1Password MCP

Create a 1Password service account

You need a 1Password account whose administrator allows service-account creation. Sign in at 1Password.com and select Developer in the sidebar (or Directory if you already have applications/services). Under Access Tokens choose Service Account, name it, then select only the vaults this MCP connection should access. Use read-only vault permissions unless you need item changes. Create the account and copy/save its token immediately; 1Password will not show it again. See 1Password’s official service-account guide.

Never share the token with the MCP server operator or paste it into your client. It is supplied directly to your signed-in account page over HTTPS and stored encrypted for your account. The connection page verifies the token and lets you select the accessible vaults. Writes and permanent deletion are separate explicit options; permanent deletion requires write access.

Sign in and connect your 1Password account

Sign in to the MCP account page with an allowed email, paste the service-account token into Connections, verify it, select vaults, and save. The 1Password token controls which vaults and items are reachable; the MCP connection’s vault selection narrows that further. Reading an item can reveal its secret fields, so choose vaults carefully. Saving a changed connection revokes existing MCP tokens; create new ones afterward.

If the 1Password account does not offer service-account creation, ask its administrator for that permission. If a vault is missing, grant the service account access to it in 1Password and verify the connection again.

Create a personal MCP token

In Access tokens, create a named token with read-only or read/write scope and an expiry, then copy it once. This token is separate from the 1Password service-account token. Revoke it in Access tokens if exposed.

Configure your MCP client

Add a remote server using Streamable HTTP at:

Set Authorization: Bearer <YOUR_PERSONAL_MCP_TOKEN>. Claude Code:

claude mcp add --transport http onepassword https://op-mcp.sherwoodcallaway.com/mcp --header "Authorization: Bearer <YOUR_PERSONAL_MCP_TOKEN>"

Other clients should use the same URL and bearer header in their remote Streamable HTTP settings. OAuth-only clients are not supported by this bearer-token route. MCP Gateway is optional.

Verify and manage access

Reload tools and call search for account_status, then execute it. Use a vault-list/read operation to verify the expected vaults.

• 401 Unauthorized: check the personal MCP token and bearer header; mint a replacement if expired/revoked.
• 1Password token rejected: create a replacement service account token and save it in Connections.
• Vault/item unavailable: check service-account vault access and the connection’s selected vaults.
• Write/delete rejected: verify 1Password service-account permission, connection write/deletion setting, and MCP token scope.

Disconnect from the MCP account page to remove the connection and revoke its MCP tokens. Revoke the 1Password service account in 1Password Developer/Directory to invalidate its provider token.