Allows generating keys, managing wallets, and signing transactions on the Bitcoin blockchain.
Allows generating keys, managing wallets, and signing transactions on the Cardano blockchain.
Allows generating keys, managing wallets, and signing transactions on the Dogecoin blockchain.
Allows generating keys, managing wallets, and signing transactions on the Litecoin blockchain.
Allows generating keys, managing wallets, and signing transactions on the Ripple blockchain.
Allows generating keys, managing wallets, and signing transactions on the Solana blockchain.
Allows generating keys, managing wallets, and signing transactions on the Sui blockchain.
Allows generating keys, managing wallets, and signing transactions on the TON blockchain.
Allows generating keys, managing wallets, and signing transactions on the Zcash blockchain.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@keygenix-mcp Sign an ETH transaction sending 0.01 ETH to 0xabc"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Keygenix MCP Server — Non-custodial TEE key management & signing for AI agents.
Private keys are generated, stored, and used exclusively inside a Trusted Execution Environment (TEE). They never leave in plaintext — not to you, not to Keygenix, not to the AI.
Register at keygenix.pro
Create an organization → note orgCode
Create a wallet → note walletCode
Generate two keypairs (run once):
# Use the CLI to generate keypairs (easiest)
git clone https://github.com/wallet-io/keygenix-skill
cd keygenix-skill/cli && npm install
node client.js keygen # → copy publicKey as API Auth Key
node client.js keygen # → copy publicKey as AuthKey (separate keypair)Register both public keys in the Keygenix dashboard.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"keygenix": {
"command": "node",
"args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
"env": {
"KEYGENIX_API_PRIV_KEY": "your-api-auth-private-key-hex",
"KEYGENIX_AUTH_PRIV_KEY": "your-authkey-private-key-hex",
"KEYGENIX_ORG_CODE": "your-org-code",
"KEYGENIX_WALLET_CODE": "your-wallet-code"
}
}
}
}Once published to npm, replace with
"command": "npx", "args": ["keygenix-mcp"]
Edit .cursor/mcp.json or .windsurf/mcp.json:
{
"mcpServers": {
"keygenix": {
"command": "node",
"args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
"env": {
"KEYGENIX_API_PRIV_KEY": "...",
"KEYGENIX_AUTH_PRIV_KEY": "...",
"KEYGENIX_ORG_CODE": "...",
"KEYGENIX_WALLET_CODE": "..."
}
}
}
}Add to your OpenClaw MCP config, or use the keygenix OpenClaw Skill directly.
Related MCP server: ows-mcp-wallet
Tool | Description |
| Generate a new secp256k1 keypair locally (no network) |
| List all keys in the wallet |
| Get details of a key by keyCode |
| Create a new key (mnemonic/private/secret) |
| Import existing key into TEE (ECIES encrypted) |
| List derived addresses for a key |
| Derive a new address for a chain |
| Sign a blockchain transaction (EVM/SOL/SUI/etc.) |
| Sign an arbitrary message |
EVM · Solana · Bitcoin · Litecoin · Dogecoin · Zcash · Tron · Ripple · Sui · TON · Cardano · Aptos · Cosmos · Sei
AI Agent
↓ calls MCP tool (no keys in prompt)
keygenix-mcp (local process)
↓ ECDSA-signed HTTPS requests
Keygenix TEE API
↓ private key never leaves enclave
Signed transaction returnedAPI Auth Private Key — signs every API request. Store in env, never hardcode.
AuthKey Private Key — authorizes sign/export. Signed locally; Keygenix only sees the public key.
Private keys — generated inside TEE, never exposed in plaintext.
git clone https://github.com/wallet-io/keygenix-mcp
cd keygenix-mcp
npm install
npm run build
npm startChannel | Command |
GitHub |
|
npm (coming soon) |
|
OpenClaw |
|
Smithery |
Website: keygenix.pro
API Docs: keygenix.pro/docs.html
Skill + CLI: wallet-io/keygenix-skill
Derive a new address from a key for a specific chain. Idempotent — returns the existing address if already derived for the same path.
Inputs: keyCode (required), addressType (required), path, curve, +1 more.
Create a new key in the TEE. Supports mnemonic (HD wallet), private key, or secret key types. curve is required for private (secp256k1 or ed25519) and secret (ed25519 only) key types.
Inputs: keyType (required), curve, chains.
Export a key from TEE. The key material is returned encrypted with your ephemeral public key (ECIES). Generates a local keypair, sends the public key to the server, receives encrypted key, decrypts locally.
Inputs: keyCode (required).
Get details of a specific key by keyCode.
Inputs: keyCode (required).
Get the derived public key for a key. For mnemonic keys, provide curve/path/deriveType. For private/secret keys, omit all deriving params.
Inputs: keyCode (required), path, curve, deriveType.
Import an existing key (mnemonic or private key) into Keygenix TEE. The key material is encrypted with ECIES before leaving the local machine — it is never transmitted in plaintext. Provide either 'mnemonic' (12/24 words) or 'privateKey' (hex), not both.
Inputs: keyType (required), curve, chains, mnemonic, +1 more.
Generate a new secp256k1 keypair locally (no network call). Use this to create API Auth keypairs or AuthKey keypairs before registering with Keygenix.
Inputs: no named parameters.
List all derived addresses for a key.
Inputs: keyCode (required), page, size.
List all keys in the wallet.
Inputs: name, page, size, keyCode, +1 more.
Sign an arbitrary message (hex-encoded sha256 hash) using a TEE-stored key. keyCode is always required. Optionally provide address to skip HD derivation.
Inputs: keyCode (required), message (required), path, chain, +1 more.
Sign a blockchain transaction using a TEE-stored key. Supports EVM (RLP hex), SOL (base58/base64/hex), SUI, and other chains. keyCode is always required. Optionally provide address to skip HD derivation.
Inputs: tx (required), keyCode (required), path, chain, +3 more.
Update a key's name or remark.
Inputs: keyCode (required), name, remark.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 12 tools
Most tools target a distinct action (import/export/sign/list/get/update), but a few boundaries require careful reading: keygen (local keypair generation) vs create_key (TEE-stored key), and export_key vs get_public_key both retrieve key material. The descriptions do clarify the distinction (local vs TEE, encrypted export vs derived public key), so misselection is unlikely but possible.
Nearly all tools follow a clean verb_noun snake_case pattern (export_key, import_key, create_address, sign_transaction, list_keys, get_key, update_key, create_key). The lone outlier is 'keygen', which drops the verb_noun convention and slightly breaks the pattern.
12 tools is well-scoped for a key management and signing server. Each tool covers a distinct lifecycle stage (generate, import, export, derive addresses, sign, CRUD) with no redundant filler.
Key lifecycle covers create, import, export, list, get, and update, plus address derivation and signing, but there is no delete_key or address removal operation, leaving a notable gap. Agents can create and manage keys but cannot clean up or revoke them.
Trusted execution infrastructure for AI agents. Proposal-only protocol with human consent.
Manage your blockchain infrastructure across 80+ chains with your agents.
Verified memory for AI agents. Signed assertions, billing attestation, session continuity.
Zero-key, non-custodial cross-chain crypto swap aggregator for AI agents: 100+ chains, 15+ providers
