← MCP

1Password Environments MCP Server1Password Environments MCP Server

1Password

MCPMCP 凭据管理Credential management 密钥Secrets 本地stdioLocal stdio 授权弹窗Authorization prompts 安全边界Security boundary betabeta partial lifecycle: active 核验Checked 2026-10-31

1Password 官方 Environments MCP server（本地 stdio，随桌面应用）：凭据类 MCP 的安全边界判例—— agent 能建环境、列变量名、加变量、挂本机 .env，但 by design 密钥值永不回传给 agent；敏感操作按 Environment 粒度弹桌面授权窗，企业可策略级开关。beta 阶段；配套插件仓（Claude/Codex/Kiro）活跃（推送 2026-10-29）。与社区「读 secret 值」那批 1Password MCP 是本质不同的两回事。

1Password official Environments MCP server (local stdio, rides the desktop app): the security-boundary precedent for credential-class MCPs — the agent can create environments, list variable names, add variables, mount local .env files, but by design secret values are never returned to the agent; sensitive operations pop a desktop authorization window per Environment, and enterprises can toggle it by policy. Beta stage; the companion plugin repos (Claude/Codex/Kiro) are active (pushed 2026-10-29). It is an entirely different thing from the community "read a secret value" 1Password MCPs.

适合与不适合When to use it, when not to

适合：让编码 agent 管开发密钥的环境侧（建/加/挂）而永远不接触明文；企业治理场景。不适合：要 agent 运行时读密钥值；remote-only MCP 客户端；不用 1Password 生态。

Fits: coding agents managing the environment side of dev secrets (create/add/mount) while never touching plaintext; enterprise-governed scenarios. Not a fit: agents reading secret values at runtime; remote-only MCP clients; outside the 1Password ecosystem.

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-10-31

出品属地Origin: 国外出品foreign-made　1Password（加拿大，独立密码管理厂商；官方站点自述品牌）。1Password (Canada, independent password-manager vendor; per its own official site).
国内使用Direct access: 大陆可直连direct OK　developer.1password.com 直连 200（301→www.1password.dev 同页 200）；1password.com 直连 200；GitHub 官方仓直连可达（2026-10-31）。developer.1password.com returned 200 direct (301 to www.1password.dev, same page 200); 1password.com returned 200 direct; the official GitHub repos were reachable direct (2026-10-31).
备案状态CAC filing: 未见于备案名单not in filing list：未见于网信办公示名单（2026-10-31 检索）；该产品未面向大陆公众提供服务，备案不适用。not in the CAC public registry (searched 2026-10-31); the product does not serve the mainland public, so filing does not apply.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

11 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 它自己不调模型——被 MCP 客户端调用的本地 server（stdio，随 1Password 桌面应用跑）。它的独特设计是安全边界在 server 侧：agent 管理 Environments（密钥托管容器），但 server 按设计永远不会把密钥值返回给客户端——agent 只见变量名与环境名。
It calls no model itself — a local server (stdio, running inside the 1Password desktop app) called by MCP clients. Its distinctive design is that the security boundary sits on the server side: the agent manages Environments (the secrets-holding containers), but by design the server never returns secret values to the client — the agent only ever sees variable names and environment names.
运行位置Where it runs: 本地 stdio server，寄生在 1Password 桌面应用内（官方文档：runs locally as part of the 1Password desktop app）；启动命令 1password-mcp（客户端配置）或经官方插件注册（Claude Code /plugin install、Cursor 插件市场、Codex/Kiro 各自线）。 要求 MCP 客户端支持 stdio——remote-only 客户端不支持（官方明写）。配套插件仓活跃（codex-plugin 推送 2026-10-29、claude-plugin 推送 2026-10-29）。
A local stdio server riding inside the 1Password desktop app (official docs: it runs locally as part of the 1Password desktop app); launch command 1password-mcp (client configuration) or registration via the official plugins (Claude Code /plugin install, the Cursor plugin marketplace, Codex/Kiro lines of their own). The MCP client must support stdio — remote-only clients are not supported (stated plainly by the official docs). The companion plugin repos are active (codex-plugin pushed 2026-10-29, claude-plugin pushed 2026-10-29).
本地文件Local files: 能创建本机挂载的 .env 文件（locally mounted .env）——密钥按需对进程可用但不写盘（官方口径：without writing them to disk）；这是它唯一的「本机面」，且是受控挂载不是自由读写。
It can create locally mounted .env files — secrets become available to processes on demand without writing them to disk (official wording); this is its only "local surface", and it is a controlled mount rather than free read/write.
关机后的任务Tasks after shutdown: 无独立后台——server 进程随 1Password 桌面应用与 MCP 客户端会话；1Password 锁定时授权窗口关闭（批准一次后「until 1Password locks」前不再弹授权）。
No standalone background process — the server rides the 1Password desktop app and the MCP client session; when 1Password locks, the authorization window closes (an approval stays valid "until 1Password locks" without re-prompting).
工具与扩展Tools & extensions: 能力清单（官方文档口径）：创建/列出/重命名 Environments；列出 Environment 里的变量名 （不含值）；向 Environment 添加变量；创建本机挂载 .env；列挂载。没有「读取密钥值」工具 ——by design 拿不到值，这是它与一切「凭据读取型」社区 server 的本质分界。
Capability list (official docs wording): create/list/rename Environments; list the variable names in an Environment (never values); add variables to an Environment; create locally mounted .env files; list the mounts. There is no "read a secret value" tool — by design it cannot fetch values, which is the essential divide between it and every "credential-reading" community server.
上下文与记忆Context & memory: 无 server 侧跨会话记忆；状态在 1Password 云端 Environments（跨设备同步是 1Password 账户能力，不是 MCP server 的记忆）。授权按 Environment 粒度批准。
No server-side cross-session memory; state lives in 1Password cloud Environments (cross-device sync is a 1Password account capability, not MCP-server memory). Approvals are granted per Environment.
权限与限制Permissions & limits: 权限模型是本档案核心：每次敏感操作触发 1Password 桌面应用的安全授权弹窗（per-Environment approval）；Enterprise 管理员可在 Policies > Agentic permissions 整体开关 Local MCP server。要 1Password 账户 + 桌面应用 + 已建 Environment。beta 阶段（官方标注）。
The permission model is the core of this dossier: each sensitive operation triggers a secure authorization prompt in the 1Password desktop app (per-Environment approval); Enterprise admins can toggle the Local MCP server feature wholesale under Policies > Agentic permissions. Requires a 1Password account + the desktop app + an existing Environment. Beta stage (marked by the official docs).
适合什么任务Best for: 适合：让编码 agent（Claude Code/Codex/Cursor/Kiro）管理开发密钥的「环境侧」——建环境、加变量、挂 .env——而 agent 永远接触不到密钥明文；企业可治理（策略开关+审计）。不适合：要 agent 运行时直接读密钥值（by design 不行）；remote-only MCP 客户端（要 stdio）；不用 1Password 生态的场景。
Fits: letting coding agents (Claude Code/Codex/Cursor/Kiro) manage the "environment side" of dev secrets — create environments, add variables, mount .env — while the agent never touches plaintext secrets; governable by enterprises (policy toggle + audit). Not a fit: agents reading secret values at runtime (impossible by design); remote-only MCP clients (stdio required); scenarios outside the 1Password ecosystem.
传输方式Transport: stdio（command: 1password-mcp；随 1Password 桌面应用）；官方插件线（Claude Code 插件/MCPB、 Cursor 插件、Kiro Power）替你注册配置。核验：developer.1password.com/docs/environments/mcp-server （2026-10-31 直连 200，301→www.1password.dev 同页）。
stdio (command: 1password-mcp; rides the 1Password desktop app); the official plugin lines (Claude Code plugin/MCPB, Cursor plugin, Kiro Power) register the configuration for you. Verified: developer.1password.com/docs/environments/mcp-server (200 direct on 2026-10-31, 301 to www.1password.dev, same page).
认证机制Authentication: 1Password 账户 + 桌面应用登录；敏感操作按 Environment 粒度弹授权窗（批准一次有效到 1Password 锁定）； Enterprise 策略开关（Policies > Agentic permissions）。无 API token 概念。
A 1Password account + desktop-app sign-in; sensitive operations pop an authorization window per Environment (an approval lasts until 1Password locks); Enterprise policy toggle (Policies > Agentic permissions). There is no API-token concept.
权限范围Permission scope: Environments 管理面（建/列/改名/加变量/挂 .env）；无密钥值读取面（by design）；本机面仅受控 .env 挂载。凭据类 MCP 里权限面最保守的一档。
The Environments management surface (create/list/rename/add variables/mount .env); no secret-value read surface (by design); the local surface is only the controlled .env mount. Among the most conservative permission surfaces of credential-class MCPs.

头号误解Top misconception

把它当「给 agent 读 1Password 密码的 MCP」——by design 密钥值永不回传 agent；它是 Environments（开发密钥容器）管理面，不是密码库读取面Treating it as "an MCP that lets agents read 1Password passwords" — by design secret values never return to the agent; it is the Environments (dev-secrets container) management surface, not a vault-reading surface
用 remote-only MCP 客户端——官方明写要 stdio 支持，server 在你机器上随桌面应用跑Using a remote-only MCP client — the official docs require stdio support; the server runs on your machine riding the desktop app
混淆 Environments 与个人密码库（Vault）——它管的是 Developer Environments（.env 场景），不是浏览器自动填充那个库Confusing Environments with the personal password Vault — it manages Developer Environments (.env scenarios), not the autofill vault
企业环境默认以为可用——Enterprise 管理员策略（Agentic permissions > Local MCP server）可整体关掉Assuming it works by default in enterprises — the admin policy (Agentic permissions > Local MCP server) can switch it off wholesale
把社区「1Password MCP」（读 secret 值那批）当官方——官方只有这一条 Environments 线；读值类全是社区实现，安全模型完全不同Mistaking community "1Password MCPs" (the secret-value-reading bunch) for official — the official line is this Environments one only; value-reading implementations are all community, with a completely different security model

未知项清单Known unknowns

beta→GA 的时间线与能力变化（官方标 beta，无公开路线图）
Environments 与 1Password SDK/服务账户/Credential Broker 的能力分工细节（开发者站多线并存，未逐条对照）
授权弹窗的审计日志导出面（企业叙事提审计，具体导出格式未核验）

The beta-to-GA timeline and capability changes (marked beta officially, no public roadmap)
The capability division between Environments and the 1Password SDK / service accounts / Credential Broker (multiple lines coexist on the developer site; not compared item by item)
The audit-log export surface of authorization prompts (the enterprise narrative mentions audit; the concrete export format was not verified)

证据来源Evidence sources

判断可回到以下一手源复核。本站核验日Every judgement can be rechecked against the primary sources below. Verified on 2026-10-31，内容更新日content updated on 2026-10-31。

类型Type	名称Name	链接Link
docs	1Password Developer · Environments MCP Server 官方文档（能力清单/授权模型/stdio 要求/企业策略；直连 200）1Password Developer · Environments MCP Server official docs (capability list / authorization model / stdio requirement / enterprise policy; 200 direct)	https://developer.1password.com/docs/environments/mcp-server
changelog	1Password · 官方博客「Securing MCP servers with 1Password」（op run 注入模式与 MCP 安全叙事）1Password · official blog "Securing MCP servers with 1Password" (the op run injection pattern and the MCP security narrative)	https://www.1password.com/blog/securing-mcp-servers-with-1password-stop-credential-exposure-in-your-agent
repo	1Password/1password-codex-plugin · 官方 Codex 插件仓（MIT；推送 2026-10-29，GitHub API 核验；commits 作变更记录线）1Password/1password-codex-plugin · official Codex plugin repo (MIT; pushed 2026-10-29, GitHub API verified; commits as the change-record line)	https://github.com/1Password/1password-codex-plugin
repo	1Password/1password-claude-plugin · 官方 Claude 插件仓（MIT；推送 2026-10-29，GitHub API 核验）1Password/1password-claude-plugin · official Claude plugin repo (MIT; pushed 2026-10-29, GitHub API verified)	https://github.com/1Password/1password-claude-plugin

实测记录Measured runs

本档未在真实客户端逐项跑通；工具清单与权限来自官方 README。

This site has not completed measured runs. The test protocol is at protocols/mcp/_protocol.md.