1Password Connect

1Password Connect

This connector talks to a 1Password Connect server, the self-hosted REST API (<your Connect address>/v1) that 1Password runs in your own infrastructure for Secrets Automation. Through it the AI can list vaults and items, read items and their files, create items, change them with JSON Patch and read the server's request log. It only reaches the shared vaults the Connect token was granted, never Personal or Private vaults.

The AI sees secret values: onepassword_connect_get_item returns an item's passwords, API keys, TOTP seeds and other concealed fields in plain text, and onepassword_connect_get_file_content returns attached files; onepassword_connect_create_item and onepassword_connect_update_item answer with the full item as well. These values go to the AI model and the chat. The list tools (onepassword_connect_list_vaults, onepassword_connect_list_items, onepassword_connect_list_files) and onepassword_connect_get_vault, onepassword_connect_get_file return metadata only. Grant the token only the vaults the AI should see, and switch off onepassword_connect_get_item and onepassword_connect_get_file_content if the AI should work with names only. Never repeat a secret in an answer unless the user asked for it.

Setup (about 15 minutes, needs a deployed Connect server)

1. On 1Password.com open Developer, Directory, select Other under Infrastructure Secrets Management and Create a Connect server (or run op connect server create <name> --vaults <vault>). Save the 1password-credentials.json and the first access token in 1Password. Connect only reaches shared vaults granted to it.
2. Deploy the server (the connect-api and connect-sync containers from https://github.com/1Password/connect, Docker Compose, Kubernetes or the Helm chart). By default it listens on port 8080.
3. Use the first token, or issue one for the AI: Developer, Connect servers, choose the server, New Token (or op connect token create <name> --server <server> --vault <vault>). Grant only the vaults the AI should see; a token's vaults cannot be changed later, so revoke it and issue a new one instead. An expiry of 30, 90 or 180 days can be set.
4. Set ONEPASSWORD_CONNECT_URL to the server's address as AnythingMCP reaches it, without /v1 (e.g. https://op-connect.example.com), and paste the token into ONEPASSWORD_CONNECT_TOKEN.
5. Install; onepassword_connect_list_vaults checks the token. On AnythingMCP Cloud the Connect server needs a public HTTPS address. A self-hosted AnythingMCP can reach a server on a private network or IP only once that host is allowed through SSRF_ALLOWED_HOSTS, because the outbound guard blocks private address space by default.

Workflow

• Find a secret: onepassword_connect_list_vaults (filter name eq "Production"), then onepassword_connect_list_items (filter title eq "Stripe API" or tag eq "prod"), then onepassword_connect_get_item only if the value itself is needed. onepassword_connect_get_vault shows one vault's details.
• Files: onepassword_connect_list_files or onepassword_connect_get_file for names and sizes, onepassword_connect_get_file_content to download one.
• Store a new secret: onepassword_connect_create_item with a category, title and fields; set generate: true and a recipe on a field to let 1Password create a random password.
• Rotate or edit: onepassword_connect_update_item with JSON Patch, e.g. [{"op": "replace", "path": "/fields/<field id>/value", "value": "..."}]. Read the field ids with onepassword_connect_get_item first. {"op": "replace", "path": "/", "value": {...}} replaces the whole item.
• Who used the server: onepassword_connect_list_activity (READ, CREATE, UPDATE, DELETE with SUCCESS or DENY, per token and item). onepassword_connect_get_health shows whether the server and its sync service are healthy.
• Switched off at install: onepassword_connect_delete_item; it cannot be undone, so an admin switches it on when the team needs it.

Reading the answers: vault and item ids are 26 lower-case letters and digits. A field has id, label, type (STRING, CONCEALED, EMAIL, URL, TOTP, DATE, MONTH_YEAR, MENU), purpose (USERNAME, PASSWORD, NOTES), value and section; password fields also carry entropy. Dates are ISO 8601. Lists return the whole collection in one answer; only onepassword_connect_list_activity pages with limit and offset and reports the total in the content-range header (1-50/1134).

Errors: 401 means a wrong or revoked token; 403 vault ... is not in scope means the token was not granted that vault, or may not write to it; 404 means the vault, item or file does not exist; 400 on a write names the invalid field or category; 413 means a file is too large to return. Connection errors usually mean ONEPASSWORD_CONNECT_URL is not reachable from AnythingMCP; onepassword_connect_get_health and the server logs tell more.