op-mcp

A lightweight MCP server for 1Password that wraps the op CLI. Zero idle CPU usage.

Why?

The popular @takescake/1password-mcp uses the @1password/sdk WASM runtime, which burns 40-80% CPU even when idle due to an internal event loop in the compiled Rust/WASM binary. This server shells out to the op CLI instead — it does nothing when idle and only spawns a process when a tool is called.

Supports service account tokens for headless/CI use (no biometric auth required).

Install

npx op-mcp

Or install locally:

git clone https://github.com/studio-corsair/op-mcp.git
cd op-mcp
npm install && npm run build
node dist/index.js

Prerequisites

• 1Password CLI (op) installed
• A service account token or signed-in op session

Configuration

Claude Code

{
  "mcpServers": {
    "1password": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "op-mcp"],
      "env": {
        "OP_SERVICE_ACCOUNT_TOKEN": "your-token-here"
      }
    }
  }
}

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | OP_SERVICE_ACCOUNT_TOKEN | Recommended | Service account token (skips biometric) | | OP_PATH | No | Path to op binary (default: /opt/homebrew/bin/op) |

Tools

| Tool | Description | |------|-------------| | vault_list | List all accessible vaults | | item_lookup | Search items by name, URL, or tag | | password_read | Read a field via op:// reference or get full item | | password_create | Create a new login/password/note item | | password_update | Update fields on an existing item | | password_generate | Generate a random password | | item_delete | Delete or archive an item |

License

MIT