1password vs Aegis
A side-by-side look at the 1password and Aegis MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose 1password for security work as a local process; choose Aegis for security as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose 1password when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You have the keys it needs:
OP_SERVICE_ACCOUNT_TOKEN, OP_KEYCHAIN_SERVICE, OP_KEYCHAIN_ACCOUNT. - You want tools like
vault_list, item_lookup, item_delete.
Choose Aegis when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 57/100 · Good | 53/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | Not declared | Not declared |
| Pricing | Not declared | Not declared |
| Required env vars | OP_SERVICE_ACCOUNT_TOKENOP_KEYCHAIN_SERVICEOP_KEYCHAIN_ACCOUNT | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 21 | 14 |
| Directory activity | 2 views 0 installs 0 upvotes | 3 views 0 installs 0 upvotes |
| Tools | 15 | Not listed |
| Full listing | View 1password | View Aegis |
Tools & capabilities
1password tools 15
vault_listList the 1Password vaults accessible to the service account (limited to the allow-listed vaults when OP_MCP_ALLOWED_VAULTS / --allowed-vaults is configured). Returns vault IDs, names, descriptions, and types.item_lookupSearch for items within a 1Password vault by title substring. Returns item IDs, titles, categories, and vault IDs.item_deletePermanently delete an item from a 1Password vault. This action cannot be undone.item_getRetrieve a full 1Password item — title, category, tags, notes, and all fields (id, title, type, section). Secret-bearing field values (passwords and other concealed fields, SSH private keys, one-time-password seeds, card numbers) are hidden unless reveal is true; only known non-secret types (text, URL, email, phone, date, menu, card type, address, reference) are shown by default. Accepts a secret reference (op://vault/item/field) or vault ID + item ID. Revealing a secret puts it in the model context/transcript — to USE a secret in a command or API call, prefer op_run with op:// references instead.item_editEdit an existing 1Password item. Update the title, notes (pass an empty string to clear notes), tags, website URL, upsert fields, or remove fields. Only referenced fields are changed; all others are preserved.item_listList all items in a 1Password vault, returning id, title, category, tags, and updatedAt for each. Never returns secret values.item_archiveArchive an item in a 1Password vault. The item is moved to the archive and hidden from regular views, rather than being permanently deleted.note_createCreate a Secure Note item in a 1Password vault, with optional tags and custom fields.password_createCreate a new password/login item in a 1Password vault with optional username, URL, tags, and notes.password_readRetrieve a secret from 1Password using either a secret reference (op://vault/item/field) or vault ID + item ID. Supports field selection and optional value reveal (defaults to metadata-only). Revealing a secret puts it in the model context/transcript — to USE a secret in a command or API call, prefer op_run with op:// references instead.password_updateUpdate (rotate) a password or concealed field on an existing 1Password item. If the target field does not exist, it will be created.password_generateGenerate a cryptographically secure random password with configurable length and character types. Uses rejection sampling for unbiased randomness.- +3 more on the listing page
Aegis tools
No tool names declared yet. Check the project README from the listing page.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
1password
{
"mcpServers": {
"1password": {
"command": "npx",
"args": [
"-y",
"@takescake/1password-mcp"
],
"env": {
"OP_SERVICE_ACCOUNT_TOKEN": "YOUR_OP_SERVICE_ACCOUNT_TOKEN_HERE",
"OP_KEYCHAIN_SERVICE": "YOUR_OP_KEYCHAIN_SERVICE_HERE",
"OP_KEYCHAIN_ACCOUNT": "YOUR_OP_KEYCHAIN_ACCOUNT_HERE"
}
}
}
}
Aegis
{
"mcpServers": {
"getaegis-aegis": {
"command": "npx",
"args": [
"-y",
"@getaegis/cli"
]
}
}
}
Frequently asked questions
1password is categorized under Security and uses a local stdio subprocess. Aegis belongs to Security and uses a local stdio subprocess. Pick 1password for security work and Aegis for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
1password has no declared pricing — check the project's own site. Aegis has no declared pricing — check the project's own site. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add 1password and getaegis-aegis as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, 1password has a quality signal of 57/100 (Good) with 2 views, 0 installs and 21 GitHub stars. Aegis has 53/100 (Good) with 3 views, 0 installs and 14 GitHub stars.