1Password MCP

公式

1Password MCPサーバーは、CodexやKiroなどのMCPクライアントが、安全な認証プロンプトを使用して1Password環境を管理できるようにするブリッジを作成します。

1password.dev で表示

1Password MCPで何ができますか？

  • List environments — Ask your assistant to list all 1Password Environments in your account via list_environments.
  • Create or rename environments — Instruct your assistant to create a new Environment or rename an existing one using create_environment or rename_environment.
  • Manage variables — Have your assistant add or update variables in an Environment, or list variable names, via append_variables or list_variables.
  • Mount local .env files — Ask your assistant to create a locally mounted .env file for on-demand secret access, or list existing mounts, using create_local_env_file or list_local_env_files.

ドキュメント

1Password Environments MCP Server

Connect MCP clients to 1Password Environments with secure authorization prompts, without returning secrets to the agent.

The 1Password Environments MCP Server lets MCP clients such as Claude Code , Codex , Cursor , and Kiro securely manage your 1Password Environments. The server can only see variable and Environment names, and never returns the secrets stored in your Environments, which stay safe in 1Password.

You can use the MCP server to:

  • Create, list, and rename Environments.
  • List the names of variables stored in an Environment.
  • Add variables to an Environment.
  • Create locally mounted .env files that make your secrets available on demand without writing them to disk.
  • List locally mounted .env files.

Learn more about 1Password's approach to MCP servers.

How the 1Password Environments MCP Server works

The 1Password Environments MCP Server runs locally on your computer as part of the 1Password desktop app. When your MCP client connects to the server or uses a tool that requires per-Environment approval, the 1Password app shows a secure authorization prompt. If you approve, the client can use the approved tool with the Environment again without prompting you until 1Password locks.

By design, the server cannot return secret values stored in 1Password to the client, even if an agent requests them.

This walkthrough shows how to use the MCP server for Codex:

Requirements

Before you can use the MCP server, you'll need to:

Note

1Password Enterprise Password Manager admins can turn the MCP server feature on and off. To do so, sign in to your account on 1Password.com, then go to Policies > Agentic permissions and turn the Local MCP server option on or off as needed.

Step 1: Turn on access to the MCP server

In 1Password, go to Settings > Developer, then select Integrate with MCP clients.

Step 2: Configure your MCP client

Next, you’ll need to configure 1Password as a local MCP server within your MCP client.

To configure the 1Password MCP server, install the [1Password plugin for Claude Code](/environments/claude-plugin). The plugin registers the MCP configuration for you, along with a local `.env` file validation hook and an agent skill that gives Claude Code a full Environments setup workflow.

1. Open your terminal, go to your project directory, then enter `claude` to start a Claude Code session.

2. Add the 1Password marketplace:

   ```shell theme={null}
   /plugin marketplace add 1Password/1password-claude-plugin
   ```

3. Install the plugin:

   ```shell theme={null}
   /plugin install 1password@1password
   ```

4. Restart Claude Code, then enter `/mcp` to confirm the 1Password server is connected.

Learn more about [the 1Password plugin for Claude Code](/environments/claude-plugin).
> **Note** > > Codex currently supports Mac and Linux. 
To configure the 1Password Environments MCP Server for Codex:

1. In Codex, go to **MCP servers** and select **+ Add server**. Make sure the toggle is turned on.
2. In the **Command to launch** field, enter:

```
1password-mcp
```

Next, update your `AGENTS.md` file to instruct Codex to explicitly use the MCP server without needing to ask.

To do this, go to **Personalization** and fill in the **Custom instructions** field. For example, add the instruction:

"Always use the 1Password Environments MCP Server if you need to work with the 1Password developer environments without me having to explicitly ask."

To configure the 1Password Environments MCP Server, install the [1Password plugin for Cursor](/environments/cursor-plugin). The plugin registers the MCP configuration for you, along with a local `.env` file validation hook and an agent skill that gives Cursor Agent a full Environments setup workflow.

1. Open Cursor and navigate to the **Cursor Agents** window.
2. In the left sidebar, select **Customize**.
3. Select **Plugins** in the top menu.
4. Search for **1Password** then select **Add**.
5. Restart Cursor, then go to **Settings** > **Tools & MCP** to confirm the 1Password server is connected.

Learn more about [the 1Password plugin for Cursor](/environments/cursor-plugin).
> **Note** > > This feature is in beta. The Kiro plugin currently supports Mac and Linux. 
To configure the [1Password Environments MCP Server for Kiro](https://github.com/1Password/1password-kiro-plugin), you can either install the plugin from the Kiro Power Marketplace or from GitHub.

#### Option 1: Install from the Kiro Power Marketplace

1. Search for "1Password Developer Environments" at [kiro.dev/powers](https://kiro.dev/powers).
2. Select **Add to Kiro** to open the installation page in Kiro.
3. Select **+Install** to install the Power.
4. Select **Try power** to validate your Environment and get started.

#### Option 2: Install from GitHub

1. Select **Powers** in the Activity Bar, or open the Command Palette and search for **Powers: Focus on Installed view**.
2. Select **Add Custom Power**.
3. Select **Import Power from GitHub** from the menu options.
4. Paste the repository URL: `https://github.com/1Password/1password-kiro-plugin`
5. Select `1password-kiro-plugin` from the list of installed Powers.
6. From the `Power: 1Password Developer Environments` screen, select **Try power** to validate your Environment and get started.
To manually configure the 1Password Environments MCP Server with any MCP client that supports `stdio` transport, add the `1password-mcp` command to your MCP client's configuration file. 
If your client uses a JSON MCP config file:

```json theme={null}
{
  "mcpServers": {
    "1password": {
      "command": "1password-mcp"
    }
  }
}
```

If your client uses a TOML config file:

```toml theme={null}
[mcp_servers.1password]
command = "1password-mcp"
```

Then restart your client.

Step 3: Ask your client to manage an Environment

After you connect the MCP server, you can ask your client to perform tasks like:

  • "List my 1Password Environments"
  • "Create a local .env mount here"
  • "Show me the variable names in my project environment"
  • "Add a variable for my OpenAI API key"
  • "Create a new Environment called my-project"

Warning

Make sure to rotate any secrets you import into 1Password that were previously stored in plaintext in your codebase or .env files. Moving your project secrets to 1Password secures them going forward, but doesn’t mitigate any past exposure, such as in your Git history or your coding agent memory.

Available tools

The following tools are exposed to MCP clients. The first time a client calls a tool to interact with a specific Environment, 1Password may prompt you to approve.

ToolDescription
append_variablesAdd or update environment variables in a 1Password Environment. Make sure to rotate any secrets that were previously stored in plaintext in your codebase or .env files.
authenticateAuthenticate with the 1Password desktop app to access 1Password Environment tools.
create_environmentCreate a new 1Password Environment in a specified account. Make sure to rotate any secrets that were previously stored in plaintext in your codebase or .env files.
rename_environmentRename a 1Password Environment in a specified account.
create_local_env_fileCreate a locally mounted .env file for a 1Password Environment that makes your secrets available on demand without writing them to disk.
list_environmentsRead-only. List all 1Password Environments in a specified account.
list_variablesRead-only. Retrieve a list of environment variable names stored in a 1Password Environment.
list_local_env_filesRead-only. List all locally mounted .env files from a 1Password Environment. Local .env files currently only support Mac and Linux.

Learn more

Related topics