1Claw is an HSM-backed secret management platform for AI agents. It provides a Vault API, MCP server, Shroud TEE proxy, and Intents API for multi-chain transaction signing.

What chains does 1Claw support for transaction signing?

1Claw supports Ethereum, Bitcoin, Solana, XRP (XRPL), Cardano, and Tron for multi-chain transaction signing via the Intents API.

How do AI agents authenticate with 1Claw?

Agents authenticate by exchanging an ocv_ API key for a short-lived JWT via POST /v1/auth/agent-token. The MCP server and SDK handle this automatically.

Is there a free tier?

Yes. The free tier includes 1,000 API requests/month, 3 vaults, 50 secrets, and 2 agents at no cost.

What are Cloud Runtimes?

Cloud Runtimes are managed containers for AI agents. Deploy your agent with secrets injected at runtime, Shroud LLM proxy built in, and optional public HTTP hosting via custom subdomains.

What presets are available?

Six presets: Small (0.5 vCPU, 512 MB), Medium (1 vCPU, 1 GB), Large (2 vCPU, 4 GB), and confidential compute variants (Small CC, Medium CC, Large CC) with AMD SEV-SNP enclaves for Pro+ tiers.

How are secrets injected?

Vault secrets are automatically injected as environment variables when the container starts. No credentials in code or config files — secrets are resolved from your 1Claw vault at runtime.

What is Confidential Compute?

Confidential Compute presets run on AMD SEV-SNP enclaves, ensuring keys and sensitive data never leave the Trusted Execution Environment. Available on Pro and higher tiers.

[ CLOUD RUNTIMES ]

Managed Cloud Containers for AI Agents

Deploy your agent in a secure, managed container with secrets injected at runtime, Shroud protection built in, and public HTTP hosting via custom subdomains.

Deploy your first runtimeRead the docs

[ 01 ] KEY FEATURES

Everything your agent needs to run

From secret injection to confidential compute — deploy production-ready agents without managing infrastructure.

One-Click Deploy

Choose a preset (Small to Large), pick your Docker image, and deploy. No Kubernetes to manage.

Secret Injection

Vault secrets automatically injected as environment variables. No credentials in code or config files.

Shroud Built In

Every runtime includes the Shroud sidecar for LLM traffic inspection and secret redaction.

Public HTTP Hosting

Expose your agent via {slug}.run.1claw.xyz with configurable auth (API key, JWT, or public).

Confidential Compute

Pro+ tiers get AMD SEV-SNP enclaves. Keys never leave the TEE.

Web Terminal

Debug your running container from the dashboard. Routed through the sidecar for security.

Auto-Idle

Containers auto-stop after configurable idle time to save costs.

[ 02 ] PRESETS

Pick a size, deploy in seconds

Six presets from lightweight dev containers to confidential-compute enclaves. Scale up anytime without redeploying.

Small

0.5 vCPU

1 GB

$15/mo

Medium

1 vCPU

2 GB

$39/mo

Large

2 vCPU

4 GB

$99/mo

SEV-SNP

Small CC

0.5 vCPU

1 GB

$35/mo

SEV-SNP

Medium CC

1 vCPU

2 GB

$75/mo

SEV-SNP

Large CC

2 vCPU

4 GB

$149/mo

[ 03 ] HOW IT WORKS

From zero to running in four steps

No Dockerfiles to write (bring your own image), no infrastructure to manage. We handle orchestration, secrets, networking, and security.

deploy flow

Create runtime

Choose a preset, Docker image, and the agent to bind.

Secrets injected

Secrets from your vault are injected as environment variables automatically.

Shroud sidecar

The Shroud sidecar intercepts LLM traffic for inspection and redaction.

Expose or keep private

Expose via a public subdomain ({slug}.run.1claw.xyz) or keep it internal.

6presets

Sub-minutedeploys

AMD SEV-SNPenclaves

[ 04 ] GET STARTED

Deploy your first runtime today

Start on the free tier with one runtime and 10 hours per month. Upgrade for more runtimes, higher resources, and confidential compute.

Free tier included
No Kubernetes required
Secrets auto-injected
Shroud sidecar included
Confidential compute
Public HTTP hosting

Deploy your first runtimeRead the docs