1Claw Vault for VS Code

io.github.1clawai/1claw-mcp

HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.

client:VS Code transport:stdio runtime:npm

Install 1Claw Vault in VS Code

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "oneclaw-agent-api-key",
      "description": "ONECLAW_AGENT_API_KEY",
      "password": true
    },
    {
      "type": "promptString",
      "id": "oneclaw-agent-id",
      "description": "ONECLAW_AGENT_ID",
      "password": true
    },
    {
      "type": "promptString",
      "id": "oneclaw-vault-id",
      "description": "ONECLAW_VAULT_ID",
      "password": true
    },
    {
      "type": "promptString",
      "id": "oneclaw-base-url",
      "description": "ONECLAW_BASE_URL",
      "password": true
    },
    {
      "type": "promptString",
      "id": "oneclaw-local-only",
      "description": "ONECLAW_LOCAL_ONLY",
      "password": true
    }
  ],
  "servers": {
    "1claw-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@1claw/mcp"
      ],
      "env": {
        "ONECLAW_AGENT_API_KEY": "${input:oneclaw-agent-api-key}",
        "ONECLAW_AGENT_ID": "${input:oneclaw-agent-id}",
        "ONECLAW_VAULT_ID": "${input:oneclaw-vault-id}",
        "ONECLAW_BASE_URL": "${input:oneclaw-base-url}",
        "ONECLAW_LOCAL_ONLY": "${input:oneclaw-local-only}"
      }
    }
  }
}

VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs

1Claw Vault in other clients

1Claw Vault MCP server