Get Started with 1Claw in One Command

We shipped a shorter path from signup to a working MCP connection. You used to create a vault, register an agent, write a policy, paste JSON into Cursor, and hope you did not miss a step. Now you can do the whole thing in one terminal command, or click through a three-step wizard in the dashboard. This post walks through both, with the exact prompts and configs we use internally.

What you get at the end

Whether you use the CLI or the dashboard, the outcome is the same:

• A vault named default (if you did not already have one)
• A sample secret at examples/hello so you can verify access without putting a real API key in yet
• An agent with a one-time ocv_ API key and a policy that allows read/write on ** inside that vault
• MCP config for stdio mode: npx @1claw/mcp plus ONECLAW_AGENT_API_KEY

Save the agent key when it is shown. We do not display it again.

Fastest path: one CLI command

If you have Node 20+ installed, run this from any directory:

npx @1claw/cli setup

Or install globally first:

brew install 1clawAI/tap/1claw
# or: npm install -g @1claw/cli

1claw setup

The command opens a browser login at 1claw.xyz/cli/verify (device flow, no password typed into the terminal). Then it asks for an agent name (default mcp-agent), calls POST /v1/onboarding/provision, and writes MCP settings for every AI client it detects (Cursor, Claude Desktop, VS Code, Windsurf, and others).

Target one client only:

1claw setup --client cursor

Project-level config instead of global:

1claw setup --client cursor --project

Dashboard path: connect wizard

Prefer clicking? Sign up at 1claw.xyz/login. After your first login you should land on Connect your agent. Three steps:

1. Pick your client (Cursor, Claude Code, Claude Desktop, Windsurf, or Other).
2. Either copy the npx @1claw/cli setup command, or click Generate MCP config in dashboard to provision from the browser and copy the JSON block.
3. Restart your IDE, then ask your assistant to list secrets. The wizard waits until it sees a successful connection.

The JSON the dashboard gives you looks like this (with your real key filled in):

{
  "mcpServers": {
    "1claw": {
      "command": "npx",
      "args": ["-y", "@1claw/mcp"],
      "env": {
        "ONECLAW_AGENT_API_KEY": "ocv_...",
        "ONECLAW_BASE_URL": "https://api.1claw.xyz"
      }
    }
  }
}

Paste that into your client's MCP settings file. Cursor uses ~/.cursor/mcp.json for global config, or .cursor/mcp.json in a project. Claude Desktop uses its own config path; the wizard labels match what 1claw setup writes automatically.

Verify it worked

Open a fresh chat in Cursor or Claude and ask:

List my secrets in 1Claw

You should see examples/hello. That confirms the agent key, JWT exchange, vault binding, and policy are all wired correctly. If nothing shows up, restart the client so it picks up the new MCP config, and check that the ocv_ key is still in the env block (not a placeholder).

Store your real secrets next

Replace the sample with something you actually need:

1claw vault list
# copy the default vault ID, then:
1claw secret set api-keys/openai sk-... -v <vault-id>

# or import a whole .env file:
1claw import .env --prefix api-keys/ -v <vault-id>

You can also use the dashboard vault UI. Policies already allow this agent to read and write paths under the default vault. When you want tighter scope, create a new policy with a narrower glob (for example api-keys/* only) and remove the broad ** rule.

What changed under the hood

We added two API endpoints for humans: GET /v1/org/onboarding/status and POST /v1/onboarding/provision. New accounts also get a welcome bundle in the background on signup (vault + sample secret). The CLI and dashboard both call provision so you do not have to stitch vault, agent, and policy creation yourself.

MCP still runs locally over stdio. Your API key stays in the MCP process environment, not in the model's context window. The server exchanges it for a short-lived JWT and auto-discovers the default vault. You do not need to set ONECLAW_VAULT_ID unless you have multiple vaults and want to pin one.

Where to go from here

• Cursor-specific tips if you hit MCP cache or restart issues
• Full quickstart for human vs agent flows, Shroud, and signing
• Shroud when you want LLM traffic inspected in a TEE before it hits OpenAI or Anthropic

Create a free account · Open the connect wizard · CLI reference