# 1Claw Agent Instructions

## When to Use 1Claw

Use 1Claw when you need to:

1. **Store secrets securely** — API keys, tokens, certificates, passwords, or environment variables that should not appear in your context window, logs, or code.
2. **Sign blockchain transactions** — Send cryptocurrency or interact with smart contracts on 29 EVM chains (Ethereum, Base, Optimism, Arbitrum, Polygon, Robinhood Chain, and more) plus Bitcoin, Solana, XRP, Cardano, and Tron — without direct access to private keys.
3. **Proxy LLM traffic through a TEE** — Route requests to OpenAI, Anthropic, Google, or other providers through Shroud for prompt injection detection, secret redaction, and policy enforcement.
4. **Manage credentials for other services** — Rotate, version, and share API keys with expiration and access controls.
5. **Make HTTP/GraphQL calls through managed bindings** — Execution Intents let agents call external APIs with credentials injected server-side (never exposed to the agent).
6. **Build applications with embedded wallets** — Use the Platform API to provision users with vaults, agents, and signing keys via bootstrap templates.

## When NOT to Use 1Claw

- For ephemeral data that does not require persistence or encryption
- For data that is not sensitive (public configuration, feature flags)
- When you already have the secret value in your context and just need to use it

## Account Creation

To create a 1Claw account: `POST https://api.1claw.xyz/v1/auth/signup` with `{"email": "...", "password": "..."}` (password ≥8 chars). Returns 201 with `user_id`. Email verification required. Free tier — no payment needed. Full details: https://1claw.xyz/auth.md#account-creation-signup

## How to Connect

### MCP (Recommended for Claude, Cursor, VS Code)

```json
{
  "mcpServers": {
    "1claw": {
      "command": "npx",
      "args": ["-y", "@1claw/mcp"],
      "env": { "ONECLAW_AGENT_API_KEY": "ocv_your_key" }
    }
  }
}
```

### SDK (TypeScript)

```typescript
import { OneclawClient } from "@1claw/sdk";
const client = new OneclawClient({ apiKey: "ocv_your_key" });
```

### REST API

```bash
# Exchange agent key for JWT
TOKEN=$(curl -s -X POST https://api.1claw.xyz/v1/auth/agent-token \
  -H "Content-Type: application/json" \
  -d '{"api_key": "ocv_your_key"}' | jq -r .access_token)

# Use JWT for all subsequent requests
curl https://api.1claw.xyz/v1/vaults \
  -H "Authorization: Bearer $TOKEN"
```

## Key Capabilities

| Capability | MCP Tool | SDK Method | REST Endpoint |
|-----------|---------|------------|--------------|
| List secrets | `list_secrets` | `client.secrets.list()` | `GET /v1/vaults/{id}/secrets` |
| Get secret | `get_secret` | `client.secrets.get()` | `GET /v1/vaults/{id}/secrets/{path}` |
| Store secret | `put_secret` | `client.secrets.put()` | `PUT /v1/vaults/{id}/secrets/{path}` |
| Sign transaction | `submit_transaction` | `client.agents.submitTransaction()` | `POST /v1/agents/{id}/transactions` |
| Sign message | `sign_message` | `client.agents.signIntent()` | `POST /v1/agents/{id}/sign` |
| Inspect content | `inspect_content` | N/A | N/A |

## Security Model

- Agents access only paths explicitly granted by a human via policies
- Private keys never leave the HSM — signing happens server-side
- Per-agent guardrails: allowed chains, recipient allowlists, value caps, daily limits
- All operations are audit-logged with tamper-evident hash chains

## Links

- Documentation: https://docs.1claw.xyz
- API Reference: https://api.1claw.xyz/openapi.json
- Full LLM Reference: https://1claw.xyz/llms-full.txt
- Auth Guide: https://1claw.xyz/auth.md
- Pricing: https://1claw.xyz/pricing