1claw-crewai-tools

CrewAI tools for 1Claw — HSM-backed secrets, multi-chain signing, encrypted memory, and automation workflows for AI agents.

11 tools that give CrewAI agents secure access to vault secrets, blockchain signing keys, persistent memory, and workflow automations — all guarded by policy-based access control. Private keys never leave the HSM.

Install

pip install 1claw-crewai-tools

PyPI package: 1claw-crewai-tools · Python import: oneclaw_crewai

Quick Start

All tools at once (recommended)

import os
from crewai import Agent, Crew, Process, Task
from oneclaw_crewai import OneclawClient, get_all_tools

client = OneclawClient(
    api_key=os.environ["ONECLAW_AGENT_API_KEY"],
    # agent_id and vault_id are auto-resolved from the API key
)

tools = get_all_tools(client)  # 11 tools

researcher = Agent(
    role="Blockchain Researcher",
    goal="Check wallet balances and sign transactions",
    backstory="You use 1Claw tools for all credential and signing operations.",
    tools=tools,
)

task = Task(
    description="Check the Ethereum balance, then sign the message 'hello world'.",
    expected_output="Balance and signature details.",
    agent=researcher,
)

crew = Crew(agents=[researcher], tasks=[task], process=Process.sequential)
crew.kickoff()

Single tool (backward-compatible)

from oneclaw_crewai import OneclawVaultTool

vault_tool = OneclawVaultTool(
    agent_id=os.environ["ONECLAW_AGENT_ID"],
    api_key=os.environ["ONECLAW_AGENT_API_KEY"],
    vault_id=os.environ["ONECLAW_VAULT_ID"],
)

agent = Agent(
    role="Engineer",
    goal="Build features using vault-stored API keys",
    backstory="You use tools instead of pasted secrets.",
    tools=[vault_tool],
)

Available Tools

Multi-Agent Crew Example

from crewai import Agent, Crew, Process, Task
from oneclaw_crewai import OneclawClient, get_all_tools

client = OneclawClient(api_key=os.environ["ONECLAW_AGENT_API_KEY"])
tools = get_all_tools(client)

# Agent 1: Manages secrets and credentials
secrets_agent = Agent(
    role="Secrets Manager",
    goal="Manage and rotate API credentials securely",
    backstory="You handle all credential lifecycle operations.",
    tools=tools,
)

# Agent 2: Handles blockchain operations
blockchain_agent = Agent(
    role="Blockchain Operator",
    goal="Execute blockchain transactions safely",
    backstory="You check balances and sign transactions using 1Claw.",
    tools=tools,
)

# Agent 3: Remembers context across sessions
memory_agent = Agent(
    role="Knowledge Manager",
    goal="Store and recall important information",
    backstory="You use encrypted memory for persistent knowledge.",
    tools=tools,
)

rotate_task = Task(
    description="Rotate the secret at 'api-keys/external-service'.",
    expected_output="Confirmation of rotation with new version number.",
    agent=secrets_agent,
)

balance_task = Task(
    description="Check the Ethereum signing key balance.",
    expected_output="Native balance in ETH.",
    agent=blockchain_agent,
)

remember_task = Task(
    description="Store today's rotation status in memory under key 'last-rotation'.",
    expected_output="Confirmation that the value was stored.",
    agent=memory_agent,
)

crew = Crew(
    agents=[secrets_agent, blockchain_agent, memory_agent],
    tasks=[rotate_task, balance_task, remember_task],
    process=Process.sequential,
)
crew.kickoff()

Authentication

The OneclawClient supports two auth patterns:

Key-only (recommended) — agent ID and vault ID auto-resolved:

client = OneclawClient(api_key="ocv_...")

Explicit IDs — for backward compatibility or multi-vault setups:

client = OneclawClient(
    api_key="ocv_...",
    agent_id="<agent-uuid>",
    vault_id="<vault-uuid>",
)

Testing

Unit tests (offline, no credentials needed)

python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest -v
ruff check src tests

All network calls are mocked with respx; no 1Claw account required.

Security

• Tool output can contain plaintext credentials. Never print() or log return values.
• All tools set cache_function to always return False — no framework-level caching.
• CrewAI's verbose=True prints tool output to stdout — use verbose=False in production.
• Private signing keys never leave the HSM — signing happens server-side.

Links

• 1Claw Documentation
• CrewAI Integration Guide
• Source Code

License

MIT — see LICENSE.