@dcprotocol/proxy

@dcprotocol/proxy

Lightweight VPS/local proxy for DCP.

Use this package when an agent runs on a remote machine and should talk to a simple local HTTP endpoint while the real vault stays somewhere else behind the relay.

This package is the recommended remote-agent package. It avoids the heavier human CLI/keychain path.

Examples below use the default public relay wss://relay.dcp.1ly.store, but any compatible self-hosted relay works.

Install

npm install -g @dcprotocol/proxy

Or run it without installing:

npx -y -p @dcprotocol/proxy dcp-proxy --help

What It Does

• pairs a remote proxy with a vault using a short-lived pairing token
• stores only proxy identity on the remote machine
• exposes a local DCP-compatible HTTP endpoint for the agent
• forwards requests through the relay to the real vault

VPS Quick Start

Run the command generated by DCP Desktop or your local operator CLI:

npx -y -p @dcprotocol/proxy dcp-proxy \
  --pair "<pairing-token>" \
  --service-id "openclaw-vps" \
  --vault "<vault-id>" \
  --hpke-key "<vault-hpke-public-key>" \
  --relay "wss://relay.dcp.1ly.store" \
  --port 8420

Then point the remote agent to:

export DCP_URL=http://127.0.0.1:8420
export DCP_MODE=local

Endpoints

Agents should start with GET /v1/capabilities to discover what the proxy supports.

Minimal agent bootstrap:

• set DCP_URL=http://127.0.0.1:8420
• call GET $DCP_URL/v1/capabilities
• use the returned routes and operation names

Example read call after discovery:

curl -X POST http://127.0.0.1:8420/v1/vault/read \
  -H "Content-Type: application/json" \
  -d '{"scope":"identity.email"}'

The proxy exposes this local HTTP surface:

• GET /v1/capabilities
• GET /health
• GET /address/:chain
• GET /budget/check
• POST /v1/vault/sign
• POST /v1/vault/sign_message
• POST /v1/vault/sign_typed_data
• POST /v1/vault/sign_x402
• POST /v1/vault/read
• POST /v1/vault/write

Notes

• Proxy identity is stored at ~/.dcp/proxy/<service-id>.json
• Vault secrets do not move to the VPS
• The relay remains transport-only
• Read and write operations use vault scopes such as identity.email or credentials.api.openai

Related Docs

• Root: README.md
• Operator CLI: packages/dcp-cli/README.md
• SDK: packages/dcp-client/README.md