Agentic Vault

English | 繁體中文 | 简体中文 | 日本語 | 한국어

Server-side EVM signing with AWS KMS and built-in DeFi protocol awareness. Expose your wallet to AI agents via MCP, CLI, or OpenClaw with deny-by-default policy enforcement and full audit logging.

Why Agentic Vault

AI agents need to sign blockchain transactions, but giving them private keys is dangerous. Agentic Vault solves this by keeping keys in AWS KMS (HSM) and providing a policy engine that constrains what agents can sign. The agent sees high-level tools (sign_swap, sign_permit); the private key never leaves the hardware.

Related MCP server: waiaas

Features

• HSM-backed signing -- private keys never leave AWS KMS; only digests are sent for signing

• DeFi protocol awareness -- calldata decoding for ERC-20, Uniswap V3, and Aave V3 with protocol-specific policy rules

• Deny-by-default policy engine -- chain, contract, selector, amount, deadline, and protocol-level constraints

• Multiple interfaces -- use as a TypeScript library, CLI, MCP server, or OpenClaw plugin

• Audit logging -- structured JSON audit trail for every signing operation (approved, denied, errored)

• EVM-native -- built on viem with full EIP-712 typed data support

Quick Start

Requires Node.js 22+.

npm install @agenticvault/agentic-vault

import { createSigningProvider, EvmSignerAdapter } from '@agenticvault/agentic-vault';

const provider = createSigningProvider({
  provider: 'aws-kms',
  keyId: 'arn:aws:kms:us-east-1:123456789:key/your-key-id',
  region: 'us-east-1',
});

const signer = new EvmSignerAdapter(provider);
const address = await signer.getAddress();

For a no-AWS quick test, use dry-run mode (decode + policy check without signing):

npx agentic-vault dry-run --chain-id 1 --to 0xa0b869... --data 0x095ea7b3...

See AWS KMS Setup for key creation and IAM policy.

Interfaces

See Interfaces Guide for usage examples and configuration.

Supported Protocols

Unknown calldata is rejected by default (fail-closed). The dispatcher uses 2-stage resolution: contract address first, then selector-based fallback (e.g., ERC-20). Raw signing tools (sign_transaction, sign_typed_data) bypass protocol decoding and are disabled unless --unsafe-raw-sign is explicitly enabled.

Configuration

The policy engine uses a JSON configuration file. Without a policy file, all policy-guarded signing operations are denied (deny-by-default).

See Policy Reference for the full schema and examples, or start with policy.example.json.

Security Model

Trust Boundary

 AI Agent (Claude / MCP Client / OpenClaw)
          |
          | MCP Protocol / OpenClaw Plugin API
          v
 +------------------------------------+
 |   Agentic Vault                    |
 |  +-----------+ +--------+ +-----+ |
 |  | Protocol  | | Policy | | Audit| |
 |  | Dispatcher| | Engine | | Sink | |
 |  +-----------+ +--------+ +-----+ |
 |          |                         |
 |  +--------------------+           |
 |  | EvmSignerAdapter   |           |
 |  +--------------------+           |
 +-----------|------------------------+
             | digest only
             v
 +------------------------------------+
 |       AWS KMS (HSM)                |
 |   Private key never leaves         |
 +------------------------------------+

Key Principles

Claude Code Plugin

4 skills interact with the wallet through MCP tools only -- they never access keys directly.

Package Exports

Documentation

Roadmap

• Additional signing providers (GCP KMS, HashiCorp Vault)

• More protocol decoders (Curve, Compound V3)

• Multi-signature support

• Remote MCP server mode (HTTP transport with OAuth 2.1)

Contributing

See CONTRIBUTING.md for development workflow, branch naming, and commit conventions.

This project follows the Contributor Covenant Code of Conduct.

License

MIT