Skip to main content
G
glyph
May 21, 2026
Question

Remove MCP support

  • May 21, 2026
  • 2 replies
  • 280 views

The presence of code whose only purpose is to leak secrets to AIs is a vulnerability magnet and has no utility.

Even if you are using AI for production workloads, everything should be going through a proxy that holds secrets, where a user can review every action it takes; as every single product in this category says, "AI can make mistakes" and it should not be allowed to make mistakes with sensitive data.

Any secret exposed to a model, at the very least, goes through the model provider and leaks your secrets into their logs.

I currently have the MCP server disabled in the "labs" section of the app, but its presence there is a constant source of anxiety and makes me think of migrating to Apple's passwords app every time I see it.

    2 replies

    1P_Blake
    1P_Blake
    Community Manager
    May 21, 2026

    Hey @glyph! It's great to see you again! 👋

    The Labs toggle on its own doesn't expose anything to any AI. Turning it on doesn't connect 1Password to a model, doesn't give a model access to your vault, and doesn't surface your secrets anywhere. It just makes it possible for you to set up a connection if you choose to. Any actual access still requires you to wire up the connection on your end.

    The way our MCP server is built is actually pretty close to what you described as the correct approach. Credentials stay in 1Password, the user reviews and approves every action, and the model never gets custody of the secret. 1Password injects the values directly into the authorized process at runtime, only for as long as that process needs them, so that way the secret never reaches the model, and the model provider's logs never see the secret.

    Take our Environments MCP Server for Codex as an example. The model can create environments and reference variable names, but secret values aren't returned through the MCP channel, aren't surfaced in the model's context window, and aren't written to disk, all while still requiring direct authorization from you throughout the entire process.

    There's more on the thinking behind this in our broader AI security principles, especially the parts about keeping raw credentials out of LLM context and using deterministic authorization rather than letting the model decide: The security principles guiding 1Password’s approach to AI

    If MCP isn't part of your workflow, leaving it off is a totally fine call, and that's exactly why the toggle exists. We don't have plans to remove the feature though, because for folks who are using agentic tools this is the path designed to keep secrets out of prompts, .env files, terminals, and repos, not the path that puts them there.

    G
    glyphAuthor
    May 21, 2026

    I am a bit vague on step 8 there. How is the website "built/served" if no secrets are exposed to the LLM? The "security principles" document describes how bad it would be to grant an AWS API key to the agent, then turns around and says "If an AI agent accesses a credential to run a scheduled task, that access should be logged". Presumably if it "accesses" a credential, it gets access to the credential?

    1P_Blake
    1P_Blake
    Community Manager
    May 21, 2026

    On step 8, "built/served" is the application process running, not the model itself. When Codex kicks off something like a build/dev server, the runtime that actually executes is what consumes the secret. 1Password injects the required variables directly into that process at runtime, the runtime uses them to do its thing, and the model never holds the value.

    On the "accesses" wording, I think it makes a bit more sense when you put it next to the deterministic authorization principle a couple of sections earlier.

    "the LLM itself will not have direct access to credentials in a 1Password vault via the data channel of a protocol like MCP. Instead, credential exchange must follow a separate, well-defined deterministic permissioned flow."

    So when the audit principle talks about an agent "accessing" a credential, it's the agent invoking that separate auth flow, not the agent holding the raw value itself. The audit principle is layered on top of that to make sure the invocation gets logged.

      M
      mainnine
      June 24, 2026

      Fed up of companies racing to implement AI features into apps, none of us want this and I'd rather have development resources spent on something worthwhile.

      Terms & ConditionsAccessibility statement

      ©2026 1Password. All rights reserved.
      4711 Yonge St, 10th Floor, Toronto Ontario, M2N 6K8, Canada