1password MCP Server

MCP server for 1Password service accounts

Local serverstdioTypeScript

What is the 1password MCP Server?

MCP server for 1Password service accounts

The short version

Built on the MCP TypeScript SDK v2 with protocol negotiation for 2026-07-28 (and legacy clients). Secrets stay in 1Password; agents prefer op:// references and op_run so plaintext never has to land in the model transcript.

  • Security-first defaults — — password_read and item_get return metadata unless you opt in with reveal: true
  • op_run (the MCP equivalent of op run) — — inject op://vault/item/field into a local command’s environment; plaintext is redacted from stdout/stderr and never logged back to the model
  • Full vault toolkit — — list, search, get, edit, create logins & notes, rotate passwords, archive, or delete
  • Guided prompts — — password generation, credential rotation, vault audit, and secret-reference helpers
  • Browsable resources — — vault and item catalogs over 1password://… URIs (no secrets in resource payloads)
  • Modern MCP — — stdio transport, Zod 4 schemas, MCP the publisher’s release record negotiation with legacy client compatibility

What it needs from you

You need two things: 1. Node.js 20 or newer 2. A 1Password Service Account with access to the vault(s) you want the AI to use

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

How to install the 1password MCP Server

{
  "mcpServers": {
    "1password": {
      "command": "npx",
      "args": ["-y", "@takescake/1password-mcp"],
      "env": {
        "OP_SERVICE_ACCOUNT_TOKEN": "YOUR_SERVICE_ACCOUNT_TOKEN"
      }
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

You need two things: 1. Node.js 20 or newer 2. A 1Password Service Account with access to the vault(s) you want the AI to use

VariableDescriptionRequired
OP_SERVICE_ACCOUNT_TOKENCredential the server authenticates with.Yes
OP_KEYCHAIN_SERVICECredential the server authenticates with.Yes
OP_KEYCHAIN_ACCOUNTCredential the server authenticates with.Yes
OP_MCP_ALLOWED_VAULTSConfiguration value read at startup.Optional
API_TOKENCredential the server authenticates with.Yes

Example prompts to try

  • “Use 1password to Discover.”

Frequently asked questions

MCP server for 1Password service accounts Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.