{
 "categories": [
  "identity",
  "developer-tools"
 ],
 "deployment": "hybrid",
 "evidence": [
  {
   "date": "2026-09-03",
   "fact": "homepage",
   "note": "1Password presents a commercial password, secrets, and access-management product with desktop, mobile, browser, and CLI downloads.",
   "source": "https://1password.com/",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "license",
   "note": "Individual and Families plans are paid subscriptions with a 14-day free trial. CLI and developer-tool docs require a 1Password subscription.",
   "source": "https://1password.com/pricing/password-manager",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "platforms",
   "note": "Downloads cover macOS, Windows, Linux, iOS, Android, browser extensions, and the CLI.",
   "source": "https://1password.com/downloads",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.exists",
   "note": "1Password documents Connect Servers as a private REST API for items and vaults in company apps and infrastructure.",
   "source": "https://www.1password.dev/connect/overview",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.sdk.exists",
   "note": "1Password documents official SDKs that load secrets, manage items, share items, and manage vaults.",
   "source": "https://www.1password.dev/sdks",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.sdk.languages[0]",
   "note": "Official Go package is github.com/1password/onepassword-sdk-go.",
   "source": "https://www.1password.dev/sdks",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.sdk.languages[1]",
   "note": "Official JavaScript package is @1password/sdk.",
   "source": "https://www.1password.dev/sdks",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.sdk.languages[2]",
   "note": "Official Python package is onepassword-sdk.",
   "source": "https://www.1password.dev/sdks",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.kinds[0]",
   "note": "The Connect API is a documented REST interface (OpenAPI 1.8.1) with JSON request and response bodies.",
   "source": "https://www.1password.dev/connect/api-reference",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.auth[0]",
   "note": "Each Connect API request must send Authorization: Bearer <access_token> and Content-type: application/json.",
   "source": "https://www.1password.dev/connect/api-reference",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.auth[1]",
   "note": "Every Events API call must use a JWT-encoded bearer token in the Authorization header. Example: Authorization: Bearer <YOUR_BEARER_TOKEN>.",
   "source": "https://www.1password.dev/events-api/authorization",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.coverage",
   "note": "Connect covers vault and item list/get/create/replace/delete, files, and API activity on a deployed Connect server. It is not a public SaaS management API for every 1Password product surface. Events API coverage is read-only audit, item-usage, and sign-in events for Business accounts.",
   "source": "https://www.1password.dev/connect/api-reference",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.mcp.first_party",
   "note": "1Password documents a first-party local MCP server inside the desktop app (command 1password-mcp, stdio). Tools manage Environments only and never return stored secret values.",
   "source": "https://www.1password.dev/environments/mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.cli.exists",
   "note": "1Password documents official op for the terminal, including item and user management, secret injection, service accounts, Connect, and Events API token provisioning.",
   "source": "https://www.1password.dev/cli",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.data_access.export[0]",
   "note": "Global --format json (or OP_FORMAT) returns structured JSON for item, vault, and related commands.",
   "source": "https://www.1password.dev/cli/reference",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.data_access.import[0]",
   "note": "Environments can import project variables from existing .env files or accept manual key-value pairs.",
   "source": "https://www.1password.dev/environments/overview",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "1Password publishes a curated llmstxt.org index at https://www.1password.dev/llms.txt plus llms-full.txt and per-page Markdown.",
   "source": "https://www.1password.dev/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "verdict.scores.api",
   "note": "Connect is a documented read/write REST item API with Bearer tokens and official Connect SDKs, but it requires a self-hosted deploy and excludes built-in Personal, Private, Employee, and default Shared vaults. Events API is a separate read-only Business audit surface.",
   "source": "https://www.1password.dev/connect/api-reference",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "verdict.scores.mcp",
   "note": "Official desktop MCP is useful for Environments administration, but it never returns secret values, does not cover consumer vault items, is stdio-only, and the developer homepage plus Cursor/Kiro pages label the surface as beta.",
   "source": "https://www.1password.dev/environments/mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "verdict.scores.cli",
   "note": "Official op covers item, vault, user, group, document, Connect, service-account, and Events API commands with --format json, secret references, and non-interactive service-account or Connect auth.",
   "source": "https://www.1password.dev/cli/reference",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[0].url",
   "note": "Opened 1Password's current Environments MCP page. Confirmed 1password-mcp, stdio-only, tool table, no-secret-return rule, Cursor/Kiro beta, and Mac/Linux .env-mount limit.",
   "source": "https://www.1password.dev/environments/mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[1].url",
   "note": "Opened 1Password's current CLI overview, including desktop-app, service-account, and Connect authentication.",
   "source": "https://www.1password.dev/cli",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[2].url",
   "note": "Opened the current Connect Server REST API reference, including Bearer auth and vault/item endpoints.",
   "source": "https://www.1password.dev/connect/api-reference",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[3].url",
   "note": "Opened the current Events API overview for Business audit, item-usage, and sign-in event retrieval.",
   "source": "https://www.1password.dev/events-api",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-03",
  "volatility": "high",
  "watch": [
   {
    "type": "mcp",
    "url": "https://www.1password.dev/environments/mcp-server"
   },
   {
    "type": "docs",
    "url": "https://www.1password.dev/cli"
   },
   {
    "type": "docs",
    "url": "https://www.1password.dev/connect/api-reference"
   },
   {
    "type": "docs",
    "url": "https://www.1password.dev/events-api"
   }
  ]
 },
 "homepage": "https://1password.com/",
 "id": "1password",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "connect-bearer-token",
    "events-jwt-bearer"
   ],
   "coverage": "partial",
   "docs": "https://www.1password.dev/connect/api-reference",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json"
   ],
   "import": [
    "dotenv"
   ]
  },
  "extensibility": {
   "scripting": [],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. The official op CLI, Connect REST API, Events API, and Environments MCP cover practical secrets and Environments work without browser control.\n",
   "ui_stack": [
    "native-desktop",
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": true,
   "languages": [
    "go",
    "javascript",
    "python"
   ],
   "official": true
  }
 },
 "name": "1Password",
 "platforms": [
  "windows",
  "macos",
  "linux",
  "web",
  "ios",
  "android"
 ],
 "related": {
  "alternatives": [
   "okta",
   "auth0"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "1Password",
 "verdict": {
  "best_path": "cli",
  "scores": {
   "api": 7,
   "cli": 8,
   "computer_use": null,
   "integrations": null,
   "mcp": 5,
   "overall": 8,
   "rpa": null
  },
  "summary": "1Password is automatable today through the official op CLI. This record is 1Password (desktop apps, 1Password.com, Environments, CLI, Connect Server, and Events API), not Okta, Auth0, or HashiCorp Vault. op installs on macOS, Windows, and Linux, authenticates with the desktop app, a service-account token, or a Connect token, and supports --format json for item, vault, user, and group commands. That is the broadest documented agent path for vault items. The self-hosted Connect Server exposes a private REST API for vault and item CRUD with Authorization: Bearer access tokens and official Connect SDKs in Go, JavaScript, and Python. Connect cannot reach built-in Personal, Private, Employee, or default Shared vaults. The Events API is a separate Business-account REST surface for audit events, item usage, and sign-in attempts; it authenticates with a JWT-encoded bearer token and is read-only. Official 1Password SDKs for Go, JavaScript, and Python manage items and Environments using desktop-app prompts or OP_SERVICE_ACCOUNT_TOKEN. First-party MCP is the local 1password-mcp server inside the desktop app. It is scoped to Environments (create, list, rename, list variable names, append variables, mount local .env files). The opened vendor page states the server never returns stored secret values, even if an agent asks. Transport is stdio only. Cursor and Kiro integrations are documented as beta. Local .env mounts are Mac and Linux only. 1Password's developer homepage labels the Environments MCP as beta. The official MCP registry listing io.github.CakeRepository/1password is a third-party server and is not the desktop Environments MCP. A separate public docs-search MCP at https://www.1password.dev/mcp reads documentation only. The Users API for Partners is public preview and is outside this score. iPaaS connectors were not opened. Computer-use viability is unassessed. CLI scores 8 and is the best path. MCP stays at 5 because it is Environments-only, cannot return secrets, and is labeled beta.\n"
 }
}