1Password MCP Server MCP Server

About

## 1Password MCP Server: Enterprise Password Management Integration The **1Password MCP Server** brings enterprise-grade password management directly into Google Antigravity, enabling developers to securely access credentials, manage secrets, and automate authentication workflows without exposing sensitive data in code. ### Why 1Password MCP? - **Secure secret access** - Retrieve credentials without hardcoding them in source files - **Vault management** - Organize and access secrets across team vaults - **Service accounts** - Automated credential retrieval for CI/CD pipelines - **Audit logging** - Track all credential access for security compliance - **Item operations** - Create, update, and manage password entries programmatically ### Key Features #### 1. Secure Credential Retrieval ```python # Access credentials securely without hardcoding db_creds = await mcp.call("1password", "get_item", { "vault": "Engineering", "item": "Production Database", "fields": ["username", "password", "host", "port"] }) # Connect to database with retrieved credentials connection = await connect_database( host=db_creds["host"], user=db_creds["username"], password=db_creds["password"], port=int(db_creds["port"]) ) ``` #### 2. Vault Management ```python # List available vaults for the service account vaults = await mcp.call("1password", "list_vaults", { "include_shared": True }) # Get all API keys from a specific vault api_keys = await mcp.call("1password", "list_items", { "vault": "API Keys", "categories": ["API_CREDENTIAL"], "tags": ["production"] }) for key in api_keys: print(f"{key[\"title\"]}: Last modified {key[\"updated_at\"]}") ``` #### 3. Secret Rotation ```python # Generate and update API key new_api_key = await mcp.call("1password", "generate_password", { "length": 64, "symbols": False, "recipe": "letters,digits" }) # Update the item with new key await mcp.call("1password", "update_item", { "vault": "Production", "item": "Stripe API Key", "fields": { "credential": new_api_key, "rotation_date": "2024-04-01" } }) # Deploy new key to service await deploy_api_key(new_api_key) ``` #### 4. SSH Key Management ```python # Retrieve SSH key for deployment ssh_key = await mcp.call("1password", "get_item", { "vault": "DevOps", "item": "Production SSH Key", "fields": ["private_key", "public_key"] }) # Use for secure server access await mcp.call("ssh", "connect", { "host": "prod-server.example.com", "private_key": ssh_key["private_key"], "user": "deploy" }) ``` ### Configuration ```json { "mcpServers": { "1password": { "command": "npx", "args": ["-y", "@anthropic/mcp-1password"], "env": { "OP_SERVICE_ACCOUNT_TOKEN": "ops_xxx", "OP_CONNECT_HOST": "https://connect.1password.com", "OP_CONNECT_TOKEN": "eyJxxx" } } } } ``` ### Use Cases **CI/CD Integration**: Inject secrets into build pipelines without storing credentials in repository or environment variables. **Database Connections**: Securely connect to databases with credentials fetched at runtime, supporting automatic rotation. **API Key Management**: Centralize API keys with automatic retrieval, reducing secret sprawl across configuration files. **Team Onboarding**: Grant new developers access to required credentials through vault permissions without sharing passwords directly. The 1Password MCP Server transforms credential management from a security risk into a secure, auditable workflow.

Installation

{
  "mcpServers": {
    "1password": {
      "mcpServers": {
        "1password": {
          "env": {
            "OP_SERVICE_ACCOUNT_TOKEN": "YOUR_SERVICE_ACCOUNT_TOKEN"
          },
          "args": [
            "-y",
            "@dkvdm/onepassword-mcp-server"
          ],
          "command": "npx"
        }
      }
    }
  }
}

How to Use

1. 1Create service account in 1Password
2. 2Create AI vault for credentials
3. 3Never exposes secrets in prompts