@rui.branco/1password-mcp 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rui.branco/1password-mcp",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "1Password MCP server for Claude Code - list vaults and items, get secrets, generate passwords, manage items via service accounts. Multi-instance like jira-mcp.",
   "main": "index.js",
   "bin": {
@@ -24,7 +24,7 @@
   "author": "Rui Branco",
   "license": "MIT",
   "dependencies": {
-    "@1password/sdk": "^0.3.1",
+    "@1password/sdk": "^0.4.0",
     "@modelcontextprotocol/sdk": "^1.25.3"
   }
 }

package/setup.js

@@ -28,19 +28,37 @@ function saveConfig(cfg) {
 }
 
 // Non-interactive: setup add <name> <token> [description]
+//                  setup add-desktop <name> <accountName> [description]
 if (args[0] === "add" && args.length >= 3) {
   const [, name, token, ...descArgs] = args;
   const description = descArgs.join(" ").trim();
   const config = loadConfig() || {};
   if (!config.instances) config.instances = [];
   const existing = config.instances.findIndex((i) => i.name === name);
-  const instance = { name, token };
+  const instance = { name, authType: "serviceAccount", token };
   if (description) instance.description = description;
   if (existing >= 0) config.instances[existing] = instance;
   else config.instances.push(instance);
   if (!config.defaultInstance) config.defaultInstance = name;
   saveConfig(config);
-  console.log(`Instance "${name}" saved to ${configPath}`);
+  console.log(`Instance "${name}" saved to ${configPath} (serviceAccount)`);
+  process.exit(0);
+}
+
+if (args[0] === "add-desktop" && args.length >= 3) {
+  const [, name, accountName, ...descArgs] = args;
+  const description = descArgs.join(" ").trim();
+  const config = loadConfig() || {};
+  if (!config.instances) config.instances = [];
+  const existing = config.instances.findIndex((i) => i.name === name);
+  const instance = { name, authType: "desktop", accountName };
+  if (description) instance.description = description;
+  if (existing >= 0) config.instances[existing] = instance;
+  else config.instances.push(instance);
+  if (!config.defaultInstance) config.defaultInstance = name;
+  saveConfig(config);
+  console.log(`Instance "${name}" saved to ${configPath} (desktop: ${accountName})`);
+  console.log("Make sure the 1Password 8 desktop app is installed and the CLI integration is enabled (Settings → Developer → Connect with 1Password CLI).");
   process.exit(0);
 }
 
@@ -88,19 +106,86 @@ async function setup() {
     }
   }
 
-  console.log("To create a 1Password service account token:");
-  console.log("1. Go to https://start.1password.com/developer-tools/infrastructure-secrets/serviceaccount");
-  console.log("2. Create a service account and grant it access to the vaults you need");
-  console.log("3. Copy the token (starts with 'ops_')\n");
+  console.log("Pick auth mode:");
+  console.log("  1. Desktop app (recommended for personal use — uses 1Password 8 biometric unlock, full vault access)");
+  console.log("  2. Service account token (recommended for CI/shared — needs admin to provision, scoped vaults only)\n");
+  const mode = (await ask("Auth mode (1/2, default 1): ")).trim() || "1";
 
   const name = (await ask("Instance name (e.g., work): ")).trim();
-  const token = (await ask("Service account token: ")).trim();
   const description = (await ask("Description (optional): ")).trim();
 
   const config = existing || { instances: [] };
   if (!config.instances) config.instances = [];
   const idx = config.instances.findIndex((i) => i.name === name);
-  const instance = { name, token };
+  let instance;
+
+  if (mode === "2") {
+    console.log("\nCreate a service account token at:");
+    console.log("  https://start.1password.com/developer-tools/infrastructure-secrets/serviceaccount");
+    const token = (await ask("Service account token (ops_...): ")).trim();
+    instance = { name, authType: "serviceAccount", token };
+  } else {
+    console.log("\n=== One-time 1Password 8 setup (required for desktop auth) ===");
+    console.log("");
+    console.log("Open the 1Password 8 desktop app (not the browser — the Mac/Windows app).");
+    console.log("");
+    console.log("  1. Open Settings (cmd+, on Mac / ctrl+, on Windows)");
+    console.log("  2. Click the 'Developer' tab on the left");
+    console.log("  3. Tick 'Integrate with 1Password CLI'");
+    console.log("     (under 'Command-Line Interface (CLI)')");
+    console.log("  4. Tick 'Integrate with other apps'");
+    console.log("     (under 'Integrate with the 1Password SDKs')");
+    console.log("     ** THIS IS THE KEY ONE — without it the SDK can't unlock. **");
+    console.log("  5. (Optional) Settings → Security → 'Unlock using Touch ID'");
+    console.log("");
+    console.log("The first time the MCP calls 1Password you'll get a system prompt");
+    console.log("asking to authorize '1password-mcp' — click Approve.");
+    console.log("");
+    console.log("=== Finding your account name ===");
+    console.log("");
+    console.log("Open 1Password 8 → click the account switcher in the top-left.");
+    console.log("The signin address shown next to your name is what you want here,");
+    console.log("e.g. 'my.1password.com' or 'my-team.1password.com'.");
+    console.log("");
+    const accountName = (await ask("Account name (e.g., my.1password.com): ")).trim();
+    if (!accountName) {
+      console.error("Account name is required. Aborting.");
+      rl.close();
+      process.exit(1);
+    }
+    instance = { name, authType: "desktop", accountName };
+
+    // Validate by actually trying to talk to the desktop app. This will pop the
+    // OS-level authorization prompt on first use.
+    console.log("\nValidating with 1Password desktop app (you may get an auth prompt)…");
+    try {
+      const sdk = require("@1password/sdk");
+      const client = await sdk.createClient({
+        auth: new sdk.DesktopAuth(accountName),
+        integrationName: "1password-mcp-setup",
+        integrationVersion: "v1",
+      });
+      const probe = [];
+      for await (const v of await client.vaults.list()) {
+        probe.push(v);
+        if (probe.length >= 1) break;
+      }
+      console.log(`Validated. Saw vault: ${probe[0]?.title || "(none visible)"}.`);
+    } catch (e) {
+      console.error("");
+      console.error("Validation failed: " + e.message);
+      console.error("");
+      console.error("Common causes:");
+      console.error("  - 'Integrate with other apps' is NOT ticked in 1Password Settings → Developer");
+      console.error("  - 1Password 8 desktop app is not running or locked");
+      console.error("  - Account name is wrong (check the account switcher in 1Password 8)");
+      console.error("");
+      console.error("Fix the issue and re-run this setup.");
+      rl.close();
+      process.exit(1);
+    }
+  }
+
   if (description) instance.description = description;
   if (idx >= 0) config.instances[idx] = instance;
   else config.instances.push(instance);