keygenix-mcp

keygenix-mcp

Keygenix MCP Server — Non-custodial TEE key management & signing for AI agents.


Private keys are generated, stored, and used exclusively inside a Trusted Execution Environment (TEE). They never leave in plaintext — not to you, not to Keygenix, not to the AI.

---

Quick Start

1. Get your credentials

1. Register at keygenix.pro
2. Create an organization → note orgCode
3. Create a wallet → note walletCode
4. Generate two keypairs (run once):

# Use the CLI to generate keypairs (easiest)
git clone https://github.com/wallet-io/keygenix-skill
cd keygenix-skill/cli && npm install

node client.js keygen   # → copy publicKey as API Auth Key
node client.js keygen   # → copy publicKey as AuthKey (separate keypair)

1. Register both public keys in the Keygenix dashboard.

2. Configure your AI client

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "keygenix": {
      "command": "node",
      "args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
      "env": {
        "KEYGENIX_API_PRIV_KEY": "your-api-auth-private-key-hex",
        "KEYGENIX_AUTH_PRIV_KEY": "your-authkey-private-key-hex",
        "KEYGENIX_ORG_CODE": "your-org-code",
        "KEYGENIX_WALLET_CODE": "your-wallet-code"
      }
    }
  }
}

Once published to npm, replace with "command": "npx", "args": ["keygenix-mcp"]

Cursor / Windsurf

Edit .cursor/mcp.json or .windsurf/mcp.json:

{
  "mcpServers": {
    "keygenix": {
      "command": "node",
      "args": ["/path/to/node_modules/keygenix-mcp/dist/index.js"],
      "env": {
        "KEYGENIX_API_PRIV_KEY": "...",
        "KEYGENIX_AUTH_PRIV_KEY": "...",
        "KEYGENIX_ORG_CODE": "...",
        "KEYGENIX_WALLET_CODE": "..."
      }
    }
  }
}

OpenClaw

Add to your OpenClaw MCP config, or use the keygenix OpenClaw Skill directly.

---

Available Tools

| Tool | Description | |------|-------------| | keygen | Generate a new secp256k1 keypair locally (no network) | | list_keys | List all keys in the wallet | | get_key | Get details of a key by keyCode | | create_key | Create a new key (mnemonic/private/secret) | | import_key | Import existing key into TEE (ECIES encrypted) | | list_addresses | List derived addresses for a key | | create_address | Derive a new address for a chain | | sign_transaction | Sign a blockchain transaction (EVM/SOL/SUI/etc.) | | sign_message | Sign an arbitrary message |

---

Supported Chains

EVM · Solana · Bitcoin · Litecoin · Dogecoin · Zcash · Tron · Ripple · Sui · TON · Cardano · Aptos · Cosmos · Sei

---

Security Model

AI Agent
  ↓  calls MCP tool (no keys in prompt)
keygenix-mcp (local process)
  ↓  ECDSA-signed HTTPS requests
Keygenix TEE API
  ↓  private key never leaves enclave
Signed transaction returned

• API Auth Private Key — signs every API request. Store in env, never hardcode.
• AuthKey Private Key — authorizes sign/export. Signed locally; Keygenix only sees the public key.
• Private keys — generated inside TEE, never exposed in plaintext.

---

Development

git clone https://github.com/wallet-io/keygenix-mcp
cd keygenix-mcp
npm install
npm run build
npm start

---

Distribution

| Channel | Command | |---------|---------| | GitHub | npm install github:wallet-io/keygenix-mcp | | npm _(coming soon)_ | npx keygenix-mcp | | OpenClaw | clawhub install keygenix | | Smithery | smithery.ai/server/keygenix |

---

Links

• Website: keygenix.pro
• API Docs: keygenix.pro/docs.html
• Skill + CLI: wallet-io/keygenix-skill
• Issues: github.com/wallet-io/keygenix-mcp/issues