1Password Environments MCP Server

The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environments. The server can only see the names of your secrets and Environments, and never returns the actual secret values stored in your Environments, which stay safe in 1Password. You can use the MCP server to:

Create, list, and rename Environments.
List the names of secrets stored in an Environment.
Add secrets to an Environment.
Create locally mounted .env files that make your secrets available on demand without writing them to disk.
List locally mounted .env files.

Learn more about 1Password’s approach to MCP servers.

How the 1Password Environments MCP Server works

The 1Password Environments MCP Server runs locally on your computer as part of the 1Password desktop app. When your MCP client connects to the server or uses a tool that requires per-Environment approval, the 1Password app shows a secure authorization prompt. If you approve, the client can use the approved tool with the Environment again without prompting you until 1Password locks. By design, the server cannot return secret values stored in 1Password to the client, even if an agent requests them. This walkthrough shows how to use the MCP server for Codex:

Requirements

Before you can use the MCP server, you’ll need to:

Sign up for 1Password.
Install the 1Password desktop app.
Create a 1Password Environment.
Have an MCP client that supports stdio transport. Remote-only MCP clients aren’t currently supported.

1Password Enterprise Password Manager admins can turn the MCP server feature on and off. To do so, sign in to your account on 1Password.com, then go to Policies > Agentic permissions and turn the Local MCP server option on or off as needed.

Step 1: Turn on access to the MCP server

In 1Password, go to Settings > Developer, then select Integrate with MCP clients.

Step 2: Configure your MCP client

Next, you’ll need to configure 1Password as a local MCP server within your MCP client.

Claude Code
Codex
Cursor
Kiro
Other

To configure the 1Password MCP server, install the 1Password plugin for Claude Code. The plugin registers the MCP configuration for you, along with an agent skill that gives Claude Code a full Environments setup workflow.

Open your terminal, go to your project directory, then enter claude to start a Claude Code session.

Add the 1Password marketplace:

/plugin marketplace add 1Password/1password-claude-plugin

Install the plugin:
/plugin install 1password@1password
Restart Claude Code, then enter /mcp to confirm the 1Password server is connected.

Learn more about the 1Password plugin for Claude Code.

Codex currently supports Mac and Linux.

To configure the 1Password Environments MCP Server for Codex:

In Codex, go to MCP servers and select + Add server. Make sure the toggle is turned on.
In the Command to launch field, enter:

1password-mcp

Next, update your AGENTS.md file to instruct Codex to explicitly use the MCP server without needing to ask.To do this, go to Personalization and fill in the Custom instructions field. For example, add the instruction:“Always use the 1Password Environments MCP Server if you need to work with the 1Password developer environments without me having to explicitly ask.”

To configure the 1Password Environments MCP Server, install the 1Password plugin for Cursor. The plugin registers the MCP configuration for you, along with a local .env file validation hook and an agent skill that gives Cursor Agent a full Environments setup workflow.

Open Cursor and navigate to the Cursor Agents window.
In the left sidebar, select Customize.
Select Plugins in the top menu.
Search for 1Password then select Add.
Restart Cursor, then go to Settings > Tools & MCP to confirm the 1Password server is connected.

Learn more about the 1Password plugin for Cursor.

This feature is in beta. The Kiro plugin currently supports Mac and Linux.

To configure the 1Password Environments MCP Server for Kiro, you can either install the plugin from the Kiro Power Marketplace or from GitHub.

Option 1: Install from the Kiro Power Marketplace

Search for “1Password Developer Environments” at kiro.dev/powers.
Select Add to Kiro to open the installation page in Kiro.
Select +Install to install the Power.
Select Try power to validate your Environment and get started.

Option 2: Install from GitHub

Select Powers in the Activity Bar, or open the Command Palette and search for Powers: Focus on Installed view.
Select Add Custom Power.
Select Import Power from GitHub from the menu options.
Paste the repository URL: https://github.com/1Password/1password-kiro-plugin
Select 1password-kiro-plugin from the list of installed Powers.
From the Power: 1Password Developer Environments screen, select Try power to validate your Environment and get started.

To manually configure the 1Password Environments MCP Server with any MCP client that supports stdio transport, add the 1password-mcp command to your MCP client’s configuration file.If your client uses a JSON MCP config file:

{
  "mcpServers": {
    "1password": {
      "command": "1password-mcp"
    }
  }
}

If your client uses a TOML config file:

[mcp_servers.1password]
command = "1password-mcp"

If you use OpenCode, add the server to the mcp section of your opencode.json config file:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "1password": {
      "type": "local",
      "command": ["1password-mcp"],
      "enabled": true
    }
  }
}

Then restart your client.

Step 3: Ask your client to manage an Environment

After you connect the MCP server, you can ask your client to perform tasks like:

“List my 1Password Environments”
“Create a local .env mount here”
“Show me the secret names in my project environment”
“Add a secret for my OpenAI API key”
“Create a new Environment called my-project”

Make sure to rotate any secrets you import into 1Password that were previously stored in plaintext in your codebase or .env files. Moving your project secrets to 1Password secures them going forward, but doesn’t mitigate any past exposure, such as in your Git history or your coding agent memory.

Available tools

The following tools are exposed to MCP clients. The first time a client calls a tool to interact with a specific Environment, 1Password may prompt you to approve.

Tool	Description
`append_secrets`	Add or update secrets in a 1Password Environment. Make sure to rotate any secrets that were previously stored in plaintext in your codebase or .env files.
`authenticate`	Authenticate with the 1Password desktop app to access 1Password Environment tools.
`create_environment`	Create a new 1Password Environment in a specified account. Make sure to rotate any secrets that were previously stored in plaintext in your codebase or .env files.
`rename_environment`	Rename a 1Password Environment in a specified account.
`create_local_env_file`	Create a locally mounted `.env` file for a 1Password Environment that makes your secrets available on demand without writing them to disk.
`list_environments`	Read-only. List all 1Password Environments in a specified account.
`list_secrets`	Read-only. Retrieve a list of secret names stored in a 1Password Environment.
`list_local_env_files`	Read-only. List all locally mounted `.env` files from a 1Password Environment. Local .env files currently only support Mac and Linux.

Troubleshooting

If your MCP client can’t connect on macOS 27 Golden Gate

If you updated to macOS 27 Golden Gate and your MCP client shows MCP error -32000: Connection closed, or the MCP server log shows Failed to start logger: Log cannot be written, even though you’ve turned on “Integrate with MCP clients”, macOS may be blocking your MCP client from accessing data from the 1Password app. To allow access:

Open System Settings > Privacy & Security > Files & Folders.
Select your MCP client app, like Claude, Cursor, or Codex.
Turn on the setting that starts with “Data shared by 1Password”. The rest of the name depends on which 1Password apps you’ve installed.
Quit and reopen your MCP client app, then try again.

If you use more than one MCP client, turn on the setting for each one.

​How the 1Password Environments MCP Server works

​Requirements

​Step 1: Turn on access to the MCP server

​Step 2: Configure your MCP client

​Option 1: Install from the Kiro Power Marketplace

​Option 2: Install from GitHub

​Step 3: Ask your client to manage an Environment

​Available tools

​Troubleshooting

​If your MCP client can’t connect on macOS 27 Golden Gate

​Learn more

How the 1Password Environments MCP Server works

Requirements

Step 1: Turn on access to the MCP server

Step 2: Configure your MCP client

Option 1: Install from the Kiro Power Marketplace

Option 2: Install from GitHub

Step 3: Ask your client to manage an Environment

Available tools

Troubleshooting

If your MCP client can’t connect on macOS 27 Golden Gate

Learn more