Hermes Agent — Aurey Wallet MCP

Install Aurey Wallet MCP on Hermes so your agent can read EVM balances, prepare swaps, and sign via 1Claw Intents (no private keys in chat or MCP env).

How this doc is used: humans follow the steps; agents load skills/aurey-wallet-onboarding/SKILL.md and use this file as the Hermes-specific reference.

What you are building

You (human)          1Claw                    Hermes + Aurey MCP
    │                  │                              │
    │  1ck_… (once)    │  vault + agent + ocv_…       │
    ├─────────────────►│  Intents + ETH signing key   │
    │  (terminal)      │  Alchemy in vault (optional)   │
    │                  │                              │
    │                  │◄──── agent JWT + Intents ──────┤ wallet tools
    │                  │                              │

• Human key (1ck_…) — creates/configures 1Claw (one-time, terminal only).
• Agent key (ocv_…) — what Aurey MCP uses at runtime (written to ~/.hermes/.env, never chat).
• Wallet address — comes from 1Claw signing keys; fetch with get_agent_wallet_addresses, do not type 0x manually.

Official 1Claw docs: docs.1claw.xyz.

Secrets: what goes where

Hermes may retain chat in memory and logs. Never ask the user to paste 1ck_, ocv_, Alchemy, or Zerion keys in chat. Never pipe chat text into aurey-setup or aurey-hermes-install --prompt-secrets.

Naming: AUREY_ONECLAW_VAULT_API_KEY is the per-agent ocv_… key (agent-token + vault reads). Legacy alias: AUREY_ONECLAW_BOOTSTRAP_API_KEY. Not plt_ (Platform).

Built-in defaults (omit from MCP env): AUREY_HOSTED_PLATFORM_ENABLED=false, AUREY_EVM_SIGNING_MODE=oneclaw_intents.

Prerequisites

1. Hermes installed and a model configured (hermes setup / hermes model).
2. Hermes MCP extra (once):

bash cd ~/.hermes/hermes-agent && source venv/bin/activate && uv pip install -e ".[mcp]"

Hermes uses venv/, not .venv/.

1. 1Claw account at 1claw.xyz with a personal API key (1ck_…): dashboard → API keys → create (or Human API).
2. Aurey Wallet MCP installed on the Hermes machine (PyPI/curl—no clone required). See install site.
3. Alchemy API key (optional at setup; needed for balances/portfolio reads).

Skills (load in Hermes so the agent can guide you):

• skills/aurey-wallet-onboarding/SKILL.md — setup
• skills/aurey-wallet/SKILL.md — swaps/sends after MCP is live

Index: SKILL.md.

Recommended: one-command setup (aurey-setup)

Run in your terminal (not Hermes chat). Default host is Hermes; same command works for Cursor, Claude Desktop, and OpenClaw with --host.

Install package (once):

curl -fsSL https://agentic-pantheon.github.io/aurey-mcp/install.sh | bash
# or: pip install 'aurey-wallet-mcp[hermes]'

Configure (masked prompts):

aurey-setup                  # Hermes (default)
aurey-setup --host cursor    # ~/.cursor/mcp.json
aurey-setup --host claude    # Claude Desktop config
aurey-setup --host openclaw  # ~/.openclaw/openclaw.json (or OPENCLAW_CONFIG)

Contributors from a git clone: uv sync --group dev --extra hermes then uv run aurey-setup ….

Prompts (masked):

1. 1Claw human API key (1ck_…)
2. Alchemy API key (Enter to skip; stored in 1Claw if provided)
3. LiFi API key (optional; Enter to skip) — Earn vault discovery + higher LiFi quote limits; see Earn quickstart / portal.li.fi/signup
4. Zerion API key (optional; Enter to skip) — local portfolio UI at http://127.0.0.1:8765/ and Telegram Mini App live data; see developers.zerion.io

What aurey-setup does automatically:

Useful flags:

uv run aurey-setup --vault-id '<existing-vault-uuid>'   # do not create/pick another vault
uv run aurey-setup --skip-alchemy                     # add Alchemy in dashboard later
uv run aurey-setup --skip-lifi                        # skip LiFi prompt (Earn vault list needs key later)
uv run aurey-setup --skip-zerion                      # skip Zerion prompt (portfolio UI needs key later)
uv run aurey-setup --zerion-key '<key>'               # non-interactive Zerion key
uv run aurey-setup --zerion-vault-path api-keys/zerion  # custom 1Claw vault path
uv run aurey-setup --from-env                         # human key in AUREY_ONECLAW_HUMAN_API_KEY
uv run aurey-setup --provision-only                   # 1Claw + ~/.aurey/mcp.env only
uv run aurey-setup --host cursor --skip-provision     # Re-wire MCP using saved mcp.env
uv run aurey-setup --host cursor --cursor-project .   # Project .cursor/mcp.json
uv run aurey-setup --config /path/to/mcp.json         # Override config file path

After success:

hermes mcp test aurey-wallet

In Hermes chat: /reload-mcp, then ask the agent to call get_agent_wallet_addresses.

Agent-guided flow (chat + terminal)

Use this when the user starts in Hermes chat and you (the agent) coach them.

1 — Open with a safe prompt (user)

Help me install Aurey Wallet MCP on Hermes.
Repo: /path/to/aurey-wallet-mcp
I will run aurey-setup in my terminal for 1ck_ and Alchemy.
I will NOT paste 1ck_, ocv_, or Alchemy in this chat.

2 — Agent checklist (copy in chat)

Setup:
- [ ] Hermes + MCP extra installed
- [ ] 1Claw account + human API key (1ck_…) ready
- [ ] User ran: uv sync --group dev --extra hermes && uv run aurey-setup
- [ ] hermes mcp test aurey-wallet OK
- [ ] /reload-mcp
- [ ] get_agent_wallet_addresses → ethereum + evm_source oneclaw_signing_keys
- [ ] Read-only balance test (no tx_execute yet)
- [ ] User loaded skills/aurey-wallet/SKILL.md

3 — What the agent does in chat

• Explain one terminal command (aurey-setup); do not request secrets.
• Answer questions about 1Claw (vault, Intents, signing keys) using docs/1claw-onboarding-guide.md.
• After MCP is up: call get_agent_wallet_addresses; read back ethereum and evm_source.
• First live action: read-only (e.g. native balance on ethereum).
• No tx_execute during onboarding.

4 — What the user does in terminal only

• uv run aurey-setup (or manual path below).
• hermes mcp test aurey-wallet
• Fix ~/.hermes/.env if smoke test fails (never paste fixes into chat).

Manual path (dashboard 1Claw + aurey-hermes-install)

Use if you already created vault/agent in the 1Claw dashboard or need fine-grained control.

1Claw (dashboard):

1. Vault → copy vault UUID.
2. Agent with Intents API enabled → copy agent UUID.
3. Create / rotate agent API key → ocv_… (shown once).
4. Provision Ethereum signing key on that agent.
5. Store Alchemy at api-keys/alchemy; policy allowing agent read on api-keys/**.

Hermes (terminal):

cd /path/to/aurey-wallet-mcp
uv sync --group dev --extra hermes
uv run aurey-hermes-install --repo "$(pwd)" --prompt-secrets

Type vault UUID, agent UUID, and masked ocv_ in the terminal.

Or UUIDs from chat + secrets in shell:

export AUREY_ONECLAW_VAULT_API_KEY='ocv_...'
uv run aurey-hermes-install --repo "$(pwd)" \
  --vault-id '<vault-uuid>' \
  --agent-id '<agent-uuid>' \
  --from-env

What gets written on disk

Do not use hermes mcp add with uv run --directory … — Hermes CLI misparses --directory. The installer uses the venv binary path.

Manual config.yaml snippet:

mcp_servers:
  aurey-wallet:
    enabled: true
    command: /path/to/aurey-wallet-mcp/.venv/bin/aurey-wallet-mcp
    env:
      AUREY_ONECLAW_VAULT_ID: ${AUREY_ONECLAW_VAULT_ID}
      AUREY_ONECLAW_VAULT_API_KEY: ${AUREY_ONECLAW_VAULT_API_KEY}
      AUREY_ONECLAW_AGENT_ID: ${AUREY_ONECLAW_AGENT_ID}

Verify and first use

Terminal:

hermes mcp test aurey-wallet

Chat:

/reload-mcp

Call get_agent_wallet_addresses and show my ethereum address and evm_source.
Then evm_get_native_balance for ethereum using that address.

When the user wants to swap or send, follow skills/aurey-wallet/SKILL.md: prepare → show summary → explicit confirm → tx_execute(prepared_id=…).

Using Aurey after setup

Signing stays in 1Claw Intents; the model never sees the private key.

Optional: AUREY_ROUTE_BUILDER_URL in MCP env for hosted swap quotes — see docs/setup.md.

Troubleshooting

Agent rules (operators / skills)

1. Say it first, unprompted: your opening setup message must state that 1ck_ / ocv_ / Alchemy / LiFi / Zerion keys are never pasted in chat, and must include the exact terminal commands to run on the machine where Hermes runs. Never offer “send me the key and I’ll continue”.
2. Hermes default: direct user to aurey-setup in a terminal on the Hermes machine; it prompts for secrets with masked input. Never collect 1ck_ / ocv_ / Alchemy in chat.
3. If a secret lands in chat anyway: do not echo it; tell the user to rotate it in the issuing dashboard and re-run setup with the new key.
4. Chat is OK for: repo path, errors (redact secrets), vault/agent UUIDs after setup, verification tool output.
5. Do not run interactive installers with secrets embedded in agent-run command strings.
6. After install: /reload-mcp → get_agent_wallet_addresses → read-only check.
7. Load both onboarding and operations skills (SKILL.md).

Related

• docs/1claw-onboarding-guide.md — all hosts, manual 1Claw, Platform note
• docs/setup.md — route builder, dashboard, autonomy
• install/openclaw.md / install/cursor.md — non-Hermes MCP hosts
• ONBOARDING_1CLAW.md — one-page agent playbook

Telegram/Discord/Slack use the Hermes gateway; Aurey only adds wallet MCP tools on the machine running Hermes.