Identity, a credential vault, and an audit layer for every AI agent in the Claw ecosystem. Ed25519 keys, AES-256 encryption, and immutable logs. Works everywhere MCP does.
clawlock register_agent --name billing-bot # issuing Ed25519 keypair... ✓ agent_id ag_7f3c91 scopes: read:vault clawlock store_credential ag_7f3c91 stripe sk_live_*** ✓ sealed in AES-256-GCM vault cred_a18d clawlock use_credential ag_7f3c91 cred_a18d ✓ decrypted on the fly logged to audit ledger # scope verified · least-privilege · tamper-evident
Six controls that turn a swarm of anonymous agents with shared human keys into scoped, verifiable, fully audited workers.
Ed25519 cryptographic keypairs. Every agent gets its own verifiable identity, so you retire shared human credentials for good.
AES-256-GCM encrypted storage. API keys are never kept in plain text or env vars, and access is scoped per agent.
An immutable log of every access, scope check, and action. Filterable, paginated, tamper-evident.
Least-privilege controls. Deny by default, with explicit grants only.
Credentials rotate on schedule. No stale tokens left in config files.
Works across any MCP runtime: Claude Desktop, OpenClaw, and the whole Claw family.
Drop it into your claude_desktop_config.json and your first agent has a sealed identity before your coffee is cold.
# install git clone https://github.com/PalmCoast/clawlock-mcp-server.git cd clawlock-mcp-server npm install && npm run build # add to Claude Desktop config "mcpServers": { "clawlock": { "command": "node", "args": ["./dist/index.js"] } } # register, then store a credential clawlock_register_agent(name: "my-agent", scopes: ["read:vault", "write:vault"]) clawlock_store_credential(agent_id: "ag_xxx", service: "openai", key: "sk-...")
Every tier is a flat monthly rate with real cryptographic identity behind it. No per-seat games.
218,000 agents are running with borrowed human keys. Give yours a real identity in the next 60 seconds.