mcpField
1
1password

1password

github.com/letta-aiSecurity152111 installsUpdated 4w ago
Repository

About 1password

A skill that guides safe use of the 1Password CLI, including setup, sign-in, and account verification. It requires running commands in a fresh tmux session and emphasizes keeping secrets out of logs and files.

Key features

  1. 01Check CLI installation and version
  2. 02Set up sign-in through app integration
  3. 03Run commands inside a fresh tmux session
  4. 04Verify account access before reading secrets
  5. 05Avoid exposing secrets in logs or files

Use cases

  1. 01Set up 1Password CLI access
  2. 02Reauthorize an account in tmux
  3. 03Confirm identity before secret retrieval

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/letta-ai/skills --skill 1password

After installing, type/1passwordin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
assets/
1password-small.svg
references/
cli-examples.md
get-started.md

Details

From the project README

1Password CLI

Follow the official CLI get-started steps. Don't guess install commands.

Prerequisites

  • tmux is required for reliable op commands (the shell tool uses fresh TTYs per command, causing re-auth issues without tmux)
    • macOS: brew install tmux
    • Linux (Debian/Ubuntu): sudo apt install tmux
    • Linux (RHEL/Fedora): sudo dnf install tmux

References

  • references/get-started.md (install + app integration + sign-in flow)
  • references/cli-examples.md (real op examples)

Workflow

  1. Check OS + shell.
  2. Verify CLI present: op --version.
  3. Confirm desktop app integration is enabled (per get-started) and the app is unlocked.
  4. REQUIRED: create a fresh tmux session for all op commands (no direct op calls outside tmux).
  5. Sign in / authorize inside tmux: op signin (expect app prompt).
  6. Verify access inside tmux: op whoami (must succeed before any secret read).
  7. If multiple accounts: use --account or OP_ACCOUNT.

REQUIRED tmux session

The shell tool uses a fresh TTY per command. To avoid re-prompts and failures, always run op inside a dedicated tmux session with a fresh socket and session name.

Socket conventions:

  • Put sockets under ${LETTA_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/letta-tmux-sockets} so they're isolated and easy to clean up.
  • Use a timestamped session name (e.g. op-auth-$(date +%Y%m%d-%H%M%S)) so you never reuse an old session — previous auth state may be stale or broken.
  • Kill the session when you're done (tmux -S "$SOCKET" kill-session -t "$SESSION") to avoid leaking long-running tmux processes.

Full example:

SOCKET_DIR="${LETTA_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/letta-tmux-sockets}"
mkdir -p "$SOCKET_DIR"
SOCKET="$SOCKET_DIR/letta-op.sock"
SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"

tmux -S "$SOCKET" new -d -s "$SESSION" -n shell
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op vault list" Enter
tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200
tmux -S "$SOCKET" kill-session -t "$SESSION"

Guardrails

  • Never paste secrets into logs, chat, or code.
  • Prefer op run / op inject over writing secrets to disk.
  • If sign-in without app integration is needed, use op account add.
  • If a command returns "account is not signed in", re-run op signin inside tmux and authorize in the app.
  • Do not run op outside tmux; stop and ask if tmux is unavailable.

Comments

Markdown supported