M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
1

1Password MCP Server

Community
Give your AI assistant a locked door to 1Password — not a pile of passwords in the chat
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #5 of 438
Stars
★ 21 Popular
Transport
stdio (local process)
Runtime
Node.js 20+
Credentials
API key / credential required
License
Apache-2.0
Last commit
Tools
15
75FMRS · B

A mature, security-conscious community 1Password MCP server. The 15 tools cover the full credential lifecycle, and the default-safe path — op_run with op:// references plus metadata-only reads — effectively keeps plaintext out of model transcripts. Caveats: it is not an official 1Password product, and MCP transport is not end-to-end encrypted for secrets in flight, so it suits automation credentials rather than highly personal data. Recommended for developers and SREs working in dedicated automation vaults.

Strongest · Documentation 18/20 Weakest · Reliability 12/20

Reliability
12/20
Security and permissions
16/20
Maintenance
14/20
Documentation
18/20
Setup experience
15/20
Why each score
Reliability 12/20
The project uses MCP SDK v2 with clear protocol negotiation for version 2026-07-28 while maintaining legacy client compatibility. The code structure is well-organized with complete implementations of tools, prompts, and resources. However, there's insufficient evidence of thorough error handling and edge case testing, preventing a full score.
Security and permissions 16/20
The project employs a security-first design, defaulting to not return sensitive data unless explicitly requested with reveal: true. It supports op_run functionality for injecting environment variables into child processes without exposing plaintext in model outputs. It also integrates with macOS Keychain and provides allow-list configuration. However, the MCP protocol itself doesn't encrypt secrets in transit, presenting some risk.
Maintenance 14/20
The project has active CI/CD processes with frequent version updates, with the latest being 4.0.2. It uses the Apache 2.0 license and includes clear contribution guidelines. However, dependency update status and issue response times cannot be determined from static code alone.
Documentation 18/20
Documentation is comprehensive, including detailed installation guides, configuration options, tool descriptions, and usage examples. It particularly emphasizes security best practices, including how to handle sensitive information and follow the principle of least privilege. Configuration examples are provided for various clients like Claude Desktop, VS Code, and OpenAI Codex.
Setup experience 15/20
Installation is straightforward using npm package management, supporting configuration via environment variables or CLI parameters. It provides configuration guides for different platforms, especially macOS Keychain integration. Configuration examples are clear and easy to understand and implement.

Static review · not runListed 2026-09-07

Read the FMRS scoring method →

Fit and risk

What it can accessRuns commands or codeUses the networkChanges third-party account data

Best for

  • Individuals and teams managing automation credentials like CI tokens and bot accounts
  • Security-conscious users who want to keep plaintext out of model transcripts
  • Developers and SREs using MCP clients such as Claude Desktop, Cursor, VS Code Copilot, or OpenAI Codex

Not for

  • Storing banking, primary personal logins, or recovery codes
  • Workflows where nothing may be sent to an AI provider
  • Scenarios requiring end-to-end encryption of secrets in transit
  • Users without a Node.js 20+ runtime

Required permissions

  • Requires a 1Password service account token (or a macOS Keychain token)
  • The service account must be granted access to target vaults
  • op_run can execute arbitrary local commands (with cwd, shell, timeout, stdin options)
  • item_delete permanently removes items with no undo

Risks and side effects

  • Anything revealed to the model may be sent to your AI provider and retained under their policies
  • Secrets are plaintext inside the MCP workflow — not end-to-end encrypted; encrypted only at rest in 1Password
  • The service account token is a master key and must be rotated immediately if leaked
  • item_delete is irreversible
  • op_run allows local command execution — pair with vault allow-lists and least-privilege scoping

Setup

Before you start

Runtime：Node.js 20+

OP_SERVICE_ACCOUNT_TOKEN requiredsecret 1Password service account token; create one in 1Password web under Developer → Service Accounts and copy it once.
Other optional settings (7)
OP_KEYCHAIN_SERVICE optional macOS only: Keychain service name holding the token, so it stays out of config files.
OP_KEYCHAIN_ACCOUNT optional macOS only: optional Keychain account name to narrow the token lookup.
OP_MCP_ALLOWED_VAULTS optional Optional comma-separated vault names or IDs restricting which vaults op_run and op_check_ref may resolve.
OP_INTEGRATION_NAME optional Optional integration name reported to the 1Password SDK (default: 1password-mcp).
OP_INTEGRATION_VERSION optional Optional integration version reported to the 1Password SDK.
MCP_LOG_LEVEL optional Log level: debug, info, warn, or error (default: info).
MCP_DEBUG optional If set, forces debug logging.
  1. Install Node.js 20 or newer.
  2. In 1Password web, go to Developer → Service Accounts, create a service account scoped only to an automation vault, and copy the token.
  3. Add to your MCP config: {"mcpServers":{"1password":{"command":"npx","args":["-y","@takescake/1password-mcp"],"env":{"OP_SERVICE_ACCOUNT_TOKEN":"YOUR_SERVICE_ACCOUNT_TOKEN"}}}}.
  4. Restart the app and ask in plain English. On macOS, use OP_KEYCHAIN_SERVICE (plus optional OP_KEYCHAIN_ACCOUNT) to read the token from Keychain instead of the config file. Optionally set OP_MCP_ALLOWED_VAULTS to restrict which vaults op_run / op_check_ref may resolve.
claude_desktop_config.json 
{"mcpServers":{"1password":{"command":"npx","args":["-y","@takescake/1password-mcp"],"env":{"OP_SERVICE_ACCOUNT_TOKEN":"YOUR_SERVICE_ACCOUNT_TOKEN"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "1password": {
      "command": "npx",
      "args": [
        "-y",
        "@takescake/1password-mcp"
      ],
      "env": {
        "OP_SERVICE_ACCOUNT_TOKEN": "YOUR_SERVICE_ACCOUNT_TOKEN"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add 1password -e OP_SERVICE_ACCOUNT_TOKEN=YOUR_SERVICE_ACCOUNT_TOKEN -- npx -y @takescake/1password-mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

Restart the client and ask "List my 1Password vaults" — if the vault_list tool appears and returns vaults, the connection works.

Troubleshooting

  1. Confirm Node.js 20 or newer is installed
  2. Check that OP_SERVICE_ACCOUNT_TOKEN is set correctly and not expired
  3. On macOS without a token env var, verify OP_KEYCHAIN_SERVICE (and optional OP_KEYCHAIN_ACCOUNT) are configured
  4. If an op:// reference is rejected, check that OP_MCP_ALLOWED_VAULTS includes the target vault name or ID
  5. Verify the service account has access to the relevant vaults
  6. Set MCP_LOG_LEVEL to debug for more detailed logs

Things to try

Once connected, you can ask your AI assistant things like:

  • List my 1Password vaults
  • Search the Automation vault for items with 'staging' in the title
  • Generate a 24-character password with symbols
  • Add the Automation and CI vaults to the op_run allow-list

Tools 15

vault_list read-only
List vaults the service account can access (id, name, description, type).
item_lookup read-only
Search a vault by title substring with optional limit (max 200).
item_list read-only
List every item in a vault (id, title, category, tags, updatedAt) — never secrets.
item_get read-only
Get full item details: title, category, tags, notes, fields. Concealed values stay hidden unless reveal: true. Accepts op:// references or vaultId + itemId.
password_read read-only
Read one field (default password) via op:// reference or ids. Metadata-only unless reveal: true; prefer op_run to use a secret.
op_check_ref read-only
Validate an op://vault/item/field reference and return non-secret metadata only (vault, item, field) — never the value.
password_create writes
Create a Login or Password item (username, URL, tags, notes) with returnSecret defaulting to false.
note_create writes
Create a Secure Note with optional tags and custom fields.
Show 7 more tools
password_update writes
Rotate a password or concealed field (creates the field if missing).
item_edit writes
Update title, notes (empty string clears), tags, URL; upsert or remove fields. Unreferenced fields stay untouched.
password_generate read-only
Generate a cryptographically secure random password (length 8–128; symbols/numbers/uppercase toggles).
password_generate_memorable read-only
Generate a memorable passphrase from a ~500-word list (word count, separator, number/symbol suffixes).
op_run writes
Run a local command (command or argv) with env vars; op:// values are resolved into the child process only and redacted from returned output.
item_archive writes
Move an item to the archive (hidden from normal views).
item_delete destructive
Permanently delete an item — cannot be undone.

Use cases

Have an AI assistant list and manage credentials in an automation vault
Inject secrets into local commands via op:// references without exposing plaintext
Bulk-rotate passwords for CI tokens or bot accounts
Audit a vault for duplicates or oddities without revealing secrets
Generate strong random passwords or memorable passphrases

Supported clients

Claude Desktop
Cursor
VS Code
Codex
GeminiPartial support

Listed from the project's documentation, not tested by this site.

Overview

A community-built (not official), Apache-2.0 licensed MCP server for 1Password that lets Claude, Cursor, VS Code Copilot, OpenAI Codex, and other MCP clients manage vaults and credentials via a 1Password Service Account. It ships 15 tools, 4 workflow prompts, and 3 browsable resources, with a security-first design that prefers op:// references and op_run secret injection so plaintext never has to land in the model transcript. Built on MCP TypeScript SDK v2 with 2026-07-28 protocol negotiation and legacy compatibility; requires Node.js 20+.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 9287e779c017 Data synced 2026-10-19 Read the FMRS scoring method