1password MCP Server

Most developer tooling work still happens through a UI a human drives. 1password MCP server moves it into the conversation instead. MCP server for 1Password service accounts.

The short version

Built on the MCP TypeScript SDK v2 with protocol negotiation for 2026-07-28 (and legacy clients). Secrets stay in 1Password; agents prefer op:// references and op_run so plaintext never has to land in the model transcript.

• Security-first defaults — — password_read and item_get return metadata unless you opt in with reveal: true
• op_run (the MCP equivalent of op run) — — inject op://vault/item/field into a local command’s environment; plaintext is redacted from stdout/stderr and never logged back to the model
• Full vault toolkit — — list, search, get, edit, create logins & notes, rotate passwords, archive, or delete
• Guided prompts — — password generation, credential rotation, vault audit, and secret-reference helpers
• Browsable resources — — vault and item catalogs over 1password://… URIs (no secrets in resource payloads)
• Modern MCP — — stdio transport, Zod 4 schemas, MCP 2026-07-28 negotiation with legacy client compatibility

The tools it exposes

The server publishes 1 tool. What each one is for:

• Discover — The Discover tool exposed by this server

Getting it running

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client. The configuration blocks on this page cover the common clients.

What it needs from you

Configuration is passed through the environment: OP_SERVICE_ACCOUNT_TOKEN, OP_KEYCHAIN_SERVICE, OP_KEYCHAIN_ACCOUNT, OP_MCP_ALLOWED_VAULTS, API_TOKEN, YOUR_SERVICE_ACCOUNT_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

You need two things: 1. Node.js 20 or newer 2. A 1Password Service Account with access to the vault(s) you want the AI to use

How it compares

Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. 1password's toolset — Discover — is a fair guide to whether it matches your workflow. It is maintained by CakeRepository; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against 1password's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.

Things to watch

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.