Run an OpenClaw agent on Thirdfy

Your OpenClaw agent runs on its own, so it can't sign in through a browser. It uses an agent key instead. You get the key once, store it in OpenClaw's runtime secrets, and point OpenClaw's MCP connector at Thirdfy. Then the agent reads markets, checks venues and trades from its own wallet, within the limits you set.

What you need

• An OpenClaw runtime that can add a remote MCP server with a custom header.
• A Thirdfy agent and its agent key (agent-...). Step 1 shows how to get one.
• Funds in the agent's execution wallet, if you want it to trade. It can read without them.

1. Get an agent and its key

You do this once. Pick one way.

With the Agent CLI

Sign in by email on your own machine. The second command creates the agent and its wallets.

npm install -g @thirdfy/agent-cli
thirdfy-agent login email you@example.com --json
thirdfy-agent login email you@example.com --code "<otp>" --accept-terms --json
thirdfy-agent whoami --json

The agent key (agent-...) is saved in ~/.thirdfy/config.json under agent.apiKey. whoami shows the agent's 0x address as agent.agentKey.

Over MCP, without an account

Connect any MCP client to https://mcp.thirdfy.com/mcp/public. No key is needed there.

1. Call startEmailOnboarding with your email.
2. Call completeEmailOnboarding with the email, the code from your inbox and acceptTerms: true.
3. Copy the key from data.bootstrap.agentApiKey. It is shown only once, so save it in your password manager.

2. Store the key as a runtime secret

Save the key in OpenClaw's runtime secrets as THIRDFY_AGENT_API_KEY.

Never put the key in prompts, skill files, logs or tool arguments.

3. Connect OpenClaw to Thirdfy

Point OpenClaw's MCP connector at https://mcp.thirdfy.com/mcp (streamable HTTP), and send the key as a header:

{
  "mcpServers": {
    "thirdfy": {
      "url": "https://mcp.thirdfy.com/mcp",
      "headers": {
        "Authorization": "Bearer ${THIRDFY_AGENT_API_KEY}"
      }
    }
  }
}

The exact file and variable syntax depend on your OpenClaw pack. Thirdfy reads the key from the header on every call, so your agent can act only for itself.

Check the connection from a shell:

curl -s https://mcp.thirdfy.com/health
curl -s -X POST https://mcp.thirdfy.com/tool/getProviderActions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $THIRDFY_AGENT_API_KEY" \
  -d '{"provider":"hyperliquid","view":"concise"}'

4. Make a first read

Ask your agent to call a read. Nothing is signed or sent.

walletExecute { action: "get_openmarket_btc_funding" }

Have the agent call getProviderActions before it plans. Then it uses only actions it is allowed to call, with the names discovery returns.

5. Preview, then run a trade

The agent trades from its own execution wallet (agent_wallet). Before a write, it follows these steps:

getProviderActions → agentWalletBootstrap (requireFundingCheck: true) → getVenueReadiness
  → previewOrder → agentRun / walletExecute

1. Check the wallet. agentWalletBootstrap with requireFundingCheck: true shows the execution wallet and whether it is funded. Fund that wallet, not your login wallet.
2. Check the venue. Call getVenueReadiness for the venue, for example Hyperliquid. Go on only when ready is true and blockingReasons is empty.
3. Preview. Call previewOrder with the same arguments as the trade. It shows whether Thirdfy would run it. Nothing moves.
4. Run. Call agentRun or walletExecute with the same arguments.

If a write answers CONFIRMATION_REQUIRED, repeat the call with the confirmationToken only after you agree to the summary.

What happens before every trade

• Your agent's limits apply. Thirdfy checks the action allowlist, the daily limit, any delegation and credits on every write. If one check fails, nothing runs.
• Venues are checked. Thirdfy refuses a venue order when the venue isn't ready, and says why. Run the venue onboarding tools before the first Polymarket, Hyperliquid or Lighter write.
• The key stays yours. If a call names a different key in its arguments, it fails with AGENT_IDENTITY_MISMATCH.
• No double orders on hosted runtimes. Runtimes hosted on EarnOrg pass executionContext (runtimeId, orgId) on walletExecute, executeIntent and agentRun. This ties credits and duplicate-order protection to the right runtime. Place orders there need an idempotencyKey that starts with earnclaw:<runtimeId>.

{
  "runtimeId": "<runtime-uuid>",
  "orgId": "<org-uuid>"
}

If something goes wrong

For developers

OpenClaw can use the Agent CLI instead of MCP. Keep THIRDFY_AGENT_API_KEY and THIRDFY_AGENT_KEY (the agent's 0x address) in the runtime secrets, and have the agent run thirdfy-agent actions --provider <id> before it plans:

npm install -g @thirdfy/agent-cli@0.5.0
thirdfy-agent actions --provider hyperliquid --json
thirdfy-agent venue readiness hyperliquid --json

Use agent_wallet for the agent's own wallet. Use self only when local signing is set up, and hybrid or thirdfy only after delegation is ready. See Hermes and OpenClaw with the CLI.

Related

• OpenClaw and Hermes (MCP)
• Hermes and OpenClaw with the CLI
• Connect and authenticate
• Run a Hermes agent on Thirdfy