op_run
Run local shell commands, API calls, or scripts with 1Password secrets injected as environment variables from op:// references, keeping plaintext out of the model context.
Instructions
Run a local shell command with 1Password secrets injected as environment variables. Resolved values go only into the child process environment, are never logged by the server, and are redacted from stdout/stderr on a best-effort basis (including common encodings such as JSON, URL and base64) — a command that deliberately transforms or transmits a secret can still expose it. This is the preferred way to USE a secret in a command, API call, or script: prefer op_run with op://vault/item/field references in env over reading a secret with password_read/item_get and pasting it into a command yourself, which would put the plaintext in the model context and transcript.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "op_run"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory to run the command in, e.g. a repo checkout path. | |
| env | No | Map of ENV_VAR_NAME -> value. A value matching op://vault/item/field is resolved via 1Password and injected as plaintext into the child process env only; any other value is passed through unchanged as a literal. | |
| argv | No | Argument vector [executable, ...args] to execute directly without a shell (safer against quoting/injection issues). Provide either `command` or `argv`, not both. | |
| shell | No | Optional shell executable to use with `command` (e.g. 'powershell.exe', 'C:/Program Files/Git/bin/bash.exe', '/bin/bash'). Defaults to the platform shell (cmd.exe on Windows, /bin/sh elsewhere). Ignored when `argv` is used. | |
| stdin | No | Optional text to write to the process's stdin. | |
| command | No | Shell command line to execute (run via the platform shell). Provide either `command` or `argv`, not both. | |
| timeout_ms | No | Kill the process and everything it started if it runs longer than this many milliseconds. Default 120000 (2 minutes). |