Related Pages

Related topics: Entrypoints and Runtime Surface, Architecture Evidence Map, Operations and Verification Boundaries

Repository Overview

This page is generated from repository evidence because the Human Wiki provider was unavailable. It intentionally limits itself to README and file-tree facts.

README Evidence

1Password MCP Server

  

A community-built Model Context Protocol (MCP) server that connects MCP-compatible AI clients (Claude Desktop, VS Code Copilot, OpenAI Codex, Gemini, etc.) to 1Password vaults via a Service Account.

Not an official 1Password product. This is a community project.

Related Pages

Related topics: Repository Overview, Architecture Evidence Map, Operations and Verification Boundaries

Entrypoints and Runtime Surface

The files below are the highest-signal candidates for how the project is installed, started, configured, or embedded. Treat this as an evidence map, not an inferred API contract.

Source: README.md:1-120

Related Pages

Related topics: Repository Overview, Entrypoints and Runtime Surface, Operations and Verification Boundaries

Architecture Evidence Map

This section maps source paths into likely architectural areas based on repository layout only. Claims that require execution are intentionally not made here.

• .: README.md, package.json
• src: src/client.ts, src/config.ts, src/index.ts, src/logger.ts, src/types.ts, src/utils.ts

Source: package.json:1-120

Related Pages

Related topics: Repository Overview, Entrypoints and Runtime Surface, Architecture Evidence Map

Operations and Verification Boundaries

Operational guidance is limited to files that are present in the repository. Before using this project in an agent workflow, verify install, quickstart, and runtime behavior in a sandbox.

• Documentation signal: README.md
• Runtime/package signal: package.json
• Source inspection signal: src/client.ts
• Source inspection signal: src/config.ts
• Source inspection signal: src/index.ts
• Source inspection signal: src/logger.ts
• Source inspection signal: src/types.ts
• Source inspection signal: src/utils.ts
• Source inspection signal: src/prompts/index.ts
• Source inspection signal: src/resources/index.ts

Source: src/client.ts:1-120

Doramagic Pitfall Log

Doramagic extracted 10 source-linked risk signals. Review them before installing or handing real data to the project.

1. Installation risk: Bug: serverInfo version reports 2.0.0 while package is 2.0.3

• Severity: medium
• Finding: Installation risk is backed by a source signal: Bug: serverInfo version reports 2.0.0 while package is 2.0.3. Treat it as a review item until the current version is checked.
• User impact: First-time setup may fail or require extra isolation and rollback planning.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: Source-linked evidence: https://github.com/CakeRepository/1Password-MCP/issues/2

2. Configuration risk: Configuration risk needs validation

• Severity: medium
• Finding: Configuration risk is backed by a source signal: Configuration risk needs validation. Treat it as a review item until the current version is checked.
• User impact: Users may get misleading failures or incomplete behavior unless configuration is checked carefully.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: packet_text.keyword_scan | mcp_registry:io.github.CakeRepository/1password:2.0.3 | https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CakeRepository%2F1password/versions/2.0.3 | matched login / oauth / account keyword

3. Capability assumption: README/documentation is current enough for a first validation pass.

• Severity: medium
• Finding: README/documentation is current enough for a first validation pass.
• User impact: The project should not be treated as fully validated until this signal is reviewed.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: capability.assumptions | mcp_registry:io.github.CakeRepository/1password:2.0.3 | https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CakeRepository%2F1password/versions/2.0.3 | README/documentation is current enough for a first validation pass.

4. Maintenance risk: Maintainer activity is unknown

• Severity: medium
• Finding: Maintenance risk is backed by a source signal: Maintainer activity is unknown. Treat it as a review item until the current version is checked.
• User impact: Users cannot judge support quality until recent activity, releases, and issue response are checked.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: evidence.maintainer_signals | mcp_registry:io.github.CakeRepository/1password:2.0.3 | https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CakeRepository%2F1password/versions/2.0.3 | last_activity_observed missing

5. Security or permission risk: no_demo

• Severity: medium
• Finding: no_demo
• User impact: The project may affect permissions, credentials, data exposure, or host boundaries.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: downstream_validation.risk_items | mcp_registry:io.github.CakeRepository/1password:2.0.3 | https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CakeRepository%2F1password/versions/2.0.3 | no_demo; severity=medium

6. Security or permission risk: no_demo

• Severity: medium
• Finding: no_demo
• User impact: The project may affect permissions, credentials, data exposure, or host boundaries.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: risks.scoring_risks | mcp_registry:io.github.CakeRepository/1password:2.0.3 | https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CakeRepository%2F1password/versions/2.0.3 | no_demo; severity=medium

7. Security or permission risk: Feature Request: Support macOS Keychain as alternative to plaintext token in config

• Severity: medium
• Finding: Security or permission risk is backed by a source signal: Feature Request: Support macOS Keychain as alternative to plaintext token in config. Treat it as a review item until the current version is checked.
• User impact: The project may affect permissions, credentials, data exposure, or host boundaries.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: Source-linked evidence: https://github.com/CakeRepository/1Password-MCP/issues/5

8. Security or permission risk: Security: upgrade @modelcontextprotocol/sdk to >=1.26.0 (GHSA-345p-7cg4-v4c7)

• Severity: medium
• Finding: Security or permission risk is backed by a source signal: Security: upgrade @modelcontextprotocol/sdk to >=1.26.0 (GHSA-345p-7cg4-v4c7). Treat it as a review item until the current version is checked.
• User impact: The project may affect permissions, credentials, data exposure, or host boundaries.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: Source-linked evidence: https://github.com/CakeRepository/1Password-MCP/issues/1

9. Maintenance risk: issue_or_pr_quality=unknown

• Severity: low
• Finding: issue_or_pr_quality=unknown。
• User impact: Users cannot judge support quality until recent activity, releases, and issue response are checked.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: evidence.maintainer_signals | mcp_registry:io.github.CakeRepository/1password:2.0.3 | https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CakeRepository%2F1password/versions/2.0.3 | issue_or_pr_quality=unknown

10. Maintenance risk: release_recency=unknown

• Severity: low
• Finding: release_recency=unknown。
• User impact: Users cannot judge support quality until recent activity, releases, and issue response are checked.
• Recommended check: Open the linked source, confirm whether it still applies to the current version, and keep the first run isolated.
• Evidence: evidence.maintainer_signals | mcp_registry:io.github.CakeRepository/1password:2.0.3 | https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CakeRepository%2F1password/versions/2.0.3 | release_recency=unknown

Community Discussion Evidence

Doramagic exposes project-level community discussion separately from official documentation. Review these links before using 1password-mcp with real data or production workflows.

• Feature Request: Support macOS Keychain as alternative to plaintext toke - github / github_issue
• Bug: serverInfo version reports 2.0.0 while package is 2.0.3 - github / github_issue
• Security: upgrade @modelcontextprotocol/sdk to >=1.26.0 (GHSA-345p-7cg4- - github / github_issue
• Configuration risk needs validation - GitHub / issue