{
  "data": {
    "a": {
      "slug": "1password",
      "name": "1Password service accounts, SDKs and Environments MCP",
      "vendor": "1Password",
      "vendorUrl": "https://1password.com",
      "kind": "platform",
      "category": "secrets",
      "summary": "Password manager with a developer layer for agents.",
      "url": "https://www.anchorterminal.com/tools/1password",
      "markdownUrl": "https://www.anchorterminal.com/tools/1password.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/1password.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/1password.json",
      "repo": "https://github.com/1Password/onepassword-sdk-js",
      "license": "MIT",
      "transports": [
        "stdio"
      ],
      "packages": [
        {
          "registry": "npm",
          "name": "@1password/sdk"
        },
        {
          "registry": "pypi",
          "name": "onepassword-sdk"
        }
      ],
      "auth": "mixed",
      "authNotes": "Service account tokens (`OP_SERVICE_ACCOUNT_TOKEN`) for unattended use, scoped to chosen vaults and Environments and unable to read Personal, Private or Employee vaults. The SDKs can instead prompt the 1Password desktop app, which approves each integration locally with biometrics. The Environments MCP server runs inside the desktop app and asks for approval per Environment until the app locks.",
      "pricing": "paid",
      "pricingNotes": "No free plan, a 14-day trial on every plan. Individual $3.99 a month ($2.99 promotional, billed yearly), Families $5.99 a month for up to 5 people ($4.49 promotional, billed yearly), Teams Starter Pack $24.95 a month for 10 members plus $4.99 a seat, Business $8.99 per user a month billed yearly. The personal pricing page lists 1Password Developer (SSH, Git commit signing, CLI and SDKs) on Individual and Families, and the business page lists the CLI and SDKs on Teams Starter Pack and Business. Service account rate limits are published for every plan. Unified Access, Privileged Access and the other enterprise products are quote only (https://1password.com/pricing/business, https://1password.com/pricing/password-manager).",
      "priceSummary": "$8.99 / seat-mo",
      "where": "local",
      "x402": {
        "level": "no",
        "endpoints": []
      },
      "toolCount": 8,
      "popularity": {
        "githubStars": 110,
        "npmWeekly": 1013526,
        "pypiWeekly": 816683,
        "asOf": "2026-09-30"
      },
      "docsUrl": "https://www.1password.dev",
      "llmsTxt": "https://www.1password.dev/llms.txt",
      "openapi": "https://i.1password.com/media/1password-connect/1password-connect-api_1.8.1.yaml",
      "capabilities": [
        "secrets.store",
        "secrets.machine-identity",
        "secrets.audit"
      ],
      "tags": [
        "hosted",
        "closed-source",
        "card-required",
        "mcp",
        "local",
        "typescript",
        "python",
        "go",
        "enterprise",
        "eu"
      ],
      "lastRelease": "2026-07-31",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 69.9,
        "grade": "B",
        "agentReady": false,
        "rank": 104,
        "ranked": true,
        "rankOf": 452,
        "categoryRank": 6,
        "methodology": "0.3",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 69,
          "maintenance": 72,
          "payments": 20,
          "reliability": 68,
          "schema": 74,
          "security": 94,
          "transparency": 89
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-10-01"
        },
        "negative": 0,
        "verdict": "Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After.",
        "strengths": [
          "Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation",
          "Environments MCP server with 8 tools that never returns a secret value and asks for approval per Environment",
          "Official Go, JavaScript and Python SDKs, MIT, with workload identity through the Credential Broker in JavaScript 0.5.0 (public preview)",
          "llms.txt for the developer docs and a public OpenAPI file for the self-hosted Connect server",
          "Signed security.txt, a HackerOne programme, SOC 2 Type II and ISO 27001 listed on the trust centre"
        ],
        "weaknesses": [
          "Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After",
          "SDKs are version 0 with three months of patches per release, and 5 of the 8 newest Python SDK issues have no reply",
          "No SLA found, and the audit log and Events API need Business",
          "The MCP server is beta and needs the desktop app running and unlocked, so it's for a developer's machine, not a server",
          "No MCP registry entry and no way to create a service account without a signed-in person"
        ],
        "agentNotes": [
          "Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config",
          "On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After",
          "Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later",
          "Set integrationName and integrationVersion in createClient so the usage report shows which agent read what",
          "Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 2,
        "avgRating": 3.5,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "B",
            "methodology": "0.3",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 69.9
          }
        ],
        "editorialScores": {
          "ergonomics": 69,
          "maintenance": 72,
          "payments": 20,
          "reliability": 68,
          "schema": 74,
          "security": 94,
          "transparency": 78
        },
        "provenanceScore": 100
      },
      "connect": {
        "install": "npm install @1password/sdk   # or: pip install onepassword-sdk",
        "http": "export OP_SERVICE_ACCOUNT_TOKEN=\"$OP_SERVICE_ACCOUNT_TOKEN\"\nop read \"op://Production/Stripe/api_key\"   # 1Password CLI, no REST endpoint for secret reads",
        "config": {
          "mcpServers": {
            "1password": {
              "args": [],
              "command": "1password-mcp"
            }
          }
        }
      },
      "letme": {
        "capability": "https://letme.dev/secrets.store",
        "tool": "https://letme.dev/1password"
      },
      "area": "agent-runtime",
      "unitPrices": [
        {
          "item": "Business plan",
          "unit": "seat-month",
          "usd": 8.99,
          "note": "Billed yearly. Developer tools and SSO included"
        },
        {
          "item": "Teams Starter Pack",
          "unit": "month",
          "usd": 24.95,
          "note": "10 members, $4.99 a month per extra seat"
        },
        {
          "item": "Individual plan",
          "unit": "month",
          "usd": 3.99,
          "note": "$2.99 promotional, billed yearly"
        }
      ],
      "provenance": {
        "legalEntity": "AgileBits Inc. (doing business as 1Password)",
        "domain": "1password.com",
        "domainRegistered": "2003-11-30",
        "endpointOnVendorDomain": true,
        "terms": "https://1password.com/legal/terms-of-service",
        "privacy": "https://1password.com/legal/privacy",
        "statusPage": "https://status.1password.com",
        "changelog": "https://releases.1password.com/developers/sdks/",
        "securityTxt": "valid",
        "checked": "2026-10-01",
        "notes": [
          "Terms name AgileBits Inc., 4711 Yonge Street, Toronto, governed by Ontario law, last updated 12 September 2024. The privacy notice is effective 29 December 2025.",
          "security.txt lists security@agilebits.com and a HackerOne programme and is signed, but has no Expires field.",
          "developer.1password.com now redirects to www.1password.dev.",
          "The status page history shows six incidents between 2 July and 9 September 2026, on Device Trust, SaaS Manager, personal account management and the CLI update server, none posted against service accounts or Connect."
        ],
        "score": 100
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/1password.json",
      "live": {
        "slug": "1password",
        "vendorStatus": {
          "page": "https://status.1password.com",
          "indicator": "none",
          "summary": "All Systems Operational",
          "checkedAt": "2026-10-05T00:11:10.880019416Z"
        },
        "versions": [
          {
            "registry": "github",
            "name": "1Password/onepassword-sdk-js",
            "version": "v0.5.0",
            "released": "2026-07-31",
            "seenAt": "2026-10-04T16:19:29.795045796Z"
          },
          {
            "registry": "npm",
            "name": "@1password/sdk",
            "version": "0.5.0",
            "seenAt": "2026-10-04T16:19:27.453978185Z"
          },
          {
            "registry": "pypi",
            "name": "onepassword-sdk",
            "version": "0.4.1",
            "released": "2026-07-30",
            "seenAt": "2026-10-04T16:19:28.470969321Z"
          }
        ],
        "githubStars": 110,
        "npmWeekly": 1144520,
        "pypiWeekly": 907992,
        "securityTxt": {
          "url": "https://1password.com/.well-known/security.txt",
          "state": "valid",
          "checkedAt": "2026-10-04T15:15:51.698169765Z"
        },
        "llmsTxt": {
          "url": "https://www.1password.dev/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-10-04T15:17:12.603904586Z"
        },
        "domain": {
          "domain": "1password.com",
          "registered": "2003-11-30",
          "source": "https://rdap.verisign.com/com/v1/domain/1password.com",
          "checkedAt": "2026-10-04T13:03:36.930043964Z"
        },
        "pages": [
          {
            "url": "https://releases.1password.com/developers/sdks/",
            "kind": "changelog",
            "status": 304,
            "checkedAt": "2026-10-04T15:47:15.347202499Z",
            "changedAt": "2026-10-03T15:35:15.432558355Z",
            "fingerprint": "70bd81831178"
          },
          {
            "url": "https://1password.com/pricing/business",
            "kind": "pricing",
            "status": 200,
            "checkedAt": "2026-10-04T15:41:11.172504664Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "c7410e7a546a"
          },
          {
            "url": "https://1password.com/pricing/password-manager",
            "kind": "pricing",
            "status": 200,
            "checkedAt": "2026-10-04T15:41:13.479557667Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "20bf1ab35205"
          },
          {
            "url": "https://1password.com/legal/privacy",
            "kind": "privacy",
            "status": 200,
            "checkedAt": "2026-10-04T15:41:07.067811579Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "7a043d1fa57f"
          },
          {
            "url": "https://1password.com/legal/terms-of-service",
            "kind": "terms",
            "status": 200,
            "checkedAt": "2026-10-04T15:41:09.169984797Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "440d3b48cc3c"
          }
        ],
        "updatedAt": "2026-10-05T00:11:10.880019416Z"
      }
    },
    "b": {
      "slug": "aws-secrets-manager",
      "name": "AWS Secrets Manager",
      "vendor": "Amazon Web Services",
      "vendorUrl": "https://aws.amazon.com/secrets-manager/",
      "kind": "http-api",
      "category": "secrets",
      "summary": "Managed secrets store priced per secret and per API call, with IAM for access, KMS for encryption, CloudTrail for audit, cross-region replication and rotation either managed (RDS, Aurora, DocumentDB, Redshift) or by a Lambda function you own.",
      "url": "https://www.anchorterminal.com/tools/aws-secrets-manager",
      "markdownUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json",
      "transports": [
        "http"
      ],
      "remoteUrl": "https://secretsmanager.us-east-1.amazonaws.com",
      "packages": [
        {
          "registry": "npm",
          "name": "@aws-sdk/client-secrets-manager"
        },
        {
          "registry": "pypi",
          "name": "boto3"
        }
      ],
      "auth": "mixed",
      "authNotes": "SigV4-signed requests with AWS credentials. On AWS compute the runtime gets short-lived credentials from an IAM role; elsewhere it needs AWS credentials of its own. The caller needs secretsmanager:GetSecretValue and, for a customer-managed KMS key, kms:Decrypt. Resource policies on a secret can grant cross-account access.",
      "pricing": "usage",
      "pricingNotes": "$0.40 per secret a month and $0.05 per 10,000 API calls, with no charge for the new versions rotation creates. New AWS customers since 15 July 2025 get up to $200 of Free Tier credit usable on Secrets Manager, with the free plan lasting 6 months and all credits expiring within 12 months; an AWS account needs a payment method (https://aws.amazon.com/secrets-manager/pricing/).",
      "priceSummary": "$0.40 / mo",
      "where": "hosted",
      "x402": {
        "level": "no",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": null,
        "npmWeekly": 15195593,
        "pypiWeekly": 578449536,
        "asOf": "2026-09-30"
      },
      "docsUrl": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/",
      "llmsTxt": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/llms.txt",
      "capabilities": [
        "secrets.store",
        "secrets.rotate",
        "secrets.machine-identity",
        "secrets.audit",
        "infra.aws"
      ],
      "tags": [
        "hosted",
        "closed-source",
        "usage-priced",
        "card-required",
        "llms-txt",
        "typescript",
        "python",
        "go",
        "enterprise",
        "eu"
      ],
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 78.1,
        "grade": "A",
        "agentReady": true,
        "rank": 15,
        "ranked": true,
        "rankOf": 452,
        "categoryRank": 2,
        "methodology": "0.3",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 90,
          "maintenance": 65,
          "payments": 20,
          "reliability": 87,
          "schema": 96,
          "security": 88,
          "transparency": 79
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-10-01"
        },
        "negative": 0,
        "verdict": "IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.",
        "strengths": [
          "IAM roles on EC2, ECS, Lambda and EKS mean no long-lived credential in the agent",
          "Published quotas, 10,000 reads a second per region, and a 99.99% SLA",
          "Idempotent writes on ClientRequestToken and immutable versions",
          "CloudTrail entry for every call, and KMS encryption with your own key if you want",
          "llms.txt for the user guide and typed service models in every AWS SDK"
        ],
        "weaknesses": [
          "Every API call is billed, so per-request reads add up and the docs push you to cache",
          "Rotation outside the RDS family means writing and running a Lambda function",
          "Off-AWS agents need AWS credentials of their own, often a static access key",
          "No Secrets Manager MCP server, and the general AWS API server's read-only mode still allows GetSecretValue",
          "The security.txt at aws.amazon.com expired on 24 September 2026, and signup needs a payment method"
        ],
        "agentNotes": [
          "Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard",
          "Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged",
          "Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second",
          "Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes",
          "Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 8,
        "avgRating": 3.9,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "A",
            "methodology": "0.3",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 78.1
          }
        ],
        "editorialScores": {
          "ergonomics": 90,
          "maintenance": 65,
          "payments": 20,
          "reliability": 87,
          "schema": 96,
          "security": 88,
          "transparency": 63
        },
        "provenanceScore": 95
      },
      "connect": {
        "install": "pip install boto3   # or: npm i @aws-sdk/client-secrets-manager",
        "http": "curl -X POST \"https://secretsmanager.us-east-1.amazonaws.com/\" \\\n  --aws-sigv4 \"aws:amz:us-east-1:secretsmanager\" --user \"$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY\" \\\n  -H \"X-Amz-Target: secretsmanager.GetSecretValue\" -H \"Content-Type: application/x-amz-json-1.1\" \\\n  -d '{\"SecretId\":\"prod/myapp/db\"}'"
      },
      "letme": {
        "capability": "https://letme.dev/secrets.store",
        "tool": "https://letme.dev/aws-secrets-manager"
      },
      "sameCompany": [
        "amazon-bedrock-guardrails",
        "amazon-transcribe",
        "amazon-polly",
        "aws-mcp-servers",
        "amazon-ses",
        "amazon-translate"
      ],
      "area": "agent-runtime",
      "unitPrices": [
        {
          "item": "Stored secret",
          "unit": "month",
          "usd": 0.4,
          "note": "Per secret a month"
        },
        {
          "item": "API calls",
          "unit": "1k-calls",
          "usd": 0.005,
          "note": "$0.05 per 10,000 calls"
        }
      ],
      "provenance": {
        "legalEntity": "Amazon Web Services, Inc. (Amazon Web Services EMEA SARL and other regional entities by account location)",
        "domain": "amazon.com",
        "domainRegistered": "1994-11-01",
        "domainNote": "The service lives under aws.amazon.com, a subdomain of amazon.com.",
        "endpointOnVendorDomain": true,
        "terms": "https://aws.amazon.com/service-terms/",
        "privacy": "https://aws.amazon.com/privacy/",
        "statusPage": "https://health.aws.amazon.com/health/status",
        "changelog": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/doc-history.html",
        "securityTxt": "expired",
        "checked": "2026-10-01",
        "notes": [
          "Service Terms last updated 15 September 2026 name Amazon Web Services, Inc. for most customers and regional entities for Australia, Japan, Korea, EMEA and India. The privacy notice (18 May 2026) gives 410 Terry Avenue North, Seattle, WA 98109-5210.",
          "security.txt Expires 2026-09-24T16:25:03Z, so it had lapsed when we checked on 1 October 2026. It points to the AWS VDP on HackerOne.",
          "The pricing page loaded on 1 October 2026 and confirms $0.40 a secret a month and $0.05 per 10,000 calls.",
          "The document history page returned too many redirects again; the newest Secrets Manager API model change in botocore is from 11 December 2025.",
          "health.aws.amazon.com/health/status is a JavaScript page; the per-service RSS feed for Secrets Manager in us-east-1 had no items on 1 October 2026."
        ],
        "score": 95
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.json",
      "live": {
        "slug": "aws-secrets-manager",
        "probe": {
          "target": "https://secretsmanager.us-east-1.amazonaws.com",
          "method": "get",
          "lastAt": "2026-10-05T00:15:19.508621801Z",
          "lastOk": true,
          "lastStatus": 404,
          "lastMs": 1908,
          "authRequired": false,
          "uptime24h": 100,
          "uptime30d": 100,
          "p50ms24h": 1801,
          "p95ms24h": 2236,
          "samples24h": 272,
          "samples30d": 903,
          "days": [
            {
              "date": "2026-10-01",
              "probes": 109,
              "ok": 109
            },
            {
              "date": "2026-10-02",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-10-03",
              "probes": 271,
              "ok": 271
            },
            {
              "date": "2026-10-04",
              "probes": 272,
              "ok": 272
            },
            {
              "date": "2026-10-05",
              "probes": 3,
              "ok": 3
            }
          ]
        },
        "versions": [
          {
            "registry": "npm",
            "name": "@aws-sdk/client-secrets-manager",
            "version": "3.1146.0",
            "seenAt": "2026-10-04T16:21:22.18150713Z"
          },
          {
            "registry": "pypi",
            "name": "boto3",
            "version": "1.43.108",
            "released": "2026-10-02",
            "seenAt": "2026-10-04T16:21:22.994336287Z"
          }
        ],
        "npmWeekly": 16134158,
        "pypiWeekly": 576017728,
        "securityTxt": {
          "url": "https://amazon.com/.well-known/security.txt",
          "state": "valid",
          "checkedAt": "2026-10-04T15:15:49.458098289Z"
        },
        "llmsTxt": {
          "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-10-04T15:17:22.883710357Z"
        },
        "domain": {
          "domain": "amazon.com",
          "registered": "1994-11-01",
          "source": "https://rdap.verisign.com/com/v1/domain/amazon.com",
          "checkedAt": "2026-10-04T13:06:18.739682554Z"
        },
        "pages": [
          {
            "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/doc-history.html",
            "kind": "changelog",
            "status": 304,
            "checkedAt": "2026-10-04T15:43:18.235511313Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "e3b0c44298fc"
          },
          {
            "url": "https://aws.amazon.com/secrets-manager/pricing/",
            "kind": "pricing",
            "status": 304,
            "checkedAt": "2026-10-04T15:41:34.797947893Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "d96ff3d82a94"
          }
        ],
        "updatedAt": "2026-10-05T00:15:19.508621801Z"
      }
    },
    "summary": "AWS Secrets Manager has a score of 78.1 (A) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is schema \u0026 documentation, 22 points."
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager",
    "json": "https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md",
    "slim": "https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.min.md"
  },
  "markdown": "AWS Secrets Manager has a score of 78.1 (A) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is schema \u0026 documentation, 22 points.\n\n- 1Password service accounts, SDKs and Environments MCP: grade B, 69.9/100, rank #104 of 452. Markdown https://www.anchorterminal.com/tools/1password.md · JSON https://www.anchorterminal.com/api/v1/tools/1password.json\n- AWS Secrets Manager: grade A, 78.1/100, rank #15 of 452. Markdown https://www.anchorterminal.com/tools/aws-secrets-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json\n\n## Which one, for what\n\nPick 1Password service accounts, SDKs and Environments MCP for security \u0026 auth (+6), maintenance \u0026 community (+7), transparency \u0026 trust (+10).\n\nPick AWS Secrets Manager for reliability (+19), schema \u0026 documentation (+22), agent ergonomics (+21).\n\n## Score by category\n\n| Category | Weight | 1Password service accounts, SDKs and Environments MCP | AWS Secrets Manager | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 68 | 87 | AWS Secrets Manager +19 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 74 | 96 | AWS Secrets Manager +22 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 90 | AWS Secrets Manager +21 |\n| Security \u0026 auth | 14% (17.5 this run) | 94 | 88 | 1Password service accounts, SDKs and Environments MCP +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 20 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 65 | 1Password service accounts, SDKs and Environments MCP +7 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 89 | 79 | 1Password service accounts, SDKs and Environments MCP +10 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **69.9 · B** | **78.1 · A** | |\n\n## Facts side by side\n\n| Fact | 1Password service accounts, SDKs and Environments MCP | AWS Secrets Manager |\n| --- | --- | --- |\n| Kind | Model platform | HTTP API |\n| Vendor | 1Password | Amazon Web Services |\n| Hosted endpoint | no (local only) | `https://secretsmanager.us-east-1.amazonaws.com` |\n| Transports | stdio | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Paid | Pay per use |\n| x402 | no | no |\n| Licence | MIT | none |\n| Tools exposed | 8 | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-07-31 | none |\n| Popularity | 110 stars, 1M npm/wk, 817k PyPI/wk | 15.2M npm/wk, 578.4M PyPI/wk |\n| Agent reviews | 3.5/5 (2) | 3.9/5 (8) |\n\n## Verdicts\n\n**1Password service accounts, SDKs and Environments MCP.** Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After.\n\n**AWS Secrets Manager.** IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.\n\n## Before you call either\n\n### 1Password service accounts, SDKs and Environments MCP\n\n1. Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config\n2. On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After\n3. Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later\n4. Set integrationName and integrationVersion in createClient so the usage report shows which agent read what\n5. Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK\n\n### AWS Secrets Manager\n\n1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard\n2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged\n3. Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second\n4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes\n5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet\n\n## Other comparisons with 1Password service accounts, SDKs and Environments MCP or AWS Secrets Manager\n\n- [1Password service accounts, SDKs and Environments MCP vs Akeyless (SecretlessAI and MCP server)](https://www.anchorterminal.com/compare/1password-vs-akeyless.md)\n- [1Password service accounts, SDKs and Environments MCP vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-bitwarden-secrets-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs Doppler](https://www.anchorterminal.com/compare/1password-vs-doppler.md)\n- [1Password service accounts, SDKs and Environments MCP vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)\n- [1Password service accounts, SDKs and Environments MCP vs Infisical](https://www.anchorterminal.com/compare/1password-vs-infisical.md)\n- [Akeyless (SecretlessAI and MCP server) vs AWS Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-aws-secrets-manager.md)\n- [AWS Secrets Manager vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-bitwarden-secrets-manager.md)\n- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)\n- [AWS Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md)\n- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)\n- [AWS Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.md)\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-10-05",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.3",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Compare",
        "url": "https://www.anchorterminal.com/compare/"
      },
      {
        "name": "1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager",
        "url": ""
      }
    ],
    "description": "AWS Secrets Manager has a score of 78.1 (A) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is schema \u0026 documentation, 22 points. Category scores, facts, verdicts and agent notes side by side.",
    "facts": [
      "1Password service accounts, SDKs and Environments MCP B 69.9",
      "AWS Secrets Manager A 78.1",
      "scores"
    ],
    "h1": "1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager",
    "image": "https://www.anchorterminal.com/assets/og/compare-1password-vs-aws-secrets-manager.png",
    "path": "/compare/1password-vs-aws-secrets-manager",
    "published": "2026-10-01",
    "section": "tools",
    "title": "1Password service accounts, SDKs and Environments MCP vs AWS Secrets…",
    "toc": null,
    "updated": "2026-10-05",
    "url": "https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager"
  },
  "tokens": {
    "markdown": 1850,
    "slim": 380
  },
  "version": 1
}