1Password MCP Server

Community

Give your AI assistant a locked door to 1Password — not a pile of passwords in the chat

★ 19 Stars Category · Dev Tools Popular

75FMRS · B

A mature, security-conscious community 1Password MCP server. The 15 tools cover the full credential lifecycle, and the default-safe path — op_run with op:// references plus metadata-only reads — effectively keeps plaintext out of model transcripts. Caveats: it is not an official 1Password product, and MCP transport is not end-to-end encrypted for secrets in flight, so it suits automation credentials rather than highly personal data. Recommended for developers and SREs working in dedicated automation vaults.

Reliability

12/20

Security and permissions

16/20

Maintenance

14/20

Documentation

18/20

Setup experience

15/20

Read the FMRS scoring method →

A community-built (not official), Apache-2.0 licensed MCP server for 1Password that lets Claude, Cursor, VS Code Copilot, OpenAI Codex, and other MCP clients manage vaults and credentials via a 1Password Service Account. It ships 15 tools, 4 workflow prompts, and 3 browsable resources, with a security-first design that prefers op:// references and op_run secret injection so plaintext never has to land in the model transcript. Built on MCP TypeScript SDK v2 with 2026-07-28 protocol negotiation and legacy compatibility; requires Node.js 20+.

Tools

vault_list

List vaults the service account can access (id, name, description, type).

item_lookup

Search a vault by title substring with optional limit (max 200).

item_list

List every item in a vault (id, title, category, tags, updatedAt) — never secrets.

item_get

Get full item details: title, category, tags, notes, fields. Concealed values stay hidden unless reveal: true. Accepts op:// references or vaultId + itemId.

password_read

Read one field (default password) via op:// reference or ids. Metadata-only unless reveal: true; prefer op_run to use a secret.

op_check_ref

Validate an op://vault/item/field reference and return non-secret metadata only (vault, item, field) — never the value.

password_create

Create a Login or Password item (username, URL, tags, notes) with returnSecret defaulting to false.

note_create

Create a Secure Note with optional tags and custom fields.

password_update

Rotate a password or concealed field (creates the field if missing).

item_edit

Update title, notes (empty string clears), tags, URL; upsert or remove fields. Unreferenced fields stay untouched.

password_generate

Generate a cryptographically secure random password (length 8–128; symbols/numbers/uppercase toggles).

password_generate_memorable

Generate a memorable passphrase from a ~500-word list (word count, separator, number/symbol suffixes).

op_run

Run a local command (command or argv) with env vars; op:// values are resolved into the child process only and redacted from returned output.

item_archive

Move an item to the archive (hidden from normal views).

item_delete

Permanently delete an item — cannot be undone.

Setup

Install Node.js 20 or newer. 2. In 1Password web, go to Developer → Service Accounts, create a service account scoped only to an automation vault, and copy the token. 3. Add to your MCP config: {"mcpServers":{"1password":{"command":"npx","args":["-y","@takescake/1password-mcp"],"env":{"OP_SERVICE_ACCOUNT_TOKEN":"YOUR_SERVICE_ACCOUNT_TOKEN"}}}}. 4. Restart the app and ask in plain English. On macOS, use OP_KEYCHAIN_SERVICE (plus optional OP_KEYCHAIN_ACCOUNT) to read the token from Keychain instead of the config file. Optionally set OP_MCP_ALLOWED_VAULTS to restrict which vaults op_run / op_check_ref may resolve.

claude_desktop_config.json

{"mcpServers":{"1password":{"command":"npx","args":["-y","@takescake/1password-mcp"],"env":{"OP_SERVICE_ACCOUNT_TOKEN":"YOUR_SERVICE_ACCOUNT_TOKEN"}}}}

Generate and validate client config

Fit and risk

Best for

Individuals and teams managing automation credentials like CI tokens and bot accounts
Security-conscious users who want to keep plaintext out of model transcripts
Developers and SREs using MCP clients such as Claude Desktop, Cursor, VS Code Copilot, or OpenAI Codex

Not for

Storing banking, primary personal logins, or recovery codes
Workflows where nothing may be sent to an AI provider
Scenarios requiring end-to-end encryption of secrets in transit
Users without a Node.js 20+ runtime

Required permissions

Requires a 1Password service account token (or a macOS Keychain token)
The service account must be granted access to target vaults
op_run can execute arbitrary local commands (with cwd, shell, timeout, stdin options)
item_delete permanently removes items with no undo

Risks and side effects

Anything revealed to the model may be sent to your AI provider and retained under their policies
Secrets are plaintext inside the MCP workflow — not end-to-end encrypted; encrypted only at rest in 1Password
The service account token is a master key and must be rotated immediately if leaked
item_delete is irreversible
op_run allows local command execution — pair with vault allow-lists and least-privilege scoping

Troubleshooting

Confirm Node.js 20 or newer is installed
Check that OP_SERVICE_ACCOUNT_TOKEN is set correctly and not expired
On macOS without a token env var, verify OP_KEYCHAIN_SERVICE (and optional OP_KEYCHAIN_ACCOUNT) are configured
If an op:// reference is rejected, check that OP_MCP_ALLOWED_VAULTS includes the target vault name or ID
Verify the service account has access to the relevant vaults
Set MCP_LOG_LEVEL to debug for more detailed logs

Use cases

Have an AI assistant list and manage credentials in an automation vault

Inject secrets into local commands via op:// references without exposing plaintext

Bulk-rotate passwords for CI tokens or bot accounts

Audit a vault for duplicates or oddities without revealing secrets

Generate strong random passwords or memorable passphrases

Supported clients

Claude DesktopFull support

CursorFull support

VS Code CopilotFull support

OpenAI CodexFull support

GeminiPartial support

Related MCP servers

Compare with other MCP servers