op_run
Run local shell commands, API calls, or scripts with 1Password secrets injected as environment variables from op:// references, keeping plaintext out of the model context.
Instructions
Run a local shell command with 1Password secrets injected as environment variables. Resolved values go only into the child process environment, are never logged by the server, and are redacted from stdout/stderr on a best-effort basis (including common encodings such as JSON, URL and base64) — a command that deliberately transforms or transmits a secret can still expose it. This is the preferred way to USE a secret in a command, API call, or script: prefer op_run with op://vault/item/field references in env over reading a secret with password_read/item_get and pasting it into a command yourself, which would put the plaintext in the model context and transcript.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory to run the command in, e.g. a repo checkout path. | |
| env | No | Map of ENV_VAR_NAME -> value. A value matching op://vault/item/field is resolved via 1Password and injected as plaintext into the child process env only; any other value is passed through unchanged as a literal. | |
| argv | No | Argument vector [executable, ...args] to execute directly without a shell (safer against quoting/injection issues). Provide either `command` or `argv`, not both. | |
| shell | No | Optional shell executable to use with `command` (e.g. 'powershell.exe', 'C:/Program Files/Git/bin/bash.exe', '/bin/bash'). Defaults to the platform shell (cmd.exe on Windows, /bin/sh elsewhere). Ignored when `argv` is used. | |
| stdin | No | Optional text to write to the process's stdin. | |
| command | No | Shell command line to execute (run via the platform shell). Provide either `command` or `argv`, not both. | |
| timeout_ms | No | Kill the process and everything it started if it runs longer than this many milliseconds. Default 120000 (2 minutes). |