@rui.branco/1password-mcp 0.1.3 → 0.1.5

package/index.js

@@ -361,7 +361,7 @@ const TOOL_DEFINITIONS = [
   {
     name: "op_search_items",
     description:
-      "Search items by title across vaults. If `vault` is omitted, searches every vault the account can see.",
+      "Search items by title across vaults. When the user asks for a specific credential by name (e.g. 'give me the wifi password', 'what's my GitHub login'), call this with `reveal: true` to get the password/credential values back in a single call — no follow-up op_get_item needed. If `vault` is omitted, searches every vault the account can see. When there are 1–5 matches with reveal=true, return all of them; the user already consented to seeing concealed values by asking for them.",
     inputSchema: {
       type: "object",
       properties: {
@@ -375,7 +375,12 @@ const TOOL_DEFINITIONS = [
         },
         limit: {
           type: "number",
-          description: "Max results (default 25).",
+          description: "Max results (default 25, or 5 when reveal=true to avoid fetching too many items).",
+        },
+        reveal: {
+          type: "boolean",
+          description:
+            "If true, fetch each match's full item and return concealed field values (passwords, TOTPs) in cleartext. Use this when the user is asking for a credential by name — one call gets search + retrieval + reveal. Defaults to false.",
         },
         instance: {
           type: "string",
@@ -514,6 +519,105 @@ const TOOL_DEFINITIONS = [
       required: ["vault", "title"],
     },
   },
+  {
+    name: "op_update_item",
+    description:
+      "Update any part of an existing item — title, category, fields, tags, websites, sections, or notes. Omitted parameters are preserved. Fields are patched by title (existing fields match case-insensitively; new fields require `type`). Tags, websites, and sections are REPLACED when passed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        vault: { type: "string", description: "Vault id or title." },
+        item: { type: "string", description: "Item id or title to update." },
+        title: { type: "string", description: "New title (optional)." },
+        category: {
+          type: "string",
+          description:
+            "New category (rare). One of Login, SecureNote, Password, ApiCredentials, Database, Server, Email, Identity, CreditCard, etc.",
+        },
+        fields: {
+          type: "array",
+          description:
+            "Field patches: [{title, value, type?, sectionId?}]. Existing fields matched by title have their values replaced. New fields require `type` (Text | Concealed | Totp | Email | Url | Phone).",
+          items: {
+            type: "object",
+            properties: {
+              title: { type: "string" },
+              value: { type: "string" },
+              type: { type: "string" },
+              sectionId: { type: "string" },
+            },
+            required: ["title", "value"],
+          },
+        },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description:
+            "Replace the tag list. Omit to preserve existing tags; pass [] to clear.",
+        },
+        websites: {
+          type: "array",
+          description:
+            "Replace the website list. Each website is {url, label?, autofillBehavior?}. Omit to preserve existing websites.",
+          items: {
+            type: "object",
+            properties: {
+              url: { type: "string" },
+              label: { type: "string" },
+              autofillBehavior: {
+                type: "string",
+                description: "'AnywhereOnWebsite' (default) or 'Never'.",
+              },
+            },
+            required: ["url"],
+          },
+        },
+        sections: {
+          type: "array",
+          description: "Replace the section list. Each section is {title, id?}.",
+          items: {
+            type: "object",
+            properties: {
+              title: { type: "string" },
+              id: { type: "string" },
+            },
+            required: ["title"],
+          },
+        },
+        notes: {
+          type: "string",
+          description:
+            "Replace the notesPlain field. Omit to preserve existing notes.",
+        },
+        instance: {
+          type: "string",
+          description: "Instance name. Uses default if omitted.",
+        },
+      },
+      required: ["vault", "item"],
+    },
+  },
+  {
+    name: "op_update_vault",
+    description:
+      "Update a vault's title and/or description. Pass at least one of them.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        vault: { type: "string", description: "Vault id or title." },
+        title: { type: "string", description: "New title (optional)." },
+        description: {
+          type: "string",
+          description: "New description (optional).",
+        },
+        instance: {
+          type: "string",
+          description: "Instance name. Uses default if omitted.",
+        },
+      },
+      required: ["vault"],
+    },
+  },
   {
     name: "op_delete_item",
     description: "Delete an item by vault + item reference.",
@@ -709,15 +813,19 @@ async function listItemsHandler(args) {
   return `# Items in ${vault.title} (${items.length})\n\n${lines.join("\n")}`;
 }
 
-async function searchItemsHandler(args) {
-  const client = await getClient(getInstanceByName(args.instance));
-  const limit = args.limit || 25;
-  const q = String(args.query).toLowerCase();
+/**
+ * Core search implementation — pulled out of the handler so it can be unit
+ * tested with a fake client. Accepts an already-resolved client.
+ */
+async function searchItems(client, { query, vault, reveal, limit }) {
+  const wantReveal = !!reveal;
+  const max = limit || (wantReveal ? 5 : 25);
+  const q = String(query).toLowerCase();
 
   let targetVaults;
-  if (args.vault) {
-    const v = await resolveVault(client, args.vault);
-    if (!v) throw new Error(`Vault "${args.vault}" not found.`);
+  if (vault) {
+    const v = await resolveVault(client, vault);
+    if (!v) throw new Error(`Vault "${vault}" not found.`);
     targetVaults = [v];
   } else {
     targetVaults = await collect(await client.vaults.list());
@@ -727,19 +835,66 @@ async function searchItemsHandler(args) {
   for (const v of targetVaults) {
     for await (const it of await client.items.list(v.id)) {
       if ((it.title || "").toLowerCase().includes(q)) {
-        hits.push({ ...it, _vaultTitle: v.title });
-        if (hits.length >= limit) break;
+        hits.push({ ...it, _vaultId: v.id, _vaultTitle: v.title });
+        if (hits.length >= max) break;
       }
     }
-    if (hits.length >= limit) break;
+    if (hits.length >= max) break;
   }
 
-  if (hits.length === 0) return `No items matched "${args.query}".`;
-  const lines = hits.map(
-    (it) =>
-      `- **${it.title}** (id: ${it.id}, vault: ${it._vaultTitle}, category: ${it.category})`,
+  if (hits.length === 0) return `No items matched "${query}".`;
+
+  if (!wantReveal) {
+    const lines = hits.map(
+      (it) =>
+        `- **${it.title}** (id: ${it.id}, vault: ${it._vaultTitle}, category: ${it.category})`,
+    );
+    return `# Search: "${query}" (${hits.length})\n\n${lines.join("\n")}`;
+  }
+
+  // reveal=true: fetch each hit's full item in parallel and render every
+  // field (including concealed values). One-shot path for "give me the X
+  // credential" style queries.
+  const full = await Promise.all(
+    hits.map(async (it) => {
+      try {
+        const item = await client.items.get(it._vaultId, it.id);
+        return { item, _vaultTitle: it._vaultTitle, _error: null };
+      } catch (e) {
+        return { item: it, _vaultTitle: it._vaultTitle, _error: e.message };
+      }
+    }),
   );
-  return `# Search: "${args.query}" (${hits.length})\n\n${lines.join("\n")}`;
+
+  const sections = full.map((entry) => {
+    if (entry._error) {
+      return `## ${entry.item.title}\n\n_Failed to fetch: ${entry._error}_`;
+    }
+    const it = entry.item;
+    const fields = (it.fields || [])
+      .map((f) => redactField(f, true))
+      .filter((f) => f.value !== undefined && f.value !== "");
+    const fieldLines = fields.length
+      ? fields
+          .map((f) => {
+            const otp = f.otp ? ` (OTP now: ${f.otp})` : "";
+            return `- **${f.title}** (${f.type}): ${f.value}${otp}`;
+          })
+          .join("\n")
+      : "_(no fields)_";
+    const websites = (it.websites || []).map((w) => w.url).filter(Boolean);
+    const websiteLine = websites.length
+      ? `- **URLs:** ${websites.join(", ")}\n`
+      : "";
+    return `## ${it.title} (${it.category})\n\n- **Vault:** ${entry._vaultTitle}\n- **Item ID:** ${it.id}\n${websiteLine}\n${fieldLines}`;
+  });
+
+  return `# Search (revealed): "${query}" (${hits.length})\n\n${sections.join("\n\n")}`;
+}
+
+async function searchItemsHandler(args) {
+  const client = await getClient(getInstanceByName(args.instance));
+  return searchItems(client, args);
 }
 
 async function getItemHandler(args) {
@@ -823,6 +978,113 @@ function generatePasswordHandler(args) {
   return `Generated (${type}):\n${pwd}`;
 }
 
+async function updateItemHandler(args) {
+  const client = await getClient(getInstanceByName(args.instance));
+  const vault = await resolveVault(client, args.vault);
+  if (!vault) throw new Error(`Vault "${args.vault}" not found.`);
+  const itemRef = await resolveItem(client, vault, args.item);
+  if (!itemRef) {
+    throw new Error(
+      `Item "${args.item}" not found in vault "${vault.title}".`,
+    );
+  }
+
+  const current = await client.items.get(vault.id, itemRef.id);
+  const updated = { ...current };
+
+  // --- title (rename) ---
+  if (args.title) updated.title = args.title;
+
+  // --- category (rarely changed, but the SDK allows it) ---
+  if (args.category) {
+    const cat = sdk.ItemCategory[args.category];
+    if (!cat) throw new Error(`Unknown category "${args.category}".`);
+    updated.category = cat;
+  }
+
+  // --- tags (replace when passed; preserved when omitted) ---
+  if (args.tags) updated.tags = args.tags;
+
+  // --- websites (replace when passed; preserved when omitted) ---
+  if (Array.isArray(args.websites)) {
+    updated.websites = args.websites.map((w) => ({
+      url: w.url,
+      label: w.label || "website",
+      autofillBehavior:
+        w.autofillBehavior === "Never"
+          ? sdk.AutofillBehavior.Never
+          : sdk.AutofillBehavior.AnywhereOnWebsite,
+    }));
+  }
+
+  // --- sections (replace when passed; preserved when omitted) ---
+  if (Array.isArray(args.sections)) {
+    updated.sections = args.sections.map((s) => ({
+      id: s.id || s.title.toLowerCase().replace(/\s+/g, "_"),
+      title: s.title,
+    }));
+  }
+
+  // --- fields (patch by title, add new ones with explicit type) ---
+  const nextFields = [...(current.fields || [])];
+  const fieldIndexByTitle = new Map(
+    nextFields.map((f, idx) => [(f.title || "").toLowerCase(), idx]),
+  );
+
+  function upsertField({ title, value, type, sectionId }) {
+    const key = title.toLowerCase();
+    const existingIdx = fieldIndexByTitle.get(key);
+    if (existingIdx !== undefined) {
+      nextFields[existingIdx] = { ...nextFields[existingIdx], value };
+      return;
+    }
+    if (!type) {
+      throw new Error(
+        `Field "${title}" doesn't exist on the item — pass a 'type' to add it as a new field.`,
+      );
+    }
+    const ft = sdk.ItemFieldType[type];
+    if (!ft) throw new Error(`Unknown field type "${type}".`);
+    const added = {
+      id: title.toLowerCase().replace(/\s+/g, "_"),
+      title,
+      fieldType: ft,
+      value,
+    };
+    if (sectionId) added.sectionId = sectionId;
+    fieldIndexByTitle.set(key, nextFields.length);
+    nextFields.push(added);
+  }
+
+  if (Array.isArray(args.fields)) {
+    for (const patch of args.fields) upsertField(patch);
+  }
+
+  // --- notes: stored as a 'notesPlain' Text field, so patch it the same way ---
+  if (args.notes !== undefined) {
+    upsertField({ title: "notesPlain", value: args.notes, type: "Text" });
+  }
+
+  updated.fields = nextFields;
+
+  const result = await client.items.put(updated);
+  return `Updated item "${result.title}" (id: ${result.id}) in vault "${vault.title}".`;
+}
+
+async function updateVaultHandler(args) {
+  const client = await getClient(getInstanceByName(args.instance));
+  const vault = await resolveVault(client, args.vault);
+  if (!vault) throw new Error(`Vault "${args.vault}" not found.`);
+  if (!args.title && args.description === undefined) {
+    throw new Error("Provide at least one of title or description.");
+  }
+  await client.vaults.update(vault.id, {
+    title: args.title || vault.title,
+    description: args.description !== undefined ? args.description : vault.description || "",
+  });
+  return `Updated vault "${args.title || vault.title}" (id: ${vault.id}).`;
+}
+
 async function createItemHandler(args) {
   const client = await getClient(getInstanceByName(args.instance));
   const vault = await resolveVault(client, args.vault);
@@ -909,8 +1171,10 @@ const HANDLERS = {
   op_get_secret: getSecretHandler,
   op_generate_password: generatePasswordHandler,
   op_create_item: createItemHandler,
+  op_update_item: updateItemHandler,
   op_delete_item: deleteItemHandler,
   op_create_vault: createVaultHandler,
+  op_update_vault: updateVaultHandler,
   op_delete_vault: deleteVaultHandler,
 };
 
@@ -996,6 +1260,7 @@ if (typeof module !== "undefined") {
     resolveItem,
     redactField,
     formatItem,
+    searchItems,
     // handler map + tool list (for drift guard tests)
     TOOL_DEFINITIONS,
     HANDLERS,
@@ -1006,5 +1271,7 @@ if (typeof module !== "undefined") {
     searchItemsHandler,
     getItemHandler,
     generatePasswordHandler,
+    updateItemHandler,
+    updateVaultHandler,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rui.branco/1password-mcp",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "1Password MCP server for Claude Code - list vaults and items, get secrets, generate passwords, manage items via service accounts. Multi-instance like jira-mcp.",
   "main": "index.js",
   "bin": {