op_run

MCP tool from 1Password MCP by CakeRepository

Run a local command (command or argv) with env vars. Values matching op://… are resolved into the child process only; resolved secrets are redacted from returned output. Optional cwd, shell, timeoutms, stdin.

How to use it

op_run is exposed by the 1Password MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the op_run tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

FULL 1PASSWORD MCP LISTING

Other tools in 1Password MCP (14)

item_archive

Move an item to the archive (hidden from normal views).

item_delete

Permanently delete an item — cannot be undone.

item_edit

Update title, notes (empty string clears), tags, URL; upsert or remove fields. Unreferenced fields stay untouched.

item_get

Full item: title, category, tags, notes, fields. Concealed values stay hidden unless reveal: true. Accepts op://… or vaultId + itemId.

item_list

List every item in a vault (id, title, category, tags, updatedAt) — never secrets.

item_lookup

Search a vault by title substring; optional limit (max 200).

note_create

Create a Secure Note with optional tags and custom fields.

op_check_ref

Validate op://vault/item/field and return non-secret metadata only (vault, item, field). Never the value.

password_create

Create a Login or Password item (username, URL, tags, notes). returnSecret defaults to false.

password_generate

Cryptographically secure random password (length 8–128; symbols/numbers/uppercase toggles).

password_generate_memorable

Memorable passphrase from a ~500-word list (word count, separator, number/symbol suffixes).

password_read

Read one field (default password) via op://… or ids. Metadata-only unless reveal: true. Prefer oprun to use a secret.

password_update

Rotate a password / concealed field (creates the field if missing).

vault_list

List vaults the service account can access (id, name, description, type).