{ "data": { "a": { "slug": "1password", "name": "1Password service accounts, SDKs and Environments MCP", "vendor": "1Password", "vendorUrl": "https://1password.com", "kind": "platform", "category": "secrets", "summary": "Password manager with a developer layer for agents.", "url": "https://www.anchorterminal.com/tools/1password", "markdownUrl": "https://www.anchorterminal.com/tools/1password.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/1password.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/1password.json", "repo": "https://github.com/1Password/onepassword-sdk-js", "license": "MIT", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@1password/sdk" }, { "registry": "pypi", "name": "onepassword-sdk" } ], "auth": "mixed", "authNotes": "Service account tokens (`OP_SERVICE_ACCOUNT_TOKEN`) for unattended use, scoped to chosen vaults and Environments and unable to read Personal, Private or Employee vaults. The SDKs can instead prompt the 1Password desktop app, which approves each integration locally with biometrics. The Environments MCP server runs inside the desktop app and asks for approval per Environment until the app locks.", "pricing": "paid", "pricingNotes": "No free plan, a 14-day trial on every plan. Individual $3.99 a month ($2.99 promotional, billed yearly), Families $5.99 a month for up to 5 people ($4.49 promotional, billed yearly), Teams Starter Pack $24.95 a month for 10 members plus $4.99 a seat, Business $8.99 per user a month billed yearly. The personal pricing page lists 1Password Developer (SSH, Git commit signing, CLI and SDKs) on Individual and Families, and the business page lists the CLI and SDKs on Teams Starter Pack and Business. Service account rate limits are published for every plan. Unified Access, Privileged Access and the other enterprise products are quote only (https://1password.com/pricing/business, https://1password.com/pricing/password-manager).", "priceSummary": "$8.99 / seat-mo", "where": "local", "x402": { "level": "no", "endpoints": [] }, "toolCount": 8, "popularity": { "githubStars": 110, "npmWeekly": 1013526, "pypiWeekly": 816683, "asOf": "2026-09-30" }, "docsUrl": "https://www.1password.dev", "llmsTxt": "https://www.1password.dev/llms.txt", "openapi": "https://i.1password.com/media/1password-connect/1password-connect-api_1.8.1.yaml", "capabilities": [ "secrets.store", "secrets.machine-identity", "secrets.audit" ], "tags": [ "hosted", "closed-source", "card-required", "mcp", "local", "typescript", "python", "go", "enterprise", "eu" ], "lastRelease": "2026-07-31", "graded": true, "anchor": { "graded": true, "score": 69.9, "grade": "B", "agentReady": false, "rank": 104, "ranked": true, "rankOf": 452, "categoryRank": 6, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 72, "payments": 20, "reliability": 68, "schema": 74, "security": 94, "transparency": 89 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After.", "strengths": [ "Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation", "Environments MCP server with 8 tools that never returns a secret value and asks for approval per Environment", "Official Go, JavaScript and Python SDKs, MIT, with workload identity through the Credential Broker in JavaScript 0.5.0 (public preview)", "llms.txt for the developer docs and a public OpenAPI file for the self-hosted Connect server", "Signed security.txt, a HackerOne programme, SOC 2 Type II and ISO 27001 listed on the trust centre" ], "weaknesses": [ "Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After", "SDKs are version 0 with three months of patches per release, and 5 of the 8 newest Python SDK issues have no reply", "No SLA found, and the audit log and Events API need Business", "The MCP server is beta and needs the desktop app running and unlocked, so it's for a developer's machine, not a server", "No MCP registry entry and no way to create a service account without a signed-in person" ], "agentNotes": [ "Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config", "On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After", "Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later", "Set integrationName and integrationVersion in createClient so the usage report shows which agent read what", "Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.9 } ], "editorialScores": { "ergonomics": 69, "maintenance": 72, "payments": 20, "reliability": 68, "schema": 74, "security": 94, "transparency": 78 }, "provenanceScore": 100 }, "connect": { "install": "npm install @1password/sdk # or: pip install onepassword-sdk", "http": "export OP_SERVICE_ACCOUNT_TOKEN=\"$OP_SERVICE_ACCOUNT_TOKEN\"\nop read \"op://Production/Stripe/api_key\" # 1Password CLI, no REST endpoint for secret reads", "config": { "mcpServers": { "1password": { "args": [], "command": "1password-mcp" } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/1password" }, "area": "agent-runtime", "unitPrices": [ { "item": "Business plan", "unit": "seat-month", "usd": 8.99, "note": "Billed yearly. Developer tools and SSO included" }, { "item": "Teams Starter Pack", "unit": "month", "usd": 24.95, "note": "10 members, $4.99 a month per extra seat" }, { "item": "Individual plan", "unit": "month", "usd": 3.99, "note": "$2.99 promotional, billed yearly" } ], "provenance": { "legalEntity": "AgileBits Inc. (doing business as 1Password)", "domain": "1password.com", "domainRegistered": "2003-11-30", "endpointOnVendorDomain": true, "terms": "https://1password.com/legal/terms-of-service", "privacy": "https://1password.com/legal/privacy", "statusPage": "https://status.1password.com", "changelog": "https://releases.1password.com/developers/sdks/", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "Terms name AgileBits Inc., 4711 Yonge Street, Toronto, governed by Ontario law, last updated 12 September 2024. The privacy notice is effective 29 December 2025.", "security.txt lists security@agilebits.com and a HackerOne programme and is signed, but has no Expires field.", "developer.1password.com now redirects to www.1password.dev.", "The status page history shows six incidents between 2 July and 9 September 2026, on Device Trust, SaaS Manager, personal account management and the CLI update server, none posted against service accounts or Connect." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/1password.json", "live": { "slug": "1password", "vendorStatus": { "page": "https://status.1password.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-05T02:28:50.659507211Z" }, "versions": [ { "registry": "github", "name": "1Password/onepassword-sdk-js", "version": "v0.5.0", "released": "2026-07-31", "seenAt": "2026-10-04T16:19:29.795045796Z" }, { "registry": "npm", "name": "@1password/sdk", "version": "0.5.0", "seenAt": "2026-10-04T16:19:27.453978185Z" }, { "registry": "pypi", "name": "onepassword-sdk", "version": "0.4.1", "released": "2026-07-30", "seenAt": "2026-10-04T16:19:28.470969321Z" } ], "githubStars": 110, "npmWeekly": 1144520, "pypiWeekly": 907992, "securityTxt": { "url": "https://1password.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-10-04T15:15:51.698169765Z" }, "llmsTxt": { "url": "https://www.1password.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:12.603904586Z" }, "domain": { "domain": "1password.com", "registered": "2003-11-30", "source": "https://rdap.verisign.com/com/v1/domain/1password.com", "checkedAt": "2026-10-04T13:03:36.930043964Z" }, "pages": [ { "url": "https://releases.1password.com/developers/sdks/", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:47:15.347202499Z", "changedAt": "2026-10-03T15:35:15.432558355Z", "fingerprint": "70bd81831178" }, { "url": "https://1password.com/pricing/business", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:41:11.172504664Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "c7410e7a546a" }, { "url": "https://1password.com/pricing/password-manager", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:41:13.479557667Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "20bf1ab35205" }, { "url": "https://1password.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:41:07.067811579Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7a043d1fa57f" }, { "url": "https://1password.com/legal/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:41:09.169984797Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "440d3b48cc3c" } ], "updatedAt": "2026-10-05T02:28:50.659507211Z" } }, "b": { "slug": "doppler", "name": "Doppler", "vendor": "Doppler", "vendorUrl": "https://www.doppler.com", "kind": "http-api", "category": "secrets", "summary": "Hosted secrets manager organised by project, environment and config.", "url": "https://www.anchorterminal.com/tools/doppler", "markdownUrl": "https://www.anchorterminal.com/tools/doppler.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doppler.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doppler.json", "repo": "https://github.com/DopplerHQ/mcp-server", "license": "Apache-2.0 (MCP server and CLI), closed platform", "transports": [ "http", "stdio" ], "remoteUrl": "https://api.doppler.com/v3", "packages": [ { "registry": "npm", "name": "@dopplerhq/mcp-server" } ], "auth": "mixed", "authNotes": "Bearer tokens on api.doppler.com. Service tokens (`dp.st.\u003cenv\u003e.…`) are scoped to one config, read-only by default and can expire with `--max-age`. Service account identities exchange an OIDC token (GitHub Actions, Kubernetes, AWS EC2 or any issuer) for a short-lived Doppler token at POST /v3/auth/oidc, Team plan and above. The MCP server takes `DOPPLER_TOKEN` or `npx @dopplerhq/mcp-server login`.", "pricing": "freemium", "pricingNotes": "Developer plan is free for 3 users then $8 a month per extra user, with 10 projects, 50 service tokens, 3-day activity logs and API-based rotation only. Team $21 a month per user with a 14-day trial, 250 projects, 500 service tokens, service accounts, automatic rotation, 90-day logs and SAML. Enterprise is custom, with dynamic secrets (AWS IAM and Azure service principals), proxied rotation, SCIM, on-prem and a 99.95% SLO. The pricing page says AI agents and non-human identities ride free, and doesn't say whether a card is needed (https://www.doppler.com/pricing, https://docs.doppler.com/docs/dynamic-secrets).", "priceSummary": "$21 / seat-mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 8, "npmWeekly": 3261, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.doppler.com", "llmsTxt": "https://docs.doppler.com/llms.txt", "openapi": "https://docs.doppler.com/openapi/core.json", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "tags": [ "hosted", "closed-source", "freemium", "free-tier", "no-card", "mcp", "openapi", "llms-txt", "typescript", "read-only-mode", "enterprise" ], "lastRelease": "2026-09-21", "graded": true, "anchor": { "graded": true, "score": 71.6, "grade": "BB", "agentReady": true, "rank": 79, "ranked": true, "rankOf": 452, "categoryRank": 5, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 76, "payments": 25, "reliability": 90, "schema": 81, "security": 82, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.", "strengths": [ "Service tokens bound to one config, read-only by default, with --max-age expiry", "OIDC service account identities on Team, so shared runners don't hold a static token", "OpenAPI 3.1 and an llms.txt with about 500 Markdown links", "Published per-plan rate limits with retry-after and x-ratelimit headers on a 429", "MCP server with --read-only and --config modes that cut the tool list to 36 or 10" ], "weaknesses": [ "Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts", "The MCP server is experimental, has no tool annotations or value masking, and exposes up to 89 tools by default", "35 open CLI issues, most of the newest without a reply", "The CLI keeps serving its fallback file after a token is revoked, and sends anonymous analytics unless turned off", "No SLA, only a 99.95% SLO on Enterprise" ], "agentNotes": [ "Create a service token scoped to one config and read-only, then start the agent with `doppler run --token $DOPPLER_TOKEN -- \u003ccmd\u003e` so values never touch disk", "Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail", "Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call", "On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer", "Run `doppler configure flags disable analytics` on build agents if you don't want CLI command usage reported" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.6 } ], "editorialScores": { "ergonomics": 59, "maintenance": 76, "payments": 25, "reliability": 90, "schema": 81, "security": 82, "transparency": 64 }, "provenanceScore": 90 }, "connect": { "http": "curl \"https://api.doppler.com/v3/configs/config/secrets/download?format=json\" \\\n -H \"Authorization: Bearer $DOPPLER_TOKEN\"", "claudeCode": "claude mcp add doppler -e DOPPLER_TOKEN=$DOPPLER_TOKEN -- npx -y @dopplerhq/mcp-server --read-only", "config": { "mcpServers": { "doppler": { "args": [ "-y", "@dopplerhq/mcp-server", "--read-only" ], "command": "npx", "env": { "DOPPLER_TOKEN": "${DOPPLER_TOKEN}" } } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/doppler" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan", "unit": "seat-month", "usd": 21, "note": "14-day trial" }, { "item": "Developer plan, extra user", "unit": "seat-month", "usd": 8, "note": "First 3 users free" } ], "provenance": { "legalEntity": "Doppler Technologies, Inc.", "domain": "doppler.com", "domainRegistered": "1999-01-24", "domainNote": "doppler.com was registered in 1999, long before the company, so the domain was bought later.", "endpointOnVendorDomain": true, "terms": "https://www.doppler.com/legal/terms", "privacy": "https://www.doppler.com/legal/privacy", "statusPage": "https://www.dopplerstatus.com", "changelog": "https://docs.doppler.com/changelog", "securityTxt": "unknown", "checked": "2026-10-01", "notes": [ "Terms name Doppler Technologies, Inc., 440 North Barranca Avenue #5880, Covina, CA 91723, last updated 8 February 2026. Privacy notice updated 17 September 2026, data stored in the United States.", "www.doppler.com/.well-known/security.txt is disallowed by robots.txt, so we couldn't read it.", "www.dopplerstatus.com is Atlassian Statuspage. Its history shows one incident since 3 July 2026 (CLI downloads failing, 16 July) and system outages on 18 November 2025 and 12 June 2025.", "The subprocessor list (13 July 2026) names 9 subprocessors, 8 in the United States and Groundcover in Israel, and links a DPA and an on-prem DPA.", "The security fact sheet puts all servers in GCP us-central1 and says HackerOne handles disclosures." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doppler.json", "live": { "slug": "doppler", "probe": { "target": "https://api.doppler.com/v3", "method": "get", "lastAt": "2026-10-05T02:29:55.110522895Z", "lastOk": true, "lastStatus": 401, "lastMs": 148, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 150, "p95ms24h": 204, "samples24h": 273, "samples30d": 929, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 29, "ok": 29 } ] }, "vendorStatus": { "page": "https://www.dopplerstatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-05T02:28:55.261115519Z" }, "versions": [ { "registry": "github", "name": "DopplerHQ/mcp-server", "version": "v1.0.5", "released": "2026-06-04", "seenAt": "2026-10-04T16:25:42.222400654Z" }, { "registry": "npm", "name": "@dopplerhq/mcp-server", "version": "1.0.5", "seenAt": "2026-10-04T16:25:41.357710821Z" } ], "githubStars": 8, "npmWeekly": 5296, "securityTxt": { "url": "https://doppler.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:42.3339237Z" }, "llmsTxt": { "url": "https://docs.doppler.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:31.061902909Z" }, "domain": { "domain": "doppler.com", "registered": "1999-01-24", "source": "https://rdap.verisign.com/com/v1/domain/doppler.com", "checkedAt": "2026-10-04T13:08:29.130637863Z" }, "pages": [ { "url": "https://docs.doppler.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:43:35.303385156Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "816d6475b1bd" }, { "url": "https://www.doppler.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:50:08.235633812Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61b46ac39ff9" }, { "url": "https://www.doppler.com/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-10-04T15:50:03.99159557Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "306950b580d5" }, { "url": "https://www.doppler.com/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:50:06.172772616Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "642e87a74245" } ], "updatedAt": "2026-10-05T02:29:55.110522895Z" } }, "summary": "Doppler has a score of 71.6 (BB) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 22 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/1password-vs-doppler", "json": "https://www.anchorterminal.com/compare/1password-vs-doppler.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/1password-vs-doppler.md", "slim": "https://www.anchorterminal.com/compare/1password-vs-doppler.min.md" }, "markdown": "Doppler has a score of 71.6 (BB) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 22 points.\n\n- 1Password service accounts, SDKs and Environments MCP: grade B, 69.9/100, rank #104 of 452. Markdown https://www.anchorterminal.com/tools/1password.md · JSON https://www.anchorterminal.com/api/v1/tools/1password.json\n- Doppler: grade BB, 71.6/100, rank #79 of 452. Markdown https://www.anchorterminal.com/tools/doppler.md · JSON https://www.anchorterminal.com/api/v1/tools/doppler.json\n\n## Which one, for what\n\nPick 1Password service accounts, SDKs and Environments MCP for agent ergonomics (+10), security \u0026 auth (+12), transparency \u0026 trust (+12).\n\nPick Doppler for reliability (+22), schema \u0026 documentation (+7), payments \u0026 pricing (+5).\n\n## Score by category\n\n| Category | Weight | 1Password service accounts, SDKs and Environments MCP | Doppler | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 68 | 90 | Doppler +22 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 74 | 81 | Doppler +7 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 59 | 1Password service accounts, SDKs and Environments MCP +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 94 | 82 | 1Password service accounts, SDKs and Environments MCP +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 25 | Doppler +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 76 | Doppler +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 89 | 77 | 1Password service accounts, SDKs and Environments MCP +12 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **69.9 · B** | **71.6 · BB** | |\n\n## Facts side by side\n\n| Fact | 1Password service accounts, SDKs and Environments MCP | Doppler |\n| --- | --- | --- |\n| Kind | Model platform | HTTP API |\n| Vendor | 1Password | Doppler |\n| Hosted endpoint | no (local only) | `https://api.doppler.com/v3` |\n| Transports | stdio | HTTP, stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | MIT | Apache-2.0 (MCP server and CLI), closed platform |\n| Tools exposed | 8 | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-07-31 | 2026-09-21 |\n| Popularity | 110 stars, 1M npm/wk, 817k PyPI/wk | 8 stars, 3.3k npm/wk |\n| Agent reviews | 3.5/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**1Password service accounts, SDKs and Environments MCP.** Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After.\n\n**Doppler.** Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.\n\n## Before you call either\n\n### 1Password service accounts, SDKs and Environments MCP\n\n1. Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config\n2. On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After\n3. Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later\n4. Set integrationName and integrationVersion in createClient so the usage report shows which agent read what\n5. Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK\n\n### Doppler\n\n1. Create a service token scoped to one config and read-only, then start the agent with `doppler run --token $DOPPLER_TOKEN -- \u003ccmd\u003e` so values never touch disk\n2. Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail\n3. Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call\n4. On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer\n5. Run `doppler configure flags disable analytics` on build agents if you don't want CLI command usage reported\n\n## Other comparisons with 1Password service accounts, SDKs and Environments MCP or Doppler\n\n- [1Password service accounts, SDKs and Environments MCP vs Akeyless (SecretlessAI and MCP server)](https://www.anchorterminal.com/compare/1password-vs-akeyless.md)\n- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-bitwarden-secrets-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)\n- [1Password service accounts, SDKs and Environments MCP vs Infisical](https://www.anchorterminal.com/compare/1password-vs-infisical.md)\n- [Akeyless (SecretlessAI and MCP server) vs Doppler](https://www.anchorterminal.com/compare/akeyless-vs-doppler.md)\n- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)\n- [Bitwarden Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-doppler.md)\n- [Doppler vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/doppler-vs-google-secret-manager.md)\n- [Doppler vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.md)\n- [Doppler vs Infisical](https://www.anchorterminal.com/compare/doppler-vs-infisical.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "1Password service accounts, SDKs and Environments MCP vs Doppler", "url": "" } ], "description": "Doppler has a score of 71.6 (BB) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 22 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "1Password service accounts, SDKs and Environments MCP B 69.9", "Doppler BB 71.6", "scores" ], "h1": "1Password service accounts, SDKs and Environments MCP vs Doppler", "image": "https://www.anchorterminal.com/assets/og/compare-1password-vs-doppler.png", "path": "/compare/1password-vs-doppler", "published": "2026-10-01", "section": "tools", "title": "1Password service accounts, SDKs and Environments MCP vs Doppler", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/1password-vs-doppler" }, "tokens": { "markdown": 1800, "slim": 380 }, "version": 1 }