1password MCP Server
1Password vault management through a secure service account interface.
Data last scanned today · Reviewed today
Overview
1Password MCP Server provides an integration for AI assistants to manage vaults, credentials, and secure notes. By leveraging 1Password Service Accounts and the MCP TypeScript SDK, it allows users to perform CRUD operations on items and interact with secrets without exposing plaintext in the AI chat history. The server features advanced capabilities like op_run, which injects secrets into local command environments, and browsable resources using 1password:// URIs. It is designed to prioritize security by returning item metadata by default, requiring an explicit opt-in for secret retrieval.
Our verdict
This project carries a high risk level with a security score of 38/100. It is a community-maintained utility rather than an official 1Password product, which poses significant supply-chain and trust concerns. Notably, the current implementation lacks a read-only mode, granting full write access to your 1Password data upon installation. It is best suited for experienced developers who can independently audit the code and are comfortable with the inherent risks of connecting an LLM to their password manager.
- Supports modern MCP specifications with legacy client compatibility
- Uses op_run to prevent plaintext leakage into model transcripts
- Small dependency footprint with only three direct dependencies
- Includes fifteen distinct tools for granular vault management
- Lacks a read-only mode to restrict harmful AI actions
- Not an official product maintained by 1Password
- Has not yet undergone an independent editorial security review
Setup
{
"mcpServers": {
"1password-mcp": {
"args": [
"-y",
"@takescake/1password-mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| vault_list | List vaults the service account can access (id, name, description, type). | low |
| item_lookup | Search a vault by title substring; optional limit (max 200). | low |
| item_list | List every item in a vault (id, title, category, tags, updatedAt) — never secrets. | low |
| item_get | Full item: title, category, tags, notes, fields. Concealed values stay hidden unless reveal: true. Accepts op://… or vaultId + itemId. | low |
| password_read | Read one field (default password) via op://… or ids. Metadata-only unless reveal: true. Prefer op_run to use a secret. | low |
| op_check_ref | Validate op://vault/item/field and return non-secret metadata only (vault, item, field). Never the value. | low |
| password_create | Create a Login or Password item (username, URL, tags, notes). returnSecret defaults to false. | medium |
| note_create | Create a Secure Note with optional tags and custom fields. | medium |
| password_update | Rotate a password / concealed field (creates the field if missing). | medium |
| item_edit | Update title, notes (empty string clears), tags, URL; upsert or remove fields. Unreferenced fields stay untouched. | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What are the core requirements to run this MCP server?
You need Node.js 20 or higher installed on your machine and a 1Password Service Account token.
›How do I ensure secrets are not exposed in the AI chat logs?
Use the 'op_run' tool to inject secrets directly into a local command's environment, which ensures plaintext values are redacted from the model's output.
›Can I see secret values like passwords directly in the chat?
By default, tools like 'item_get' and 'password_read' return only metadata; you must explicitly set 'reveal: true' to see concealed values.
›Does this server support legacy MCP clients?
Yes, it is built with the MCP TypeScript SDK v2 and supports both the 2026-07-28 specification and legacy client compatibility.
›Can I permanently delete items using this server?
Yes, the 'item_delete' tool allows for permanent deletion, while 'item_archive' is available if you prefer to only hide items from view.
Badge
Maintain this server? Add the live badge to your README.