Wip 1password Private — 技能工具
v0.2.2[自动翻译] Headless plugin for 1Password secrets using service accounts, resolving op:// references, reading/writing secrets, and listing vault items via JS SDK.
详细分析 ▾
运行时依赖
版本
## v0.2.2: AI-Native Homepage, MCP Fix, Plan Requirements Ran wip-1password through the WIP DevOps toolbox and rebuilt the homepage from the ground up. The README is now an AI-compatible product page. All technical documentation lives in TECHNICAL.md. The MCP server that was crashing since v0.2.0 is fixed. 1Password plan requirements updated after direct conversations with 1Password support. --- ### README rebuilt as a product page **The problem it solved:** The old README was 400+ lines of technical documentation. Quick Start, Agent Tools API, Config Resolution, CLI Commands, Write Support, Security, Troubleshooting, Developer Guide... all in one file. No human would read it. No agent could parse it efficiently. **What changed:** The README is now a product page. One description, a "Teach Your AI" prompt block (Karpathy pattern), four human-readable bullets, and links to docs. That's it. The "Teach Your AI" block is the key feature. You paste it into Claude Code, ChatGPT, or any MCP-compatible agent. The agent reads the SKILL.md, explains what the tools do, dry-runs the install, and waits for your go-ahead before writing anything to disk. The README talks to AI now. All technical content moved to TECHNICAL.md: Quick Start (6 steps), Agent Tools API (3 tools with parameter tables), Config Secret Resolution (with the `memorySearch.remote` gotcha), CLI Commands, Write Support, Configuration, How It Works, Security, Troubleshooting, and a full Developer Guide with three integration options and patterns for common scenarios. New description: "Give your AI secure access to 1Password. Never copy-paste an API key into a chat window again." **What changed:** - `README.md` ... gutted from 400+ lines to ~75. Product page only. Badges, description, Teach Your AI block, What It Does (4 bullets), Documentation links, License. - `TECHNICAL.md` ... expanded with all content from README plus new Developer Guide section (3 integration options, common patterns, key rules, example projects table). --- ### MCP server fixed **The problem it solved:** `mcp-server.mjs` crashed on startup with "Schema is missing a method literal." The MCP server shipped in v0.2.0 but never actually worked. Every Claude Code user who tried to connect op-secrets hit this error. **Root cause:** `setRequestHandler` was called with raw strings (`"tools/list"`, `"tools/call"`) instead of SDK schema objects. The MCP SDK validates the first argument against its type system and rejects strings. **The fix:** ```javascript // Before (broken) server.setRequestHandler("tools/list", async () => ({...})); server.setRequestHandler("tools/call", async (request) => ({...})); // After (working) import { ListToolsRequestSchema, CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js"; server.setRequestHandler(ListToolsRequestSchema, async () => ({...})); server.setRequestHandler(CallToolRequestSchema, async (request) => ({...})); ``` op-secrets MCP server now starts clean and connects to Claude Code. **What changed:** - `mcp-server.mjs` ... import `ListToolsRequestSchema` and `CallToolRequestSchema` from `@modelcontextprotocol/sdk/types.js`, replace string handlers with schema objects. --- ### 1Password plan requirements updated Parker went back and forth with 1Password directly. The original docs said "Teams or Business" for service accounts. That was wrong. **What we confirmed:** - Service accounts work on **all plans**: Individual, Family, Teams, Business. - Headless operation (no desktop app) confirmed on Teams and Business. - Lower-tier plans may require the desktop app for initial setup. **What changed:** - `TECHNICAL.md` ... prerequisites section updated with correct plan requirements. - `SKILL.md` ... compatibility line updated. Description changed from "OpenClaw plugin" to "AI plugin (Claude Code, OpenClaw)". --- ### Feature priority reordered Agent tools (read/write secrets) is the #1 value of this tool. It was listed after config resolution. Reordered in both README and TECHNICAL.md: 1. Agent tools (read/write secrets on demand) 2. MCP server for Claude Code 3. Config resolution (`op://` refs at startup) 4. CLI diagnostics --- ### Files Changed ``` README.md | 389 ++---------------------------------------------- SKILL.md | 8 +- TECHNICAL.md | 116 +++++++++++---- mcp-server.mjs | 5 +- 5 files changed, 121 insertions(+), 412 deletions(-) ``` ### Install ```bash npm install -g @wipcomputer/wip-1password@0.2.2 ``` Or update your local clone: ```bash git pull origin main ``` --- Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code (Claude Opus 4.6).
安装命令 点击复制
技能文档
AI plugin (Claude Code, OpenClaw) for 1Password secrets. Uses the official JavaScript SDK with service accounts for fully headless operation... no desktop app, no biometrics, no popups.
When to Use This Skill
Use wip-1password for:
- Resolving
op://secret references in config files at startup - Reading API keys, tokens, and credentials from 1Password at runtime
- Storing new secrets in 1Password vaults
- Listing available secrets in a vault
Do NOT Use For
- Managing 1Password accounts or users (use the 1Password admin console)
- Accessing built-in vaults (Shared, Employee, Private). Service accounts only work with custom vaults.
- Repos that don't use OpenClaw (use the
opCLI directly instead)
API Reference
OpenClaw Plugin (startup resolver)
Resolves op://vault/item/field strings in openclaw.json at boot. Values exist in memory only... never written to disk.
// In openclaw.json
"someService": {
"apiKey": "op://Agent Secrets/Some Service/api key"
}
Agent Tools
op_read_secret({ item: "OpenAI API", vault: "Agent Secrets", field: "api key" })
op_list_items({ vault: "Agent Secrets" })
op_write_secret({ item: "New Key", value: "sk-...", vault: "Agent Secrets" })
Module
import { resolveSecretRefs } from "@wipcomputer/wip-1password";const resolved = await resolveSecretRefs({
apiKey: "op://Agent Secrets/OpenAI API/api key",
});
Setup
# 1. Save service account token
mkdir -p ~/.openclaw/secrets
echo "ops_..." > ~/.openclaw/secrets/op-sa-token
chmod 600 ~/.openclaw/secrets/op-sa-token# 2. Enable in openclaw.json
# plugins.entries.op-secrets.enabled = true
# plugins.entries.op-secrets.config.defaultVault = "Agent Secrets"
# 3. Test
openclaw op-secrets test
Key Rules
- Never call
opbare. Always prefix withOP_SERVICE_ACCOUNT_TOKEN. - Never log secret values. Store in variables only.
- Leave
memorySearch.remoteas{}... the plugin setsprocess.env.OPENAI_API_KEYinstead. - Service account token: Always at
~/.openclaw/secrets/op-sa-token. - Custom vaults only. Service accounts can't access built-in vaults.
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制