keygenix-mcp

Keygenix MCP Server — Non-custodial TEE key management & signing for AI agents.

Private keys are generated, stored, and used exclusively inside a Trusted Execution Environment (TEE). They never leave in plaintext — not to you, not to Keygenix, not to the AI.

---

Quick Start

1. Get your credentials

1. Register at keygenix.pro
2. Create an organization → note orgCode
3. Create a wallet → note walletCode
4. Generate two keypairs (run once):

# Use the CLI to generate keypairs (easiest)
git clone https://github.com/wallet-io/keygenix-skill
cd keygenix-skill/cli && npm install

node client.js keygen   # → copy publicKey as API Auth Key
node client.js keygen   # → copy publicKey as AuthKey (separate keypair)

5. Register both public keys in the Keygenix dashboard.

2. Configure your AI client

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "keygenix": {
      "command": "node",
      "args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
      "env": {
        "KEYGENIX_API_PRIV_KEY": "your-api-auth-private-key-hex",
        "KEYGENIX_AUTH_PRIV_KEY": "your-authkey-private-key-hex",
        "KEYGENIX_ORG_CODE": "your-org-code",
        "KEYGENIX_WALLET_CODE": "your-wallet-code"
      }
    }
  }
}

Once published to npm, replace with "command": "npx", "args": ["keygenix-mcp"]

Cursor / Windsurf

Edit .cursor/mcp.json or .windsurf/mcp.json:

{
  "mcpServers": {
    "keygenix": {
      "command": "node",
      "args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
      "env": {
        "KEYGENIX_API_PRIV_KEY": "...",
        "KEYGENIX_AUTH_PRIV_KEY": "...",
        "KEYGENIX_ORG_CODE": "...",
        "KEYGENIX_WALLET_CODE": "..."
      }
    }
  }
}

OpenClaw

Add to your OpenClaw MCP config, or use the keygenix OpenClaw Skill directly.

---

Available Tools

Tool	Description
keygen	Generate a new secp256k1 keypair locally (no network)
list_keys	List all keys in the wallet
get_key	Get details of a key by keyCode
create_key	Create a new key (mnemonic/private/secret)
import_key	Import existing key into TEE (ECIES encrypted)
list_addresses	List derived addresses for a key
create_address	Derive a new address for a chain
sign_transaction	Sign a blockchain transaction (EVM/SOL/SUI/etc.)
sign_message	Sign an arbitrary message

---

Supported Chains

EVM · Solana · Bitcoin · Litecoin · Dogecoin · Zcash · Tron · Ripple · Sui · TON · Cardano · Aptos · Cosmos · Sei

---

Security Model

AI Agent
  ↓  calls MCP tool (no keys in prompt)
keygenix-mcp (local process)
  ↓  ECDSA-signed HTTPS requests
Keygenix TEE API
  ↓  private key never leaves enclave
Signed transaction returned

• API Auth Private Key — signs every API request. Store in env, never hardcode.
• AuthKey Private Key — authorizes sign/export. Signed locally; Keygenix only sees the public key.
• Private keys — generated inside TEE, never exposed in plaintext.

---

Development

git clone https://github.com/wallet-io/keygenix-mcp
cd keygenix-mcp
npm install
npm run build
npm start

---

Distribution

Channel	Command
GitHub	npm install github:wallet-io/keygenix-mcp
npm (coming soon)	npx keygenix-mcp
OpenClaw	clawhub install keygenix
Smithery	smithery.ai/server/keygenix

---

Links

• Website: keygenix.pro
• API Docs: keygenix.pro/docs.html
• Skill + CLI: wallet-io/keygenix-skill
• Issues: github.com/wallet-io/keygenix-mcp/issues