langclaw-croo-agent-5b7f5f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited langclaw-croo-agent-5b7f5f (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Langclaw CROO Agent is a paid callable research agent for CROO CAP and MCP-compatible coding tools.
It turns a research request into a concise report with sources, confidence, provider trace, and delivery proof. The same core agent runs behind a CROO provider, a hosted MCP server, a local MCP server, and a Codex plugin.
Langclaw can run without a model API key for non-onchain services. Langclaw Onchain Intelligence can optionally use a semantic reasoning layer on the operator VPS, then validate and run Langclaw's read-only onchain tools before returning delivery proof.
Langclaw Onchain Intelligence as a 0.10 USDC service for requester agents.langclaw_research: Research a protocol, project, token, market topic, or agent idea.langclaw_verify_claim: Check whether a claim has enough source support.langclaw_builder_review: Review whether a project fits a builder program, hackathon, grant, or submission goal.langclaw_onchain_intelligence: Run read-only chain, token, wallet, contract, transaction, bridge, governance, or protocol analytics.langclaw_readiness: Check local provider, model, MCP, and CROO configuration.Strong onchain prompts sent through langclaw_research also auto-route to onchain intelligence. Examples include wallet, contract, transaction, TVL, liquidity, pool, bridge, governance, token holder, and chain activity requests.
Users do not need to clone this repository or bring provider API keys. The hosted Langclaw server runs on the operator VPS and keeps the provider keys there.
Codex one-line install:
npx @langclaw/mcp-client install-codex --url https://langclaw.nanta.tech/mcp --token LICENSE_TOKENThis installs the hosted MCP config, Langclaw skill, and Langclaw plugin.
Codex also understands slash-style Langclaw prompts through the installed skill:
/langclaw-research CROO agent market fit
/langclaw-onchain Base smart money last 7 days
/langclaw-builder-review Review this repo for CROO
/langclaw-verify Langclaw supports hosted MCP access
/langclaw-readinessClaude Code CLI one-line install:
npx @langclaw/mcp-client install-claude --url https://langclaw.nanta.tech/mcp --token LICENSE_TOKENCursor one-line install:
npx @langclaw/mcp-client install-cursor --url https://langclaw.nanta.tech/mcp --token LICENSE_TOKENWindsurf one-line install:
npx @langclaw/mcp-client install-windsurf --url https://langclaw.nanta.tech/mcp --token LICENSE_TOKENInstall without plugin:
npx @langclaw/mcp-client install-codex --url https://langclaw.nanta.tech/mcp --token LICENSE_TOKEN --no-pluginUninstall from Codex:
npx @langclaw/mcp-client uninstall-codexManual MCP client config:
{
"mcpServers": {
"langclaw": {
"command": "npx",
"args": [
"@langclaw/mcp-client",
"--url",
"https://langclaw.nanta.tech/mcp",
"--token",
"LICENSE_TOKEN"
]
}
}
}The same manual config shape works for Codex, Claude Code CLI, Cursor, Windsurf, and MCP clients that launch stdio servers. Codex remains the richest install because it also writes the Langclaw skill and plugin.
End users can also use Langclaw without installing anything:
Langclaw Builder Pass License for 30-day hosted MCP access.langclaw.research.brief or langclaw.onchain.intelligence for direct CROO delivery.Recommended CROO dashboard service:
Service Name: Langclaw Onchain Intelligence
Description: Source-backed onchain intelligence for agents that need read-only chain, token, wallet, contract, protocol, and market context. Langclaw plans the request, runs validated onchain tools, and returns a structured intelligence packet with sources, risks, opportunities, and reusable agent context.
Price: 0.10 USDC
SLA: 15 minutes
Deliverable: Text JSON
Requirements: SchemaStore listing evidence to include in the final submission:
Langclaw Onchain Intelligence.npm install
cp .env.example .envStore provider keys only on the VPS:
TAVILY_API_KEYBRAVE_SEARCH_API_KEYGITHUB_TOKENETHERSCAN_API_KEYALCHEMY_API_KEYGOPLUS_API_KEYGOPLUS_API_SECRETDUNE_API_KEYDUNE_API_KEYSDUNE_API_KEY_RETRY_STATUSDUNE_API_KEY_MAX_ATTEMPTSOPENAI_API_KEYCROO_API_KEYCROO_TARGET_SERVICE_IDLANGCLAW_ONCHAIN_SERVICE_IDLANGCLAW_ACCESS_TOKENSLANGCLAW_ADMIN_ACCESS_TOKENSLANGCLAW_LICENSE_STORE_PATHLANGCLAW_LICENSE_DEFAULT_DAYSLANGCLAW_LICENSE_DEFAULT_CALLSLANGCLAW_CROO_EVIDENCE_LOG_PATHLANGCLAW_A2A_WORKBENCH_ENABLEDLANGCLAW_A2A_WORKBENCH_REQUIREDLANGCLAW_A2A_WORKBENCH_SERVICE_IDLANGCLAW_A2A_WORKBENCH_CAPABILITY_IDLANGCLAW_A2A_WORKBENCH_TIMEOUT_MSLANGCLAW_A2A_WORKBENCH_MAX_INPUT_CHARSStart the hosted MCP server:
npm run serverStart the CROO provider separately:
npm run croo:providernpm run mcpExample MCP client command:
{
"mcpServers": {
"langclaw-croo-agent": {
"command": "npm",
"args": ["--prefix", "/Users/ridhorinanta/hackathon/langclaw-croo-agent", "run", "mcp"]
}
}
}Codex plugin:
plugin/.codex-plugin/plugin.jsonplugin/.mcp.jsonplugin/skills/langclaw-croo-agent/SKILL.mdCodex MCP:
Claude Code CLI:
langclaw-croo-agent.npm as the command.--prefix, this repo path, run, and mcp as args.Cursor:
Windsurf:
.env changes.npm run croo:providerRequired live settings:
CROO_API_URLCROO_WS_URLCROO_SDK_KEY or CROO_API_KEYLANGCLAW_PROVIDER_FUND_ADDRESS for CROO fund-transfer servicesLANGCLAW_AGENT_PRICE_USDCLANGCLAW_ONCHAIN_SERVICE_ID for the CROO dashboard service ID of Langclaw Onchain IntelligenceLANGCLAW_ACCESS_TOKENS for hosted MCP access controlLANGCLAW_ADMIN_ACCESS_TOKENS for hosted MCP admin fallback accessLANGCLAW_LICENSE_STORE_PATH for paid license token storageLANGCLAW_CROO_EVIDENCE_LOG_PATH for CAP order evidence logsCROO_API_KEY is the name shown by the CROO dashboard. CROO_SDK_KEY is also supported for compatibility with SDK docs. Do not export a private key from your main browser wallet for this repo. CROO shows the agent account wallet in its dashboard. Fund that agent account when CROO requires balance for paid actions.
LANGCLAW_PROVIDER_FUND_ADDRESS must be a Base mainnet EVM address such as 0x.... The provider only uses it when a CROO negotiation includes fund-transfer fields. Non-fund services keep the normal CROO escrow flow.
The provider appends safe CAP lifecycle evidence to LANGCLAW_CROO_EVIDENCE_LOG_PATH. Each JSONL row records the stage, negotiation ID, order ID, capability, input hash, settlement mode, delivery hash, and source count when available. It does not store raw buyer prompts, API keys, or license tokens.
For A2A smoke tests, set CROO_TARGET_SERVICE_ID to the same service ID as LANGCLAW_ONCHAIN_SERVICE_ID. Requester agents should send langclaw.onchain.intelligence requirements with research_prompt, chain, scope, timeframe, targetUse, and responseLanguage. query remains supported as a backward-compatible alias.
Langclaw Onchain Intelligence can optionally hire Universal Workbench as a downstream A2A agent. Enable it with LANGCLAW_A2A_WORKBENCH_ENABLED=true. Langclaw uses its own CROO agent key as the requester, so buyers do not provide a Langclaw SDK key. The default downstream target is service a8f1c20d-73f4-4551-856a-32315e18d261 with capability universal.workbench.agent. Keep LANGCLAW_A2A_WORKBENCH_REQUIRED=false for live reliability. If Workbench times out, Langclaw still delivers the onchain intelligence packet and omits a2aWorkPack from the buyer-facing delivery.
Paid MCP access uses a license token. The default paid license lasts 30 days and allows 300 MCP tool calls.
Create a demo license:
npm run license:create -- --label demo --days 7 --calls 50List licenses:
npm run license:listRevoke a license:
npm run license:revoke -- --token lc_live_xxxThe license registry stores token hashes only. Keep data/licenses.json on the VPS and do not commit it.
Optional onchain settings:
ETHERSCAN_API_KEYALCHEMY_API_KEYGOPLUS_API_KEYGOPLUS_API_SECRETDUNE_API_KEYDUNE_API_KEYSDUNE_API_KEY_RETRY_STATUSDUNE_API_KEY_MAX_ATTEMPTSDUNE_DEFAULT_QUERY_IDOPENAI_API_KEYOPENAI_MODELLANGCLAW_ONCHAIN_REASONING_ENABLEDLANGCLAW_ONCHAIN_REASONING_EFFORTLANGCLAW_ONCHAIN_REASONING_REQUIREDLANGCLAW_ONCHAIN_REASONING_MAX_INPUT_CHARSLANGCLAW_ONCHAIN_REASONING_MAX_OUTPUT_TOKENSLANGCLAW_ONCHAIN_REASONING_MAX_RETRIESLANGCLAW_A2A_WORKBENCH_ENABLEDLANGCLAW_A2A_WORKBENCH_REQUIREDLANGCLAW_A2A_WORKBENCH_SERVICE_IDLANGCLAW_A2A_WORKBENCH_CAPABILITY_IDLANGCLAW_A2A_WORKBENCH_TIMEOUT_MSLANGCLAW_A2A_WORKBENCH_MAX_INPUT_CHARSOnchain semantic reasoning is scoped only to Langclaw Onchain Intelligence. It receives the buyer research_prompt and safe provider summaries, not raw provider payloads, env dumps, API keys, private keys, license tokens, or full evidence logs. Keep LANGCLAW_ONCHAIN_REASONING_REQUIRED=false for demo fallback unless you want paid onchain orders to fail when the semantic layer is unavailable.
Use LANGCLAW_PROVIDER_MODE=mock to run a local dry run without opening a live provider connection.
Check live credential readiness:
npm run smoke:croo-liveRun a live requester smoke order from a separate CROO requester agent:
npm run croo:requester-smoke
npm run croo:evidence-reportThe requester smoke uses the requester agent's own CROO key. It reads CROO_REQUESTER_SDK_KEY first for shared local .env files, then falls back to the official CROO_SDK_KEY name from the CROO docs. Do not share the Langclaw provider key with buyers or external requester agents.
The requester smoke writes a redacted summary to data/croo-requester-smoke.json. The report command turns provider and requester evidence into docs/CROO_LIVE_EVIDENCE.md for demo and submission review.
The data/ directory is local runtime output and is intentionally ignored. Keep shareable submission evidence in docs/CROO_LIVE_EVIDENCE.md.
For final commerce proof, capture at least one paid requester order with requester agent ID, requester wallet, service ID, negotiation ID, order ID, payment transaction hash, delivery transaction hash when available, and delivery hash.
npm run typecheck
npm test
npm run build
npm run smoke:readiness
npm run smoke:croo-live
npm run validate:package
npm run scan:cleanup
npm run scan:dashLangclaw CROO Agent shows agent commerce in practice. A buyer can pay for a callable research or onchain intelligence capability, receive a verifiable delivery payload, and reuse the same hosted intelligence from coding tools through remote MCP without cloning this repository.
Use real requester agents and buyer wallets for final proof. Keep provider and requester keys separate. Do not use fake payments, self-trade loops, or synthetic order activity as reward evidence. Keep redacted CROO order logs, requester smoke summaries, transaction hashes, and Store listing screenshots available for human review.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.