1password MCP Server

MCP server for 1Password service accounts

The short version

Built on the MCP TypeScript SDK v2 with protocol negotiation for 2026-07-28 (and legacy clients). Secrets stay in 1Password; agents prefer op:// references and op_run so plaintext never has to land in the model transcript.

• Security-first defaults — — password_read and item_get return metadata unless you opt in with reveal: true
• op_run (the MCP equivalent of op run) — — inject op://vault/item/field into a local command’s environment; plaintext is redacted from stdout/stderr and never logged back to the model
• Full vault toolkit — — list, search, get, edit, create logins & notes, rotate passwords, archive, or delete
• Guided prompts — — password generation, credential rotation, vault audit, and secret-reference helpers
• Browsable resources — — vault and item catalogs over 1password://… URIs (no secrets in resource payloads)
• Modern MCP — — stdio transport, Zod 4 schemas, MCP the publisher’s release record negotiation with legacy client compatibility

The tools it exposes

The server publishes 1 tool. What each one is for:

• Discover — The Discover tool exposed by this server

Getting it running

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client. The configuration blocks on this page cover the common clients.

What it needs from you

Configuration is passed through the environment: OP_SERVICE_ACCOUNT_TOKEN, OP_KEYCHAIN_SERVICE, OP_KEYCHAIN_ACCOUNT, OP_MCP_ALLOWED_VAULTS, API_TOKEN, YOUR_SERVICE_ACCOUNT_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

You need two things: 1. Node.js 20 or newer 2. A 1Password Service Account with access to the vault(s) you want the AI to use

How it compares

Things to watch

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.