Onepassword Agent MCP

1Password Agent MCP

Let AI agents use and save 1Password secrets through a local MCP server, with a dashboard that puts you in control.

• Use approved secrets: agents receive encrypted handles. The server resolves and copies or pastes the selected field locally, without returning its plaintext to the agent.
• Save copied secrets: copy a password or API key in your browser or a local app, then let the server save it to 1Password with metadata-only tool arguments.
• Work unattended: opt into automatic approval for new items and connect a scoped 1Password service account to avoid repeated desktop unlock prompts.

npm package · setup guide · user guide · security model · uninstall guide

Independent project. Not affiliated with or endorsed by 1Password. Every installation uses its own local settings and 1Password account.

*The current dashboard, rendered with synthetic example items. All screenshots in this README use demo data; no real account, password, or service-account token is shown. Open full-size Vault screenshot.*

Quick Start

You need Node.js 20+, the 1Password CLI (`op`), and an MCP client that supports local stdio servers. Authenticate using 1Password desktop integration or a scoped service account.

On macOS, install the prerequisites if needed:

brew install node 1password-cli

For desktop authorization, open 1Password → Settings → Developer and enable Integrate with 1Password CLI. Approve only clients you trust. Service-account setup is described under Unattended Access.

Install and run the guided installer:

npm install -g onepassword-agent-mcp

onepassword-agent-mcp install

The installer detects supported MCP clients and asks before updating their configuration. On macOS, it separately offers the optional visible menu-bar shortcut.

Start the dashboard:

onepassword-agent-mcp admin

Open http://127.0.0.1:7319. For a manual setup, use onepassword-agent-mcp doctor, then onepassword-agent-mcp setup all --apply.

Updating an existing installation? Run npm install -g onepassword-agent-mcp@latest, then restart the admin console and existing MCP clients so they use the new code. Your local settings, approvals, and encryption key are retained.

Your Dashboard

The sidebar separates the four everyday tasks:

Give An Agent Its First Credential

1. Open Vault. Under Agent Vault Setup, choose Create MCPVAULT if the dedicated vault does not exist.
2. In Choose From 1Password, select a Source vault, search for an item, and click Copy. You can also drag it into Approve Agent Items and choose Copy or Move.
3. In Approve Agent Items, click Review Details. Choose the exact fields to allow and enter the websites where agents may use them.
4. Click Approve Selected. The approved fields appear in Allowed For Agents; use its Enabled switch, Save, and Delete controls to manage access.
5. In your MCP client, ask the agent to find the approved credential for the current website and paste it into the intended field.

Copy keeps the source item. Move removes it from the source vault after transfer. Copying an item into the agent vault does not approve it. An empty website list allows all websites, so add a domain when access should be limited.

The type filters—All Fields, Logins, API Keys, Credit Cards, Notes & SSH, and Other—make larger vaults easier to review. Sensitive fields such as card CVV and PIN are not suggested automatically during manual approval.

To transfer a newly saved credential back to another vault, open Review Details → Save this item to another vault. Copy To Vault keeps the agent-vault item; Move To Vault removes it from the agent vault and removes its local approvals. Use the 1Password app for items containing attachments, documents, or passkeys.

Choose How Much Agents May Do

Open Permissions, choose the settings you want, then click Save Settings. All three options below are off on a fresh installation.

*Demo configuration with the three opt-in permissions enabled and simulated saved service-account status. The token field is empty; the saved token is never displayed. Open full-size Permissions screenshot.*

View the responsive dashboard

*The same local dashboard at a narrow viewport. This screenshot does not imply remote access; the server binds to loopback by default.*

The Profile view is separate: values entered there are intentionally readable by agents through get_profile_data. Do not store passwords or tokens as profile values.

Save From The Browser Or Selected Text

In Permissions, enable Allow agents to save new items into MCPVAULT and Save secrets from the clipboard, then click Save Settings. Optionally enable automatic approval if agents should be able to use new items immediately.

1. In a browser, click the secret's Copy button, or select text in a local app and use Copy. The agent should perform that action without reading the field, clipboard, DOM value, or a screenshot that reveals it.
2. Call the local tool with metadata only:

{

"title": "Example account", "requestId": "example-signup-unique-id", "category": "login", "url": "https://example.com", "username": "my-login" }

Use those arguments with save_secret_from_clipboard. Supported categories are login, password, api_credential, and secure_note. Text is preserved exactly, including spaces and newlines. The tool runs on the computer hosting this MCP server and reads that computer's clipboard; a remote browser's clipboard is a different clipboard.

The app encrypts a retry snapshot locally, usable for 15 minutes, passes plaintext only through the local CLI's stdin, and verifies the stored item. The response contains save and approval metadata, never the copied text; use the find/list tools for approved encrypted handles. Expired ciphertext is removed while the process runs or on the next capture after downtime; a metadata-only record prevents reusing an old request ID. Clipboard clearing rechecks that the value has not changed and is best effort; check the returned cleanup status. Clipboard managers may retain their own history.

Reuse the same requestId and metadata to retry. A retry uses the original encrypted capture even if the clipboard changes. An expired capture fails closed instead of capturing unrelated text; inspect the previous operation before intentionally starting a new request. Metadata such as titles, usernames, and URLs remains visible to the model: never put a secret in those fields. save_secret_item remains available for values already in context; it cannot undo that exposure.

Automatic Approval

Under Permissions, enable Automatically approve items agents create, then click Save Settings. This option defaults to off. Agent item creation must also be enabled.

When enabled, a verified save through save_secret_item or save_secret_from_clipboard automatically approves every supported field of the new item in the configured agent vault, including credit-card CVV and PIN. The agent can use the resulting encrypted handles immediately. Existing items and items copied or moved in through the admin console still need manual approval.

CLI controls, site scoping, and retry behavior

The CLI controls the same saved option:

onepassword-agent-mcp settings auto-approve on

onepassword-agent-mcp settings auto-approve off onepassword-agent-mcp settings --json

Changes apply to subsequent new saves without restarting the MCP server. Add --dry-run to preview a change. Turning the option off keeps existing approvals; disable or delete individual approvals in Allowed For Agents to revoke them. The automatic approval choice is recorded when each save starts. Retrying an older save or a save that opted out does not opt it into automatic approval, and retries do not reinstate revoked approvals.

Automatic approvals use allowedSites when provided, otherwise the saved item's website. An empty list or an item without a website allows all sites. approveForAgents: false skips approval for that save. With automatic approval off, approveForAgents: true retains the existing single-field approval behavior, using approveField when supplied and allowing all sites unless allowedSites is provided. With automatic approval on, approveField does not narrow the set of approved fields.

Unattended Access

The Permissions → Unattended access card accepts a 1Password service-account token directly in the local dashboard. Create the token in 1Password's service-account settings with access only to your dedicated agent vault. Grant read_items, plus write_items for saves. In the dashboard, paste it into Service account token and click Save encrypted token. The input clears immediately. Do not send the token in chat.

The app encrypts the token locally in ~/.onepassword-mcp/access.json, never returns it to the dashboard or MCP client, and supplies it only to the CLI process environment. Changes apply to later CLI calls without restarting. Test connection checks vault visibility; it does not write a test item or certify write permissions. Turn off Use saved service account to switch back to desktop authentication, or choose Remove saved token to delete the local credential. Revoke the token in 1Password if you want to invalidate it everywhere. In-flight operations may finish after a toggle.

An externally configured OP_SERVICE_ACCOUNT_TOKEN takes precedence; the dashboard reports that mode, and removing a local token cannot disable the environmen