# op-mcp

A lightweight [MCP](https://modelcontextprotocol.io) server for 1Password that wraps the `op` CLI. Zero idle CPU usage.

## Why?

The popular `@takescake/1password-mcp` uses the `@1password/sdk` WASM runtime, which burns 40-80% CPU even when idle due to an internal event loop in the compiled Rust/WASM binary. This server shells out to the `op` CLI instead — it does nothing when idle and only spawns a process when a tool is called.

Supports **service account tokens** for headless/CI use (no biometric auth required).

## Install

```bash
npx @jrejaud/op-mcp
```

Or install locally:

```bash
git clone https://github.com/studio-corsair/op-mcp.git
cd op-mcp
npm install && npm run build
node dist/index.js
```

## Prerequisites

- [1Password CLI (`op`)](https://developer.1password.com/docs/cli/get-started/) installed
- A [service account token](https://developer.1password.com/docs/service-accounts/) or signed-in `op` session

## Configuration

### Claude Code

```json
{
  "mcpServers": {
    "1password": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "op-mcp"],
      "env": {
        "OP_SERVICE_ACCOUNT_TOKEN": "your-token-here"
      }
    }
  }
}
```

### Environment Variables

| Variable | Required | Description |
|----------|----------|-------------|
| `OP_SERVICE_ACCOUNT_TOKEN` | Recommended | Service account token (skips biometric) |
| `OP_PATH` | No | Path to `op` binary (default: `/opt/homebrew/bin/op`) |

## Tools

| Tool | Description |
|------|-------------|
| `vault_list` | List all accessible vaults |
| `item_lookup` | Search items by name, URL, or tag |
| `password_read` | Read a field via `op://` reference or get full item |
| `password_create` | Create a new login/password/note item |
| `password_update` | Update fields on an existing item |
| `password_generate` | Generate a random password |
| `item_delete` | Delete or archive an item |

## License

MIT