MCP 服务器

keygenix-mcp

Non-custodial TEE key management and signing for AI agents, supporting multiple blockchains.

README

keygenix-mcp

Keygenix MCP Server — Non-custodial TEE key management & signing for AI agents.

Private keys are generated, stored, and used exclusively inside a Trusted Execution Environment (TEE). They never leave in plaintext — not to you, not to Keygenix, not to the AI.

Quick Start

1. Get your credentials

Register at keygenix.pro
Create an organization → note orgCode
Create a wallet → note walletCode
Generate two keypairs (run once):

# Use the CLI to generate keypairs (easiest)
git clone https://github.com/wallet-io/keygenix-skill
cd keygenix-skill/cli && npm install

node client.js keygen   # → copy publicKey as API Auth Key
node client.js keygen   # → copy publicKey as AuthKey (separate keypair)

2. Configure your AI client

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "keygenix": {
      "command": "node",
      "args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
      "env": {
        "KEYGENIX_API_PRIV_KEY": "your-api-auth-private-key-hex",
        "KEYGENIX_AUTH_PRIV_KEY": "your-authkey-private-key-hex",
        "KEYGENIX_ORG_CODE": "your-org-code",
        "KEYGENIX_WALLET_CODE": "your-wallet-code"
      }
    }
  }
}

Once published to npm, replace with "command": "npx", "args": ["keygenix-mcp"]

Cursor / Windsurf

Edit .cursor/mcp.json or .windsurf/mcp.json:

{
  "mcpServers": {
    "keygenix": {
      "command": "node",
      "args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
      "env": {
        "KEYGENIX_API_PRIV_KEY": "...",
        "KEYGENIX_AUTH_PRIV_KEY": "...",
        "KEYGENIX_ORG_CODE": "...",
        "KEYGENIX_WALLET_CODE": "..."
      }
    }
  }
}

OpenClaw

Add to your OpenClaw MCP config, or use the keygenix OpenClaw Skill directly.

Available Tools

Tool	Description
`keygen`	Generate a new secp256k1 keypair locally (no network)
`list_keys`	List all keys in the wallet
`get_key`	Get details of a key by keyCode
`create_key`	Create a new key (mnemonic/private/secret)
`import_key`	Import existing key into TEE (ECIES encrypted)
`list_addresses`	List derived addresses for a key
`create_address`	Derive a new address for a chain
`sign_transaction`	Sign a blockchain transaction (EVM/SOL/SUI/etc.)
`sign_message`	Sign an arbitrary message

Supported Chains

EVM · Solana · Bitcoin · Litecoin · Dogecoin · Zcash · Tron · Ripple · Sui · TON · Cardano · Aptos · Cosmos · Sei

Security Model

AI Agent
  ↓  calls MCP tool (no keys in prompt)
keygenix-mcp (local process)
  ↓  ECDSA-signed HTTPS requests
Keygenix TEE API
  ↓  private key never leaves enclave
Signed transaction returned

API Auth Private Key — signs every API request. Store in env, never hardcode.
AuthKey Private Key — authorizes sign/export. Signed locally; Keygenix only sees the public key.
Private keys — generated inside TEE, never exposed in plaintext.

Development

git clone https://github.com/wallet-io/keygenix-mcp
cd keygenix-mcp
npm install
npm run build
npm start

Distribution

Channel	Command
GitHub	`npm install github:wallet-io/keygenix-mcp`
npm (coming soon)	`npx keygenix-mcp`
OpenClaw	`clawhub install keygenix`
Smithery	smithery.ai/server/keygenix