YOUR LOCAL CONTROL CENTER
Your vault. Your rules.
Give your agents the access they need. Keep your secrets in 1Password.
Approved fields—Available to your agents
Agent vaultMCPVAULTChecking connection…
Clipboard captureOffSave without sharing the secret
Agent Vault Setup
Agents only use enabled items from MCPVAULT.
1
Use a dedicated agent vault
2
Copy items into that vault
3
Approve exact fields
Choose From 1Password
Find an item in your normal vault. Copying it here does not share it with agents yet.
Approve Agent Items
Drop items here from the left. They stay private until you approve the exact details agents may use.
1. Pick an item type
Use the boxes below when you only want cards, API keys, logins, or notes.
2. Choose details
Open a copied item and tick only the fields an agent should be allowed to use.
3. Limit websites
Leave websites blank for any site, or type domains like checkout.example.
Allowed For Agents
Enabled entries are the only secret handles MCP clients can request.
Profile Data For Agents
Email, phone, address, and similar details that agents may read directly. Blank allowed sites means all sites.
Expert fallback: add a secret reference manually
Use this only for a custom field already inside the agent vault, such as an API token field that search does not show.
02 / UNATTENDED ACCESS
Keep working while you’re away.
Connect a 1Password service account to use the vault without repeated desktop authorization prompts.
Checking access…
Loading local configuration.
- Create a service account in your 1Password account.
- Grant read and write access only to your agent vault (MCPVAULT).
- Paste its token below. It is encrypted locally and never shown again.
Unattended access still requires this Mac and the MCP server to be running. It does not override approvals in your agent client.