1Password Environments MCP – Secure Agent Secrets
The 1Password Environments MCP Server for Codex lets AI coding agents create and manage 1Password Environments while keeping raw credentials inside 1Password. It is designed for secure agent workflows where secrets are injected at runtime into authorized processes rather than copied into prompts, files, or the model context.
Overview
The 1Password Environments MCP Server for Codex is a local Model Context Protocol server that connects Codex to 1Password Environments. It is intended for developer workflows where an AI coding agent needs to prepare or use environment variables while avoiding direct custody of sensitive values.
1Password documents the server as a bridge for managing Environments from Codex with secure authorization prompts. The server is currently described as beta and, at the time of this entry, supported for 1Password on Mac and Linux.
What the MCP server enables
Through the MCP server, Codex can work with 1Password Environments in scoped ways. Documented capabilities include creating Environments, listing environment variable names, handling local .env files within authenticated workflows, and managing secrets within Environments.
A key limitation is also the main security feature: the MCP server does not read or return raw secrets to the AI agent. Secrets remain in 1Password and are only made available to authorized processes. 1Password describes the runtime flow as mounting a local .env file through an in-memory FIFO file and injecting required variables directly into the application process for the duration of authorized use.
When to use it
Use this provider when Codex is helping build or configure software that needs API keys, database credentials, service tokens, or other environment variables. Practical workflows include bootstrapping a new project with a 1Password-managed Environment, replacing hardcoded credentials with managed references, preparing staging or production-style environment configuration, and keeping secrets out of prompts, terminal output, repository files, and the model context.
Connection and authentication
The server is a local MCP server packaged with 1Password Password Manager and developer tools. Users must install and sign in to the 1Password desktop app for Mac or Linux, turn on the 1Password Developer experience, create a 1Password Environment, enable the MCP Server in 1Password Labs, and then configure Codex to launch the local MCP server command.
Authentication and authorization are handled by the 1Password desktop app. Every interaction requires explicit user authorization prompt approval before Codex can proceed. Enterprise Password Manager administrators can also enable or disable the Local MCP server option through agentic permissions policies.
Key considerations
This integration is specific to Codex and 1Password Environments rather than a general-purpose vault-reading MCP server. It should be used where the desired behavior is for an agent to orchestrate environment setup while never seeing raw secret values. Because the feature is documented as beta and platform-limited, teams should confirm platform support, administrator policies, and approval workflows before relying on it for production development processes.
Supported Transports
stdio
Command: /Applications/1Password.app/Contents/MacOS/onepassword-mcp
stdio
Command: ./dist/onepassword-mcp
Frequently Asked Questions
- When should an AI agent use the 1Password Environments MCP Server for Codex?
- Use it when Codex needs to create, configure, or manage project environment variables while keeping sensitive values in 1Password. It is especially useful for bootstrapping development environments, replacing hardcoded credentials, and preparing runtime configuration without exposing secrets to the agent.
- What does this MCP server add to Codex?
- It gives Codex a local MCP connection to 1Password Environments so Codex can create Environments, list and manage variable names, handle local .env workflows, and coordinate secret-backed runtime configuration without receiving raw secret values.
- Can the AI agent read secrets through this MCP server?
- No. 1Password documents that the MCP server does not read or return secrets to the AI agent. Secrets remain in 1Password and are only accessed by authorized processes, with values injected at runtime rather than placed in the model context.
- How is authentication and approval handled?
- Authentication and authorization are handled by the 1Password desktop app. Users must be signed in, enable the 1Password Developer experience and MCP Server setting, and approve access through explicit 1Password authorization prompts before Codex can proceed.
- Which transport should be used for this server?
- Use the local stdio transport configured in Codex. 1Password documents a macOS command path at /Applications/1Password.app/Contents/MacOS/onepassword-mcp and a Linux command path at ./dist/onepassword-mcp. No public hosted HTTP or SSE endpoint is documented for this integration.