CakeRepository/1Password-MCP

Give your AI assistant a locked door to 1Password — not a pile of passwords in the chat.
@takescake/1password-mcp is a community Model Context Protocol (MCP) server. It lets Claude, Cursor, VS Code Copilot, OpenAI Codex, Gemini, and other MCP clients manage vaults and credentials through a 1Password Service Account.
Built on the MCP TypeScript SDK v2 with protocol negotiation for 2026-07-28 (and legacy clients). Secrets stay in 1Password; agents prefer op:// references and op_run so plaintext never has to land in the model transcript.
> Not an official 1Password product. Community-built, Apache 2.0 licensed.
## Who this is for
| You are… | You get… |
| Not deeply technical | A one-time setup: create a service account, paste the token into your AI app’s MCP settings, then ask in plain English (“list my automation vault”, “rotate the staging DB password”). |
| An agent / LLM | Fifteen typed tools, four workflow prompts, three browsable resources, and clear rules: prefer op_run + op:// over revealing secrets. |
| A developer / SRE | Full item CRUD, secure notes, password generation, vault allow-lists, Keychain token loading on macOS, and CI-friendly env config. |
## Why teams pick this server
Security-first defaults — password_read returns metadata, and item_get hides secret-bearing fields (passwords, SSH keys, OTP seeds, card numbers), unless you opt in with reveal: true.
op_run (the MCP equivalent of op run) — inject op://vault/item/field into a local command’s environment; resolved secrets are redacted from the returned stdout/stderr on a best-effort basis (including common encodings).
Full vault toolkit — list, search, get, edit, create logins & notes, rotate passwords, archive, or delete.
Guided prompts — password generation, credential rotation, vault audit, and secret-reference helpers.
Browsable resources — vault and item catalogs over onepassword://… URIs (no secrets in resource payloads).
Modern MCP — stdio transport, Zod 4 schemas, MCP 2026-07-28 negotiation with legacy client compatibility.
## What you get
### Tools (15)
Grouped the way agents and humans actually use them.
#### Discover
| Tool | What it does |
| vault_list | List vaults the service account can access (id, name, description, type), limited to the allow-list if one is set. |
| item_lookup | Search a vault by title substring; optional limit (max 200). |
| item_list | List every item in a vault (id, title, category, tags, updatedAt) — never secrets. |
#### Read (safe by default)
| Tool | What it does |
| item_get | Full item: title, category, tags, notes, fields. Secret-bearing values (passwords and other concealed fields, SSH private keys, OTP seeds, card numbers) stay hidden unless reveal: true; only known non-secret field types are shown. Notes are returned as-is. Accepts op://… or vaultId + itemId. |
| password_read | Read one field (default password) via op://… or ids. Metadata-only unless reveal: true. Prefer op_run to use a secret. |
| op_check_ref | Validate op://vault/item/field and return non-secret metadata only (vault, item, field). Never the value. |
#### Create & update
| Tool | What it does |
| password_create | Create a Login or Password item (username, URL, tags, notes). returnSecret defaults to false. |