Self-Hosted • Prompt Injection Immune • Zero Vendor Lock-In
Your AI agents need API keys, OAuth tokens, and wallet keys.
Hardcoding them = one prompt injection away from disaster.
Clavis stores credentials server-side and injects them at runtime.
Your agents never see the secrets.
Manage credentials via natural language in Claude Desktop. No code required.
npm install -g @clavisagent/mcp-server{
"mcpServers": {
"clavis": {
"command": "npx",
"args": ["-y", "@clavisagent/mcp-server"],
"env": {
"CLAVIS_API_KEY": "eyJ...",
"CLAVIS_API_URL": "https://clavisagent.com"
}
}
}
}Security
Credentials in agent memory are one malicious prompt away from exfiltration. Clavis prevents it architecturally.
One leaked wallet key = funds stolen. Clavis keeps signing keys out of agent memory entirely.
One leaked API key = SOC 2 violation. Audit logs on every credential access, server-side.
One leaked token = account compromise. Stop pasting secrets into prompts or environment files.
Clavis prevents credential exfiltration architecturally — not by policy.
You're stitching together LLMs, tool APIs, credential management, and token refresh logic— all custom glue code that breaks in production. Every agent project starts from scratch.
No routing logic, no refresh code, no manual retry handling. Register credentials once, get valid tokens everywhere.
Every auth event, token refresh, and proxy request is logged with timestamps. Debug production failures without guessing.
Self-hosted option available for Enterprise. Your credentials never leave your environment—no vendor lock-in, no hosted mystery boxes.
Clavis is a batteries-included auth SDK you control and deploy yourself—ship production agents without writing glue code.
Create your free Clavis account in 60 seconds. No credit card required.
POST your OpenAI, Kalshi, or Coinbase keys once. They're encrypted and never stored in plaintext.
get_token()Every agent call is one line. Clavis handles refresh, retries, rate limits, and logging—forever.
# Setup (once) from clavis import ClavisClient client = ClavisClient(api_key="your-clavis-key") # Get a valid token for any service # Clavis handles encryption, refresh, caching, and retries token = await client.get_token("my-openai") # Or proxy the entire request # Auth injected, rate limits tracked automatically response = await client.proxy( "my-openai", "POST", "/v1/chat/completions", body={"model": "gpt-4o", "messages": messages} )
All credentials encrypted with AES-128-CBC + HMAC-SHA256 (Fernet). Decrypted only in memory at token-refresh time. Your keys never appear in logs.
Tokens refreshed proactively 5 minutes before expiry. Three retries with exponential backoff before alerting.
Sliding window algorithm tracks requests across all your agents. Warning headers fire before you hit a 429.
When rate limits are reached, requests queue automatically and resume when the window resets.
Every auth event, token refresh, and proxy request logged with timestamps. Debug without guessing.
7 built-in connectors: OpenAI, Anthropic, GitHub, Stripe, Brave Search, Kalshi, Coinbase. Plus generic API key and OAuth2.
Works as both API and MCP server. Use Clavis directly in Claude Desktop with natural language commands.
Check credential health without burning API quota. Validate tokens, check rate limits, and see expiration dates—all without making external calls.
Start with a free 14-day Builder trial. No credit card required.
For side projects and light experimentation.
For developers building production agents.
For teams running high-volume agent fleets.
For organizations that need scale and control.
One API key. Every service. Handled.
pip install clavis
Free tier · No credit card · Full docs included