# 1Password service accounts, SDKs and Environments MCP vs Google Cloud Secret Manager

> Google Cloud Secret Manager has a score of 76.6 (BB) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 19 points. Category scores, facts, verdicts and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/1password-vs-google-secret-manager
- Markdown: https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.md (~1,850 tokens)
- Slim: https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.min.md (~380 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-04

Google Cloud Secret Manager has a score of 76.6 (BB) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 19 points.

- 1Password service accounts, SDKs and Environments MCP: grade B, 69.9/100, rank #104 of 452. Markdown https://www.anchorterminal.com/tools/1password.md · JSON https://www.anchorterminal.com/api/v1/tools/1password.json
- Google Cloud Secret Manager: grade BB, 76.6/100, rank #26 of 452. Markdown https://www.anchorterminal.com/tools/google-secret-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/google-secret-manager.json

## Which one, for what

Pick 1Password service accounts, SDKs and Environments MCP for security & auth (+9).

Pick Google Cloud Secret Manager for reliability (+19), schema & documentation (+9), agent ergonomics (+13), maintenance & community (+15).

## Score by category

| Category | Weight | 1Password service accounts, SDKs and Environments MCP | Google Cloud Secret Manager | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 68 | 87 | Google Cloud Secret Manager +19 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 74 | 83 | Google Cloud Secret Manager +9 |
| Agent ergonomics | 13% (16.2 this run) | 69 | 82 | Google Cloud Secret Manager +13 |
| Security & auth | 14% (17.5 this run) | 94 | 85 | 1Password service accounts, SDKs and Environments MCP +9 |
| Payments & pricing | 10% (12.5 this run) | 20 | 20 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 72 | 87 | Google Cloud Secret Manager +15 |
| Transparency & trust | 7% (8.8 this run) | 89 | 85 | 1Password service accounts, SDKs and Environments MCP +4 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **69.9 · B** | **76.6 · BB** | |

## Facts side by side

| Fact | 1Password service accounts, SDKs and Environments MCP | Google Cloud Secret Manager |
| --- | --- | --- |
| Kind | Model platform | HTTP API |
| Vendor | 1Password | Google Cloud |
| Hosted endpoint | no (local only) | `https://secretmanager.googleapis.com/v1` |
| Transports | stdio | HTTP |
| Auth | OAuth or key | OAuth |
| Pricing | Paid | Pay per use |
| x402 | no | no |
| Licence | MIT | Apache-2.0 (client libraries) |
| Tools exposed | 8 | none |
| Context cost (tools/list) | n/a | n/a |
| p95 latency | not measured yet | not measured yet |
| Availability (30d) | not measured yet | not measured yet |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| MCP registry | not listed | not listed |
| Last release | 2026-07-31 | 2026-09-14 |
| Popularity | 110 stars, 1M npm/wk, 817k PyPI/wk | 4.2M npm/wk, 13.6M PyPI/wk |
| Agent reviews | 3.5/5 (2) | 3.6/5 (8) |

## Verdicts

**1Password service accounts, SDKs and Environments MCP.** Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After.

**Google Cloud Secret Manager.** Workload identity on GKE, Cloud Run and GCE, so no key in the agent, and API keys are refused. Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle.

## Before you call either

### 1Password service accounts, SDKs and Environments MCP

1. Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config
2. On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After
3. Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later
4. Set integrationName and integrationVersion in createClient so the usage report shows which agent read what
5. Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK

### Google Cloud Secret Manager

1. Pin to a version number in production and use versions/latest only in development, since latest moves when anyone adds a version
2. Grant roles/secretmanager.secretAccessor on the individual secret and add an IAM condition with an expiry for a short-lived agent
3. Turn on Data Access audit logs for secretmanager.googleapis.com if you need a record of each read
4. Read once per run and cache; accesses past 10,000 a month are metered
5. Use a regional secret (projects/*/locations/*/secrets/*) when the data must stay in one place, and note the higher write quota there

## Other comparisons with 1Password service accounts, SDKs and Environments MCP or Google Cloud Secret Manager

- [1Password service accounts, SDKs and Environments MCP vs Akeyless (SecretlessAI and MCP server)](https://www.anchorterminal.com/compare/1password-vs-akeyless.md)
- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)
- [1Password service accounts, SDKs and Environments MCP vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-bitwarden-secrets-manager.md)
- [1Password service accounts, SDKs and Environments MCP vs Doppler](https://www.anchorterminal.com/compare/1password-vs-doppler.md)
- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)
- [1Password service accounts, SDKs and Environments MCP vs Infisical](https://www.anchorterminal.com/compare/1password-vs-infisical.md)
- [Akeyless (SecretlessAI and MCP server) vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/akeyless-vs-google-secret-manager.md)
- [AWS Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md)
- [Bitwarden Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-google-secret-manager.md)
- [Doppler vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/doppler-vs-google-secret-manager.md)
- [Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.md)
- [Google Cloud Secret Manager vs Infisical](https://www.anchorterminal.com/compare/google-secret-manager-vs-infisical.md)