDC federation (configure in Dashboard):
1claw spawn langchain --llm-provider anthropic
1claw spawn <name>) are complete project scaffolds — they include a Dockerfile, starter code (e.g. agent.py), and entrypoint. Use a template to bootstrap a new framework-specific agent.1claw init --docker --module=<name>) are composable Docker layers added on top of the base 1claw/agent:stable image. Use modules to add capabilities (payments, on-chain tools) to the base agent.You can combine both: spawn a template, then add modules with init --docker --module=... on the resulting container.
Templates live in the 1clawAI/agent-templates repository. To contribute a new template, see the CONTRIBUTING.md guide.
Each container's state lives at ~/.config/1claw/containers/{name}.json (mode 0600) and is the source of truth for info, start, restart, publish, eject, and deploy. It records the agent/vault IDs, modules, port, image, and a persisted run spec (image, env var names, mounts, labels — never secret values) so start/restart can recreate a container that was removed.
1claw containers list # List managed agent containers
1claw containers info <name> # Show details
1claw containers logs <name> # Tail logs
1claw containers start <name> # Start a stopped container (recreates if removed)
1claw containers restart <name> # Restart a container (recreates if removed)
1claw containers stop <name> # Stop a container
1claw containers rm <name> [--force] # Remove container + local state
1claw publish --name my-agent --tag <user>/my-agent:v1 # Rebuild + push
1claw publish --tag <user>/custom:latest # From ./Dockerfile
1claw publish --name my-agent --commit --tag <user>/m:c # Snapshot a running container
1claw eject --name my-agent --output ./out # Export Dockerfile + compose + module configs
1claw publish --name my-agent --tag <user>/my-agent:v1 # Image must be in a registry first
1claw deploy --google-cloud --name my-agent # Generate Terraform
1claw deploy --google-cloud --name my-agent --apply # Generate + apply (needs TF_VAR_agent_api_key)
In cloud mode the container uses the agent key directly (injected from Secret Manager), not the host daemon.
Some actions refuse a bearer token on its own and ask you to confirm your identity: editing agent guardrails, importing or exporting a signing key, treasury sends, card reveals. An agent must not be able to loosen its own limits, and a stolen token must not be enough to widen somebody else's.
Interactive — omit everything and you are prompted, without echo:
1claw agent update <agent-id> --tx-max-value 0.01
# Password (to change this agent's guardrails): ****
Scripted / CI — pipe it in:
printf %s "$ONECLAW_PASSWORD" | 1claw agent update <agent-id> \
--tx-max-value 0.01 --password-stdin
With no terminal and no --password-stdin, the command fails with a
message naming the flag. It will not hang on a prompt nobody can answer, and
it will not proceed without the credential.
Do not pass a password as a flag.
--password <value>still works onsigning-keys importandexport-signing-keyfor compatibility, and warns when used: an argv is readable by every user on the machine throughps, and your shell records it. Use--password-stdinor the prompt.
Only a human account can complete step-up; agent credentials cannot, by design.
--json # Force JSON output on any command
--api-url <url> # Override API URL for this invocation
--version # Print version
--help # Show help
Config is stored in ~/.config/1claw/config.json. Keys:
Enable DPoP (RFC 9449) to bind agent tokens to a persistent P-256 keypair. Stolen tokens are unusable without the matching private key.
export ONECLAW_DPOP=true
1claw agent token <id> # Token exchange includes DPoP proof + public JWK
When ONECLAW_DPOP=true is set, the CLI:
~/.config/1claw/dpop-key.json (mode 0600).POST /v1/auth/agent-token).DPoP proof JWT header to every API request.The keypair is reused across sessions. To rotate it, delete ~/.config/1claw/dpop-key.json — a new keypair is generated on the next request. Any tokens bound to the old key become invalid.
- name: Deploy with secrets
env:
ONECLAW_TOKEN: ${{ secrets.ONECLAW_TOKEN }}
ONECLAW_VAULT_ID: ${{ secrets.ONECLAW_VAULT_ID }}
run: |
npx @1claw/cli env pull -o .env.production
npm run deploy
RUN npm install -g @1claw/cli
CMD ["1claw", "env", "run", "--", "node", "server.js"]
#!/bin/bash
eval $(1claw env pull --format shell)
./my-app
CLI for 1Claw — secrets management for AI agents and humans
{ "mcpServers": { "1claw-cli": { "command": "npx", "args": [ "-y", "@1claw/[email protected]" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
@1claw/cli ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-10-26 CLI for 1Claw — secrets management for AI agents and humans