1Password MCP Server (Environments) — agentic threat model

Not certain from the listing — The 1Password MCP server is model-agnostic and runs on the client's chosen LLM (e.g., via Codex or Kiro). The primary L1 threat is prompt injection attempting to trick the model into leaking secrets, which is mitigated here by never exposing the actual secret values to the model's context in the first place.

The agent manages configuration and secret references rather than raw data stores. By design, actual secret payloads are kept out of the agent's context and vector memory, preventing data exfiltration or embedding inversion of sensitive credentials.

Integrates as an MCP tool. The framework-level threat of tool misuse (e.g., an LLM autonomously calling a write/delete credential tool maliciously) is directly mitigated by requiring secure, out-of-band per-action authorization prompts before executing any sensitive tool call.

Not certain from the listing — The deployment security depends on the host running the MCP client and server. If the local host or container running the 1Password MCP server is compromised, an attacker could potentially intercept local MCP communication or bypass local authorization prompts.

Not certain from the listing — The listing does not detail specific logging, auditing, or anomaly detection mechanisms for the MCP server's operations, though 1Password enterprise environments typically offer centralized audit trails.

Strongly addressed through zero-trust principles. The architecture enforces strict identity and authorization boundaries via per-action user confirmation prompts, ensuring the agent cannot act as an autonomous superuser without explicit human-in-the-loop validation.

Designed for multi-agent environments (e.g., Codex, Kiro). It prevents cascading failures or lateral privilege escalation by ensuring that even if a downstream agent is compromised, it cannot extract raw secrets from this MCP server without triggering user-facing authorization prompts.