Skip to content

docs: add 1Claw Tools integration #6976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
redbotster wants to merge 1 commit into
base: main
Choose a base branch
from
+65 −1
Open

docs: add 1Claw Tools integration #6976

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,7 +308,8 @@
"edge/en/tools/integration/overview",
"edge/en/tools/integration/bedrockinvokeagenttool",
"edge/en/tools/integration/crewaiautomationtool",
"edge/en/tools/integration/mergeagenthandlertool"
"edge/en/tools/integration/mergeagenthandlertool",
"edge/en/tools/integration/1clawtool"
]
},
{
Expand Down
59 changes: 59 additions & 0 deletions docs/edge/en/tools/integration/1clawtool.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
---
title: 1Claw Tools
description: Give CrewAI agents secure, policy-scoped access to secrets, signing, and encrypted memory through 1Claw's HSM-backed vault
icon: shield-halved
mode: "wide"
---

# `1claw-crewai-tools`

CrewAI agents need credentials and signing keys, but crew configs and shared `.env` files are not a safe place to store them. Hard-coded API keys end up in git, and shared env files break when you spin up parallel agents with different permissions.

[`1claw-crewai-tools`](https://pypi.org/project/1claw-crewai-tools/) wraps the [1Claw](https://1claw.xyz) API as CrewAI-compatible tools. Each tool fetches secrets at runtime, signs transactions server-side, and writes to encrypted agent memory. Access is policy-scoped, so an agent only sees the vault paths a human explicitly granted, and secrets are never persisted in the model's context window.

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python - <<'PY'
import io
import json
import urllib.request
import zipfile

metadata = json.load(
    urllib.request.urlopen("https://pypi.org/pypi/1claw-crewai-tools/json")
)
wheel_url = next(
    item["url"]
    for item in metadata["urls"]
    if item["packagetype"] == "bdist_wheel"
)
wheel = urllib.request.urlopen(wheel_url).read()

with zipfile.ZipFile(io.BytesIO(wheel)) as archive:
    source = archive.read("oneclaw_crewai/_tool.py").decode()

assert "return self._client.get_secret(path)" in source
assert "plaintext credentials" in metadata["info"]["description"]

print(f"Verified published version: {metadata['info']['version']}")
print("The vault tool returns decrypted values as tool output.")
PY

Repository: crewAIInc/crewAI

Length of output: 2783

🏁 Script executed:

set -euo pipefail

file=$(fd -i '1clawtool\.mdx$' docs/edge/en docs/edge/ar docs/edge/ko docs/edge/pt-BR | head -n 1)
printf '%s\n' "English and translation candidates:"
fd -i '1clawtool\.mdx$' docs/edge/en docs/edge/ar docs/edge/ko docs/edge/pt-BR || true

printf '\nEnglish page:\n'
cat -n "$file"

printf '\nRelated 1Claw references:\n'
rg -n -i '1claw|OneclawVaultTool|verbose|memory|sign' docs/edge/en docs/edge/ar docs/edge/ko docs/edge/pt-BR 2>/dev/null | head -n 200 || true

printf '\nPublished source and metadata (read-only):\n'
curl -k -L --fail --silent --show-error https://raw.githubusercontent.com/1ClawAI/1claw-crewai-tools/main/src/oneclaw_crewai/_tool.py | nl -ba | sed -n '1,240p'
curl -k -L --fail --silent --show-error https://pypi.org/pypi/1claw-crewai-tools/json |
  python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["info"]["version"]); print(d["info"].get("description","")[:12000])' |
  rg -n -i 'plaintext|verbose|secret|memory|sign|automation' || true

Repository: crewAIInc/crewAI

Length of output: 22257

🏁 Script executed:

set -euo pipefail

printf '%s\n' '1Claw source:'
curl --insecure -L --fail --silent --show-error \
  https://raw.githubusercontent.com/1ClawAI/1claw-crewai-tools/main/src/oneclaw_crewai/_tool.py |
  sed -n '1,280p'

printf '\nPyPI metadata fields relevant to secret handling:\n'
python3 - <<'PY'
import json
import ssl
import urllib.request

ctx = ssl._create_unverified_context()
with urllib.request.urlopen(
    "https://pypi.org/pypi/1claw-crewai-tools/json", context=ctx
) as response:
    metadata = json.load(response)

print("version:", metadata["info"]["version"])
description = metadata["info"].get("description", "")
for index, line in enumerate(description.splitlines(), 1):
    if any(term in line.lower() for term in ("plaintext", "verbose", "secret", "memory", "sign")):
        print(f"{index}: {line}")

print("\nwheel contents and vault implementation:")
wheel_url = next(
    item["url"] for item in metadata["urls"] if item["packagetype"] == "bdist_wheel"
)
with urllib.request.urlopen(wheel_url, context=ctx) as response:
    wheel = response.read()

import io
import zipfile
with zipfile.ZipFile(io.BytesIO(wheel)) as archive:
    names = archive.namelist()
    print("tool modules:", [name for name in names if name.startswith("oneclaw_crewai/") and name.endswith(".py")])
    source = archive.read("oneclaw_crewai/_tool.py").decode()
    for index, line in enumerate(source.splitlines(), 1):
        if any(term in line.lower() for term in ("class oneclawvaulttool", "def _run", "verbose", "get_secret", "plaintext")):
            print(f"{index}: {line}")
PY

printf '\n1Claw translations:\n'
for locale in ar ko pt-BR; do
  find "docs/edge/$locale" -type f -iname '1clawtool.mdx' -print 2>/dev/null || true
done

Repository: crewAIInc/crewAI

Length of output: 13670

Rewrite the toolkit and secret-handling claims.

get_all_tools() provides separate vault, memory, signing, and automation tools. OneclawVaultTool._run() returns decrypted values as tool output. Warn users not to log tool output and to set verbose=False in production. Remove guarantees that secrets never enter model context or are never persisted unless the integration enforces them. State only supported guarantees, such as private signing keys remaining in the HSM.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/edge/en/tools/integration/1clawtool.mdx` at line 12, Rewrite the
documentation paragraph to accurately describe get_all_tools() and its separate
vault, memory, signing, and automation tools. Note that OneclawVaultTool._run()
returns decrypted values as tool output, warn users not to log tool output and
to set verbose=False in production, and remove unsupported claims about secrets
never entering model context or being persisted; retain only enforced guarantees
such as private signing keys remaining in the HSM.


## Installation

```bash
pip install 1claw-crewai-tools
```

## Setup

Set your agent's API key. The agent and vault IDs are auto-resolved from it:

```bash
export ONECLAW_AGENT_API_KEY="ocv_your_agent_key"
```

## Usage

Load all tools (vault, memory, signing, automations) at once:

```python
import os
from crewai import Agent, Crew, Process, Task
from oneclaw_crewai import OneclawClient, get_all_tools

client = OneclawClient(api_key=os.environ["ONECLAW_AGENT_API_KEY"])
tools = get_all_tools(client) # 11 tools

researcher = Agent(
role="Blockchain Researcher",
goal="Check wallet balances and sign transactions",
backstory="You use 1Claw tools for all credential and signing operations.",
tools=tools,
)
```

Or import a single tool:

```python
from oneclaw_crewai import OneclawVaultTool
```

## Notes

- Secrets are fetched just-in-time and never written into crew configs, `.env` files, or the model context.
- Access is policy-scoped and audited per call; grants are revocable without rotating keys.
- Tools cover vault secrets, encrypted memory, multi-chain signing, and workflow automations.
- Requires a [1Claw](https://1claw.xyz) account and an agent API key.
4 changes: 4 additions & 0 deletions docs/edge/en/tools/integration/overview.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,10 @@ Integration tools let your agents hand off work to other automation platforms an
<Card title="Bedrock Invoke Agent Tool" icon="aws" href="/en/tools/integration/bedrockinvokeagenttool">
Call Amazon Bedrock Agents from your crews, reuse AWS guardrails, and stream responses back into the workflow.
</Card>

<Card title="1Claw Tools" icon="shield-halved" href="/en/tools/integration/1clawtool">
Give agents secure, policy-scoped access to secrets, signing, and encrypted memory via 1Claw's HSM-backed vault.
</Card>
</CardGroup>

## **Common Use Cases**
Expand Down