ClawVault Agent Skill

You have access to ClawVault, a security middleware for AI agents. ClawVault protects TWO spending channels:

1. 1. Crypto payments - USDC transfers on Base and Solana blockchains
2. Agent Card - Virtual Visa card for any merchant worldwide (SaaS, APIs, cloud, etc.)

Both channels use the same rules engine. Every transaction is validated against user-defined rules. Transactions within rules auto-approve; transactions outside rules require human approval via Telegram or dashboard.

Security Model

• - Non-custodial: Your keys never leave your wallet
• Rule-enforced: Spending limits, whitelists, time windows enforced on-chain
• Human-in-the-loop: Anything outside rules requires explicit approval
• Audit trail: All transactions logged and visible in dashboard

API Base URL

Authentication

Get your API key at: https://clawvault.cc/agents

CRYPTO PAYMENTS (On-Chain)

1. Request a Crypto Payment

When you need to send USDC to a blockchain address:

CODEBLOCK2

Response (Success)

Possible Statuses

• - auto_approved - Payment executed immediately (within rules)
• INLINECODE1 - Awaiting human approval via Telegram/dashboard
• INLINECODE2 - Payment was rejected
• INLINECODE3 - Approval window closed (5 minutes)

2. Check Before Sending (Dry Run)

Before making a payment, check if it will auto-approve or need manual approval:

CODEBLOCK4

Response

If autoApprove: false, tell the user the payment needs their approval.

3. Get Vault Status

Check your vault balance and current limits:

CODEBLOCK6

Response

{
  "success": true,
  "data": {
    "chain": "base",
    "balances": [{ "token": "USDC", "balance": "150.00" }],
    "rules": {
      "mode": "manual",
      "perTxLimit": 500,
      "dailyTxMax": 20
    }
  }
}

AGENT CARD (Visa Card)

Use the Agent Card when you need to pay for:

• - SaaS subscriptions (Vercel, Netlify, etc.)
• API services (OpenAI, Anthropic, Twilio, etc.)
• Cloud compute (AWS, GCP, Azure)
• Any merchant that accepts Visa

4. Request a Card Purchase

CODEBLOCK8

Response (Approved)

Response (Needs Approval)

IMPORTANT: Card credentials are temporary and single-use. Use them immediately at the merchant checkout. Never log or store card credentials.

5. Check Card Balance

CODEBLOCK11

Response

{
  "success": true,
  "data": {
    "balance": 450.00,
    "currency": "USD",
    "spent_today": 50.00,
    "spent_this_month": 350.00,
    "daily_limit": 500.00,
    "monthly_limit": 5000.00
  }
}

6. Check Card Rules

Before making a purchase, check if it's allowed:

CODEBLOCK13

Response

{
  "success": true,
  "data": {
    "allowed": true,
    "autoApprove": true,
    "reason": "Within limits, allowed category"
  }
}

COMMON ENDPOINTS

7. Check Payment/Purchase Status

CODEBLOCK15

8. List Recent Transactions

CODEBLOCK16

DECIDING: CRYPTO vs CARD

Use this logic to decide which channel to use:

Rule of thumb: If it's a blockchain address, use crypto. If it's a company/service, use the card.

HUMAN APPROVAL FLOW

When a transaction requires approval:

1. 1. User is notified via Telegram bot or ClawVault dashboard
2. User reviews the transaction details (amount, recipient, reason)
3. User approves or denies with one tap
4. Transaction executes if approved, or is cancelled if denied
5. Approval expires after 5 minutes if no action taken

Always inform the user when approval is required: "This transaction needs your approval. Check your Telegram or ClawVault dashboard."

COMMON SCENARIOS

Scenario: User asks to pay for OpenAI API credits

1. 1. Call /v1/card/check to verify it's allowed
2. If allowed, call /v1/card/purchase with merchant="OpenAI API"
3. If status: "approved", use the card credentials at checkout immediately
4. If status: "pending_approval", tell user: "This purchase needs your approval. Check Telegram or ClawVault dashboard."

Scenario: User asks to send USDC to an address

1. 1. Call /v1/rules/check to see if it will auto-approve
2. Call /v1/payments with the recipient address
3. If status: "pending", tell user to approve in Telegram

Scenario: Card purchase denied

Scenario: Insufficient card balance

ERROR HANDLING

Common Errors

Code	Meaning	Action
INLINECODE19	Bad API key	Check your API key
INLINECODE20

Monthly limit reached | User needs to upgrade |

Error Response Format

{
  "success": false,
  "error": {
    "code": "RULE_VIOLATION",
    "message": "Exceeds per-transaction limit of $100"
  }
}

SECURITY BEST PRACTICES

1. 1. Never log card credentials - Card numbers, CVCs are sensitive
2. Always check first - Use /v1/rules/check or /v1/card/check before transactions
3. Explain to users - If approval is needed, tell them where to approve
4. Handle pending - Don't assume transactions complete immediately
5. Use card credentials immediately - They expire in 5 minutes
6. Show transaction links - For crypto, link to INLINECODE29

SUPPORT

• - Dashboard: https://clawvault.cc
• Docs: https://clawvault.cc/docs
• API Status: https://api.clawvault.cc/health
• Source: https://github.com/andrewszk/clawvault-mcp-server