Footer

Your go-to destination for discovering trending open-source projects and uncovering the insights that matter

Legal

  • Terms and conditions
  • Privacy policy

More

  • Pricing
  • Advertise
  • onedump
  • gosnakego
  • Contact us

Social

  • X (Twitter)
  • GitHub
Trendshift owl
What they build speaks louder than words
© 2026 Trendshift, created by Julian Li with ❤️
SignalAdvertise
Trendshift
SignalAdvertise
Sign in
Trendshift owl

Discover trends that matter

SignalAdvertise
DailyWeeklyMonthlyYearly
Live mentionsTopics
RepositoriesDevelopers
InsightsStats

Bifrost
Bifrost

1clawAI/1claw-mcp

MCP server for 1claw secrets vault — gives AI agents secure, just-in-time access to secrets

Visit GitHub
TypeScript
4
3
2 contributors
MIT License
FeaturedAdvertise to 180K+ monthly visitors
Bifrost

Fastest Enterprise AI Gateway for Routing, Governing, and Securing all your AI Traffic

Momentum

How fast 1clawAI/1claw-mcp is gaining stars, and where it lands on Trendshift and GitHub Trending

Activity and trending

Stars, forks and merged pull requests each day or month, lined up with the repository's rank on Trendshift Trending

Oct 15 – Nov 3, 2026

Stars +2 in 20 days

01
1

Forks +0 in 20 days

01

Merged PRs 0 in 20 days

01

Trendshift Trendingwhere the repository ranked each day it made the top 25

Not in the Trendshift top 25 in this period

Oct 15Oct 18Oct 21Oct 24Oct 27Oct 30Nov 2
The left and right arrow keys step from day to day; Home and End go to the first and the last

Stars, forks, merged pull requests and Trendshift Trending rank, by day
DayStars gainedForks gainedMerged PRs
Thu, Oct 15, 2026+1+00
Fri, Oct 16, 2026+0+00
Sat, Oct 17, 2026+0+00
Sun, Oct 18, 2026+0+00
Mon, Oct 19, 2026+0+00
Tue, Oct 20, 2026+0+00
Wed, Oct 21, 2026+0+00
Thu, Oct 22, 2026+0+00
Fri, Oct 23, 2026+0+00
Sat, Oct 24, 2026+0+00
Sun, Oct 25, 2026+0+00
Mon, Oct 26, 2026+0+00
Tue, Oct 27, 2026+0+00
Wed, Oct 28, 2026+0+00
Thu, Oct 29, 2026+0+00
Fri, Oct 30, 2026+1+00
Sat, Oct 31, 2026+0+00
Sun, Nov 1, 2026+0+00
Mon, Nov 2, 2026+0+00
Tue, Nov 3, 2026+0+00
Total+2+00
  • 1#1 on the list
  • 7Rank that day
  • Not trending

Social mentions

Recent discussions about this repository across the web
  1. Nov 31 post
    • SD-JWT JS 0.19.0 silently drops tampered claims instead of rejecting the token. Agents using it will accept forged credentials. When policy enforcement lives vault-side, a buggy client library cannot…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  2. 26 days earlier
  3. Oct 81 post
    • PraisonAI's prompt injection filter was bypassed for high-severity attacks. If the agent holds API keys in its environment, a successful injection can exfiltrate them. A better filter isn't the fix.…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  4. 17 days earlier
  5. Sep 211 post
    • An AI workflow platform had an OAuth CSRF bug: empty state passed validation, letting attackers hijack accounts and the secrets inside. Keys in your orchestration layer are one CSRF away. Vault-side…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  6. Sep 161 post
    • A GitLab MCP server lets callers set the API endpoint via header. Point it at your server and receive the GitLab token the agent holds. All versions of zereight/mcp-gitlab affected. If the key never…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  7. 9 days earlier
  8. Sep 71 post
    • An OpenAI agent appeared to "escape" to Hugging Face. It did not escape. It sat on OpenAI's servers and made external calls using credentials it held. Vault the key outside the agent process, and…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  9. 10 days earlier
  10. Aug 281 post
    • Yamcs (mission control software) has a YAML injection bug. Craft an API call, get full RCE, read every secret out of the process environment. This is why keys must never live in the agent process.…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  11. Aug 261 post
    • Chainlit's MCP transport has an SSRF bug: unauthenticated requests reach internal endpoints, including cloud metadata that hands out credentials. Credential theft via SSRF only works when a key lives…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  12. Aug 251 post
    • A path traversal bug in a popular MCP browser tool let attackers write files to any disk path. Credentials stored near the agent become targets. If keys never live in the agent process, there is…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  13. 2 months earlier
  14. Jun 301 post
    • A clean GitHub repo just became a full system takeover for Claude Code. No malicious files. The attack hides prompts that redirect tool calls once the agent reads the repo. Policy-gated actions are…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com

  15. Jun 261 post
    • Someone set up a proxy giving free unlimited Claude, GPT, and Gemini. No key needed. Someone's stolen API credentials are footing the bill. Keys in the agent process are keys waiting to be stolen.…

      Read full on X, posted by @1clawAI

      @1clawAI · x.com