1Password Connect MCP Configuration
The 1Password Connect MCP configuration provides a hosted JSON schema that connects AI assistants — including Claude Desktop, Cursor, Windsurf, and VS Code Copilot — to the 1Password Connect API via the Model Context Protocol. This configuration maps 10 API endpoints as callable tools, including Retrieve a list of API Requests that have been made., Get state of the server and its dependencies., Ping the server for liveness, and more. No authentication credentials are needed — it works out of the box. The configuration is auto-generated from the 1Password Connect OpenAPI specification (v1.5.7) and has a quality score of 34/99 (fair documentation coverage). Use the hosted URL below to auto-load this schema into any compatible MCP client.
Quick Specs Reference
Hosted Config URL
Use this hosted URL in any client that supports remote MCP schema auto-loading.
https://mcpbridge.org/config/1password-local-connect.jsonOne-Click Client Setup
Copy the configurations below to wire your local coding assistant directly.
Claude Desktop
claude_desktop_config.json{
"mcpServers": {
"1password-local-connect": {
"command": "npx",
"args": [
"-y",
"@mcp/1password-local-connect"
],
"env": {
"1PASSWORD_CONNECT_API_KEY": "your_1password_connect_api_key"
}
}
}
}Cursor & VS Code
MCP Server URL Setup{
"mcpServers": {
"1password-local-connect": {
"url": "https://mcpbridge.org/config/1password-local-connect.json"
}
}
}Raw Configuration JSON
For local command line wrappers or dynamic shell bindings.
{
"mcpServers": {
"1password-local-connect": {
"command": "npx",
"args": ["-y","@mcp/1password-local-connect"],
"env": {
"1PASSWORD_CONNECT_API_KEY": "your_1password_connect_api_key"
}
}
}
}Required Environment Keys
Substitute these secrets inside your configuration directory environment definitions.
1PASSWORD_CONNECT_API_KEYyour_1password_connect_api_key with your secret key credentialMapped Web APIs & Tools
The following routes will be exposed directly as protocol tools for the LLM.
/activityRetrieve a list of API Requests that have been made.
/healthGet state of the server and its dependencies.
/heartbeatPing the server for liveness
/metricsQuery server for exposed Prometheus metrics
/vaultsGet all Vaults
/vaults/{vaultUuid}Get Vault details and metadata
/vaults/{vaultUuid}/itemsGet all items for inside a Vault
/vaults/{vaultUuid}/itemsCreate a new Item
/vaults/{vaultUuid}/items/{itemUuid}Get the details of an Item
/vaults/{vaultUuid}/items/{itemUuid}Update an Item
Similar Configurations
Spotify Web API
The Spotify Web API is a comprehensive RESTful service provided by Spotify AB that empowers developers to programmatically access Spotify's vast catalog of over 100 million songs and 5 million podcast titles. Its core capabilities encompass music discovery, library management, audio content retrieval, and playback control across authenticated user devices. Beyond basic metadata queries for albums, artists, and tracks, the API provides specialized endpoints for deep audio analysis (e.g., tempo, key, loudness) and audio features (e.g., danceability, energy, valence), which are invaluable for applications in music recommendation, DJ software, and academic research into music theory and psychology. Typical use cases span consumer applications like building custom playlist generators, social sharing features, or music learning tools, as well as enterprise applications for music intelligence platforms, content discovery engines, and personalized marketing analysis. The API serves as the foundational gateway for any third-party integration that seeks to leverage Spotify's ecosystem, from simple "Now Playing" widgets to complex data processing pipelines. When exposed as tools to an AI coding assistant via the Model Context Protocol (MCP), the Spotify Web API transforms from a static documentation reference into a dynamic, queryable, and actionable component within the developer's workflow. The AI agent gains the ability to perform live data retrieval and analysis, eliminating guesswork and enabling precise, context-aware code generation. For example, instead of the developer manually looking up artist IDs or album structures, they can instruct the AI to fetch real-time data, which then informs the logic of the code being written. This integration allows the AI to not only suggest syntactically correct API calls but also to incorporate real-world constraints and data patterns into its responses, such as constructing a query for an artist's top tracks in a specific market or verifying the existence of an album ID before referencing it in a script. This creates a feedback loop where the AI's assistance is grounded in the actual state of Spotify's data, dramatically reducing development time and error rates for building applications on top of the platform. In practice, a developer can instruct the AI coding assistant to perform a variety of dynamic, data-driven tasks that streamline the development lifecycle. For instance, an instruction like "AI agent, find the album ID for 'Rumours' by Fleetwood Mac and then retrieve the list of its track durations" would allow the agent to execute two sequential tool calls, returning structured data the developer can immediately use to calculate total album runtime or test a UI component. Another workflow example could be: "Using the Spotify API, analyze the audio features of my playlist 'Focus Flow' and suggest five new tracks from similar artists that have a high 'instrumentalness' and 'acousticness' score." Here, the AI agent would chain multiple calls—fetching playlist tracks, extracting audio features, identifying unique artists, querying related artists, and then analyzing the features of those artists' top tracks—to provide a data-backed recommendation. This enables the developer to build sophisticated, personalized features by delegating the complex data aggregation and analysis to the AI agent, which interacts with the API on their behalf. Crucially, developers must recognize that while the API endpoints themselves are documented, any application acting on behalf of a user requires authentication and authorization via OAuth 2.0, despite the initial query noting "None." A secure integration mandates that the MCP server configuration should never hardcode user credentials. Best practice dictates implementing the OAuth 2.0 Authorization Code Flow, where the application requests only the specific scopes needed (e.g., `playlist-read-private` for reading user playlists, not `user-modify-playback-state` if control isn't required), adhering to the principle of least privilege. All API calls must be made over HTTPS, and refresh tokens must be stored securely, preferably in an environment secret manager. The MCP server should be configured to handle token refresh transparently, ensuring the AI agent's tool calls remain authenticated without exposing sensitive tokens in logs or client-side code, thus maintaining a secure and compliant integration architecture.
https://mcpbridge.org/config/spotify-com.jsonEvents API
The 1Password Events API is a specialized service provided by the password and credential management platform 1Password, designed for enterprise security teams, IT administrators, and security analysts. Its core capability is to provide a secure, queryable stream of audit events related to secret access and authentication activity within a 1Password organization or team. By aggregating data from the specified endpoints—`/api/v1/itemusages` for secret access logs and `/api/v1/signinattempts` for user authentication logs—it enables comprehensive monitoring, threat detection, and compliance reporting. Unlike a general-purpose API for managing vaults or secrets, this API is strictly read-focused, serving as the primary telemetry pipeline for security information and event management (SIEM) systems, custom alerting tools, and internal audit platforms. Typical use cases include correlating unusual secret access patterns with potential insider threats, verifying compliance with data access policies, generating audit trails for regulatory frameworks like SOC 2 or GDPR, and building real-time dashboards to visualize credential usage across an organization. Exposing this API as tools through the Model Context Protocol (MCP) for an AI coding assistant transforms it from a passive data source into an active analytical partner. The unique value lies in enabling the AI to perform contextual, natural language-driven security investigations directly within a developer's or analyst's workflow. Instead of manually writing API queries, filtering JSON responses, and piecing together timeline correlations, a user can instruct the AI to analyze the event stream for patterns. The AI can act as an expert security co-pilot, instantly querying the `/api/v1/itemusages` endpoint to identify which users accessed a specific secret, cross-referencing that with `/api/v1/signinattempts` to see if those access events align with suspicious login attempts from unfamiliar locations or devices, and then summarizing the findings. This turns raw log data into actionable intelligence without the context-switching overhead, dramatically reducing mean time to detection (MTTD) and response (MTTR) for security events. In a practical workflow, a developer or security engineer could use an MCP-enabled AI agent to perform dynamic, iterative tasks. For instance, they could instruct it with commands like, "Analyze item usage events for the 'production-api-key' secret from the past 24 hours and tell me if any access occurred outside of normal business hours," or "Compare all failed sign-in attempts for the '[email protected]' account with successful ones and highlight any discrepancies in IP addresses or user agents." More complex automations become possible, such as asking the AI to "Continuously monitor the sign-in attempts endpoint and generate a concise alert summary if you see more than five consecutive failures from a single IP range, then suggest potential containment steps." This allows the AI to handle repetitive monitoring, correlation, and initial triage tasks, freeing human experts to focus on high-level strategy and remediation. Critical to the setup and use of this MCP server are the strict security and authentication requirements. Although the API itself is listed as having "None" for authentication in the provided specification, this is a critical misnomer for a real-world implementation. In practice, accessing 1Password's event logs requires a dedicated service account with explicit, read-only permissions scoped to audit events, governed by 1Password's Connect server or a similar secure provisioning mechanism. Developers must follow the principle of least privilege, ensuring the service account token or credentials used by the MCP server can only query the event endpoints and nothing else. All configuration, especially the authentication secrets, must be managed outside of the AI's direct context, injected via secure environment variables or a dedicated secrets manager, and never hardcoded. It is also essential to configure the MCP server with strict rate limiting and to use encrypted connections (HTTPS) to prevent token interception, ensuring that this powerful analytical tool does not become a vector for credential leakage.
https://mcpbridge.org/config/1password-com-events.jsonAuthentiq API
The Authentiq API provides a robust foundation for implementing strong, passwordless authentication and identity verification systems. Developed by Authentiq, a specialist in modern digital identity solutions, this API enables the secure management of cryptographic keys and the orchestration of login and scope-based authorization flows. Its core capabilities are centered around the lifecycle management of public-private key pairs, which serve as the user's credentials. The endpoints allow for the creation of a new key pair (POST /key), retrieval of a public key by its ID (GET /key/{PK}), and associated management operations (POST, PUT, DELETE on the key resource). Beyond basic key management, the API facilitates the authentication process itself through the POST /login endpoint, which verifies a signature from the user's private key. The /scope endpoints introduce a layer of fine-grained, permission-based access control, allowing developers to define, query, and manage specific authorization scopes tied to a job or session. This makes the API ideal for enterprise applications requiring secure internal tool access, consumer-facing mobile or web apps seeking seamless login experiences without credential fatigue, and IoT ecosystems where device authentication is paramount. When exposed as tools via the Model Context Protocol (MCP) to an AI coding assistant, the Authentiq API transforms from a static set of endpoints into a dynamic, interactive capability. An AI agent, such as one running in Cursor or Cline, could be instructed to programmatically manage authentication infrastructure. For example, it could generate a new API key for a specific service (POST /key), rotate existing keys for security compliance (DELETE followed by POST for a given {PK}), or audit the status of currently active keys by retrieving their details (GET /key/{PK}). More profoundly, it could orchestrate complex authorization workflows by querying and validating user scopes (GET /scope/{job}) or dynamically creating new, time-bound authorization scopes for automated tasks (POST /scope/{job}). This integration empowers developers to delegate repetitive security and configuration tasks to the AI, accelerating setup, ensuring consistency in security policy application, and allowing for rapid prototyping of authentication systems within larger applications. In practical terms, a developer using an MCP-connected AI could issue natural language commands to perform sophisticated operational tasks. For instance, they could instruct, "Onboard a new partner service by generating a dedicated authentication key with the scope 'analytics:read' and 'logs:write'," prompting the AI to first create the key (POST /key) and then define the associated scope (POST /scope/{job}). Alternatively, a command like "Audit all active login sessions for the 'admin' scope" would have the AI agent use GET /scope/{job} to fetch and summarize the relevant records. The AI could also automate security workflows, such as "Revoke and replace the key used by the legacy reporting module" by executing a sequence of DELETE and POST operations. These dynamic interactions turn the AI into a force multiplier for DevOps and security engineering, handling routine yet critical identity management tasks with precision and speed that manual scripting cannot match. It is critical to note that while the API itself employs no built-in authentication method for its endpoints, this represents a significant security consideration, not a simplification. All interactions with the Authentiq API should occur over strictly encrypted channels (HTTPS). Developers must implement their own robust authentication and authorization layer in front of this API to control access to its powerful key and scope management functions. The principle of least privilege must be rigorously applied; any service or AI agent interacting with the API should be granted only the absolute minimum permissions necessary to perform its specific function. API keys or other secrets used to interact with Authentiq endpoints must be stored securely in environment variables or a secrets vault, never committed to source code. When configuring the MCP server, developers should ensure the AI assistant operates within a sandboxed context with tightly controlled outbound network rules, allowing it to communicate only with the designated Authentiq API endpoint.
https://mcpbridge.org/config/6-dot-authentiqio-appspot-com.jsonIP geolocation API
The IP Geolocation API, developed by AbstractAPI, is a robust and scalable RESTful service designed to provide developers with precise geographic, network, and contextual data associated with any given IPv4 or IPv6 address. Its core capability lies in translating a digital identifier—a public IP address—into a rich dataset that includes region, country, city, latitude, longitude, timezone, and ISP details. Beyond this fundamental geolocation, the API extends its value by offering supplementary metadata such as the local currency code, national flag, primary language, and security flags indicating whether an IP is from a corporate network or associated with a known threat actor. Typical enterprise use cases span from real-time user authentication and fraud prevention, where a login attempt from an unexpected location can trigger a security alert, to localized content delivery, ensuring users see region-appropriate pricing, language, and offers. For consumers and developers, it powers features like website analytics dashboards, personalized news feeds, and dynamic form auto-population. When integrated as a toolset via the Model Context Protocol (MCP) for an AI coding assistant, this API transitions from a static data source to a dynamic, interactive capability. The AI agent gains the ability to resolve geographic context on-demand, transforming it from a passive code generator into an active systems integrator. This means the assistant can, within a development session, dynamically fetch and incorporate real-world geographic data into its reasoning. For instance, when a developer is building a feature that requires regional logic, the AI can proactively query the API to validate assumptions about IP-to-region mappings, test localization logic with real country/city pairs, or even mock up API responses with accurate geopolitical data for unit tests. This direct, tool-based access significantly reduces context switching and manual lookup, accelerating the development of location-aware applications and allowing the AI to serve as a knowledgeable partner in implementing complex geospatial logic. Practical workflows enabled by this MCP integration are numerous and directly enhance productivity. A developer could instruct the AI agent with a command like, “Help me write a function to determine if a user is from the EU for GDPR compliance checks. Use the IP geolocation API to test it with these sample IPs: 8.8.8.8, 2001:4860:4860::8888, and 192.168.1.1.” The AI would then leverage the MCP tool to query the AbstractAPI endpoint for each IP, analyze the response to identify European country codes, and generate or refactor the compliance function accordingly. Another dynamic task could be, “Update our user onboarding script to automatically detect a user’s country from their IP and populate the ‘currency’ field in our database.” Here, the AI agent would use the API to understand the schema and data availability, then write or modify the integration code that calls the geolocation endpoint and maps the `currency` field to the database model. It can also perform diagnostic tasks like, “Analyze these 50 IP addresses from our access logs and categorize them by country to identify our top user markets,” using the API to process and aggregate the data. While the API currently operates without authentication, which simplifies initial integration for development and testing, developers must exercise critical caution in production deployments. The lack of API keys or OAuth tokens means there is no built-in mechanism for request throttling, usage tracking, or abuse prevention at the client level. Best practice dictates implementing strict access controls within your own application architecture, ensuring the API endpoint is never exposed directly to the public internet from a client-side application. Instead, it should be called exclusively from a secure backend server. This server-side implementation should act as a controlled gateway, enforcing rate limiting, logging requests, and ideally caching responses to minimize redundant calls and mitigate latency. Developers should also rigorously validate and sanitize all IP addresses received from untrusted sources before passing them to the API to prevent injection attacks. Following the principle of least privilege, the network firewall or rules for the calling server should be configured to only allow outbound traffic to the specific AbstractAPI endpoint, minimizing the potential attack surface.
https://mcpbridge.org/config/abstractapi-com-geolocation.json