1password-environments7.25 KB
View saved version →
---
name: 1password-environments
description: Manage 1Password Developer Environments and local .env mounts through the local 1Password MCP server, without exposing secret values. Use when the user asks to set up environment variables for a repo, store or configure API keys and secrets in 1Password, mount or create a local .env file from 1Password, inspect 1Password Environment variable names, or work with the 1Password MCP server.
license: MIT
compatibility: Requires the 1Password desktop app (macOS, Windows, or Linux) with Integrate with MCP clients enabled under Settings > Developer, and a client configured to run the local 1password-mcp MCP server. Local .env mounts are supported on macOS and Linux only.
---
# 1Password Environments
Use the local 1Password MCP server for all environment variable configuration. Its tools return variable names, never secret values, so secrets stay in 1Password.
## Use When
- The user mentions 1Password Environments, 1Password Developer Environments, the 1Password MCP server, or local `.env` files from 1Password.
- The user asks to set up, mount, create, or sync a project `.env` file from a secret manager and 1Password is available.
- The user asks to configure repo environment variables, API keys, tokens, credentials, or secrets securely with 1Password.
- The user wants to list or compare Environment variable names without exposing secret values.
Do not use this skill for unrelated password-manager tasks, arbitrary local `.env` file parsing, or non-1Password secret stores unless the user asks to migrate that configuration into 1Password.
## Requirements
This skill depends on the local 1Password MCP server. If its tools are not available in the current session, help the user finish setup instead of improvising:
1. Install the 1Password desktop app, go to **Settings > Developer**, and turn on **Integrate with MCP clients**.
2. The desktop app installs the `1password-mcp` alias on the `PATH` (supported on macOS, Windows, and Linux).
3. Configure the client to launch `1password-mcp` as a local MCP server. For Codex, add this to `~/.codex/config.toml`:
```toml
[mcp_servers.1password]
command = "1password-mcp"
```
If **Integrate with MCP clients** is missing from **Settings > Developer**, update
1Password. If the checkbox is still missing, the account may not have the
`ai-local-mcp-server` feature flag. If it is disabled by an administrator, ask the
administrator to check **Policies > Sharing and permissions > Agentic permissions > Local MCP server**.
The 1Password desktop app asks the user to approve each client connection, and environment access can require additional approval.
## Tools
The local server exposes these tools:
- `authenticate`: authenticate with the 1Password desktop app and return the account ID.
- `list_environments`: list Developer Environments for an account.
- `create_environment`: create a new Developer Environment.
- `rename_environment`: rename an existing Developer Environment.
- `list_variables`: list variable names in an Environment without returning values.
- `append_variables`: add or update Environment variables.
- `create_local_env_file`: mount an Environment as a local `.env` file on macOS or Linux.
- `list_local_env_files`: list local `.env` mounts for an Environment.
It also exposes these documentation resources:
- `1password://docs/getting-started`
- `1password://docs/environments-guide`
## Workflow
1. Call `authenticate` first when you do not already have an account ID for this turn. The 1Password desktop app will ask the user to approve the connection.
2. Use `accountId` for subsequent calls. Server docs may spell the returned value as `account_id`; MCP tool calls use camelCase parameters such as `accountId` and `environmentId`.
3. Call `list_environments` with the returned `accountId` before operating on an Environment, unless the user already provided a current `environmentId`.
4. If the target Environment is ambiguous, ask the u
Preview of the first 4,000 characters. Read full instructions →
Referenced files: 3 — file references are metadata, not package contents.
