1Password Connect to MCP: Vaults, Items, Secrets and Files in any AI Agent

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → 1Password Connect, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

1Password Connect

Vaults and items of 1Password through your self-hosted 1Password Connect server: list vaults and items, read items with their secret values and attached files, create items with generated passwords, update them with JSON Patch, and read the server's request log. Delete is switched off at install.

Setup

Setting up takes about 15 minutes and needs a deployed 1Password Connect server, the self-hosted REST API that 1Password runs in your own infrastructure for Secrets Automation.

1. On 1Password.com open Developer, Directory, select Other under Infrastructure Secrets Management and Create a Connect server (or run op connect server create <name> --vaults <vault>). Save the 1password-credentials.json file and the first access token in 1Password. Connect only reaches the shared vaults granted to it, never Personal or Private vaults.
2. Deploy the server: the connect-api and connect-sync containers from https://github.com/1Password/connect, with Docker Compose, Kubernetes or the Helm chart. By default it listens on port 8080.
3. Use the first token, or issue one just for the AI: Developer, Connect servers, choose the server, New Token (or op connect token create <name> --server <server> --vault <vault>). Grant only the vaults the AI should see. A token's vaults cannot be changed later; revoke it and issue a new one instead. An expiry of 30, 90 or 180 days can be set.
4. Set ONEPASSWORD_CONNECT_URL to the server's address as AnythingMCP reaches it, without /v1 and without a trailing slash (for example https://op-connect.example.com or http://10.0.0.5:8080), and paste the token (a JWT starting with eyJ, without Bearer) into ONEPASSWORD_CONNECT_TOKEN.
5. Install the connector and run onepassword_connect_list_vaults: it confirms the token and lists the vaults it can reach.

Where the Connect server runs: on AnythingMCP Cloud the Connect server needs a public HTTPS address. A self-hosted AnythingMCP reaches a server on a private network or IP only once that host is allowed through SSRF_ALLOWED_HOSTS, because the outbound guard blocks private address space by default.

The AI sees secret values. These tools return secrets in plain text:

• onepassword_connect_get_item: the item's passwords, API keys, TOTP seeds, notes and other concealed fields, in fields[].value.
• onepassword_connect_get_file_content: the content of an attached file (certificates, key files, documents), up to 4 MB.
• onepassword_connect_create_item and onepassword_connect_update_item: they answer with the full item, secret values and any generated password included.

These values go to the AI model and into the chat. The list tools (onepassword_connect_list_vaults, onepassword_connect_list_items, onepassword_connect_list_files), onepassword_connect_get_vault and onepassword_connect_get_file return metadata only. Grant the token only the vaults the AI should see, and have a workspace admin switch off onepassword_connect_get_item and onepassword_connect_get_file_content if the AI should work with names only. The AI does not repeat a secret in an answer unless you ask for it.

Finding a secret: onepassword_connect_list_vaults (filter such as name eq "Production"), then onepassword_connect_list_items with title, category, tags, URLs, version and dates (filter title eq "Stripe API" or tag eq "prod"), then onepassword_connect_get_item only when the value itself is needed. Files: onepassword_connect_list_files or onepassword_connect_get_file for names and sizes, onepassword_connect_get_file_content to download one.

What it writes: onepassword_connect_create_item with a category, a title and fields; a field with generate: true and a recipe gets a random value from 1Password. onepassword_connect_update_item changes part of an item with JSON Patch (RFC 6902: add, remove, replace) on /title, /favorite, /tags, /urls, /fields (to add a field), /fields/<field id> or /fields/<field id>/value; the path / replaces the whole item. The AI reads the field ids with onepassword_connect_get_item first. 1Password keeps the previous version in the item's history.

Server checks: onepassword_connect_list_activity lists the requests the server handled, newest first: READ, CREATE, UPDATE or DELETE with SUCCESS or DENY, per token and item. onepassword_connect_get_health shows whether the server, its sync service and the account connection are healthy, which tells a server problem from a token problem.

Switched off at install: onepassword_connect_delete_item. It cannot be undone, and applications that read the secret through Connect stop finding it at once, so a workspace admin turns it on when the team needs it.

Data formats: vault and item ids are 26 lower-case letters and digits. A field has id, label, type (STRING, CONCEALED, EMAIL, URL, TOTP, DATE, MONTH_YEAR, MENU), purpose (USERNAME, PASSWORD, NOTES), value and section; password fields also carry entropy. Dates are ISO 8601.

Paging: lists return the whole collection in one answer. Only onepassword_connect_list_activity pages, with limit (default 50) and offset, and reports the total in the content-range header (1-50/1134).

Common errors: 401 means a wrong or revoked token, or one issued for another Connect server. 403 vault ... is not in scope means the token was not granted that vault or may not write to it. 404 means the vault, item or file does not exist; 404 on every call means ONEPASSWORD_CONNECT_URL is not the Connect API address. 400 on a write names the invalid field or category. 413 means a file is too large to return. Connection errors usually mean AnythingMCP cannot reach ONEPASSWORD_CONNECT_URL; onepassword_connect_get_health and the server logs tell more.

The connector does not reach Personal or Private vaults or vaults the token was not granted, does not delete items with the tools switched on at install, does not create Connect servers or tokens, and does not read the account's sign-in and audit events (that is the 1Password Events connector).

Prerequisites: ONEPASSWORD_CONNECT_URL, ONEPASSWORD_CONNECT_TOKEN

Install the connector locally

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Open http://localhost:3000/connectors/store, pick 1Password Connect and paste in the env vars listed under Prerequisites.

Available tools

Example prompts

• "Which vaults can the AI reach, and how many items are in each?"
• "Find the Stripe API item in the Production vault and tell me when it was last changed, without showing the key."
• "Create a Login item for the staging database in the DevOps vault with username app and a generated password."
• "Add the tag rotated to the Mail relay item in the Infrastructure vault."
• "Which tokens read items through Connect today, and were any requests denied?"

Next steps

• Connect to Claude
• Connect to ChatGPT