{ "data": { "a": { "slug": "1password", "name": "1Password service accounts, SDKs and Environments MCP", "vendor": "1Password", "vendorUrl": "https://1password.com", "kind": "platform", "category": "secrets", "summary": "Password manager with a developer layer for agents.", "url": "https://www.anchorterminal.com/tools/1password", "markdownUrl": "https://www.anchorterminal.com/tools/1password.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/1password.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/1password.json", "repo": "https://github.com/1Password/onepassword-sdk-js", "license": "MIT", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@1password/sdk" }, { "registry": "pypi", "name": "onepassword-sdk" } ], "auth": "mixed", "authNotes": "Service account tokens (`OP_SERVICE_ACCOUNT_TOKEN`) for unattended use, scoped to chosen vaults and Environments and unable to read Personal, Private or Employee vaults. The SDKs can instead prompt the 1Password desktop app, which approves each integration locally with biometrics. The Environments MCP server runs inside the desktop app and asks for approval per Environment until the app locks.", "pricing": "paid", "pricingNotes": "No free plan, a 14-day trial on every plan. Individual $3.99 a month ($2.99 promotional, billed yearly), Families $5.99 a month for up to 5 people ($4.49 promotional, billed yearly), Teams Starter Pack $24.95 a month for 10 members plus $4.99 a seat, Business $8.99 per user a month billed yearly. The personal pricing page lists 1Password Developer (SSH, Git commit signing, CLI and SDKs) on Individual and Families, and the business page lists the CLI and SDKs on Teams Starter Pack and Business. Service account rate limits are published for every plan. Unified Access, Privileged Access and the other enterprise products are quote only (https://1password.com/pricing/business, https://1password.com/pricing/password-manager).", "priceSummary": "$8.99 / seat-mo", "where": "local", "x402": { "level": "no", "endpoints": [] }, "toolCount": 8, "popularity": { "githubStars": 110, "npmWeekly": 1013526, "pypiWeekly": 816683, "asOf": "2026-09-30" }, "docsUrl": "https://www.1password.dev", "llmsTxt": "https://www.1password.dev/llms.txt", "openapi": "https://i.1password.com/media/1password-connect/1password-connect-api_1.8.1.yaml", "capabilities": [ "secrets.store", "secrets.machine-identity", "secrets.audit" ], "tags": [ "hosted", "closed-source", "card-required", "mcp", "local", "typescript", "python", "go", "enterprise", "eu" ], "lastRelease": "2026-07-31", "graded": true, "anchor": { "graded": true, "score": 69.9, "grade": "B", "agentReady": false, "rank": 104, "ranked": true, "rankOf": 452, "categoryRank": 6, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 72, "payments": 20, "reliability": 68, "schema": 74, "security": 94, "transparency": 89 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After.", "strengths": [ "Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation", "Environments MCP server with 8 tools that never returns a secret value and asks for approval per Environment", "Official Go, JavaScript and Python SDKs, MIT, with workload identity through the Credential Broker in JavaScript 0.5.0 (public preview)", "llms.txt for the developer docs and a public OpenAPI file for the self-hosted Connect server", "Signed security.txt, a HackerOne programme, SOC 2 Type II and ISO 27001 listed on the trust centre" ], "weaknesses": [ "Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After", "SDKs are version 0 with three months of patches per release, and 5 of the 8 newest Python SDK issues have no reply", "No SLA found, and the audit log and Events API need Business", "The MCP server is beta and needs the desktop app running and unlocked, so it's for a developer's machine, not a server", "No MCP registry entry and no way to create a service account without a signed-in person" ], "agentNotes": [ "Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config", "On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After", "Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later", "Set integrationName and integrationVersion in createClient so the usage report shows which agent read what", "Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.9 } ], "editorialScores": { "ergonomics": 69, "maintenance": 72, "payments": 20, "reliability": 68, "schema": 74, "security": 94, "transparency": 78 }, "provenanceScore": 100 }, "connect": { "install": "npm install @1password/sdk # or: pip install onepassword-sdk", "http": "export OP_SERVICE_ACCOUNT_TOKEN=\"$OP_SERVICE_ACCOUNT_TOKEN\"\nop read \"op://Production/Stripe/api_key\" # 1Password CLI, no REST endpoint for secret reads", "config": { "mcpServers": { "1password": { "args": [], "command": "1password-mcp" } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/1password" }, "area": "agent-runtime", "unitPrices": [ { "item": "Business plan", "unit": "seat-month", "usd": 8.99, "note": "Billed yearly. Developer tools and SSO included" }, { "item": "Teams Starter Pack", "unit": "month", "usd": 24.95, "note": "10 members, $4.99 a month per extra seat" }, { "item": "Individual plan", "unit": "month", "usd": 3.99, "note": "$2.99 promotional, billed yearly" } ], "provenance": { "legalEntity": "AgileBits Inc. (doing business as 1Password)", "domain": "1password.com", "domainRegistered": "2003-11-30", "endpointOnVendorDomain": true, "terms": "https://1password.com/legal/terms-of-service", "privacy": "https://1password.com/legal/privacy", "statusPage": "https://status.1password.com", "changelog": "https://releases.1password.com/developers/sdks/", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "Terms name AgileBits Inc., 4711 Yonge Street, Toronto, governed by Ontario law, last updated 12 September 2024. The privacy notice is effective 29 December 2025.", "security.txt lists security@agilebits.com and a HackerOne programme and is signed, but has no Expires field.", "developer.1password.com now redirects to www.1password.dev.", "The status page history shows six incidents between 2 July and 9 September 2026, on Device Trust, SaaS Manager, personal account management and the CLI update server, none posted against service accounts or Connect." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/1password.json", "live": { "slug": "1password", "vendorStatus": { "page": "https://status.1password.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:27:39.687234777Z" }, "versions": [ { "registry": "github", "name": "1Password/onepassword-sdk-js", "version": "v0.5.0", "released": "2026-07-31", "seenAt": "2026-10-04T16:19:29.795045796Z" }, { "registry": "npm", "name": "@1password/sdk", "version": "0.5.0", "seenAt": "2026-10-04T16:19:27.453978185Z" }, { "registry": "pypi", "name": "onepassword-sdk", "version": "0.4.1", "released": "2026-07-30", "seenAt": "2026-10-04T16:19:28.470969321Z" } ], "githubStars": 110, "npmWeekly": 1144520, "pypiWeekly": 907992, "securityTxt": { "url": "https://1password.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-10-04T15:15:51.698169765Z" }, "llmsTxt": { "url": "https://www.1password.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:12.603904586Z" }, "domain": { "domain": "1password.com", "registered": "2003-11-30", "source": "https://rdap.verisign.com/com/v1/domain/1password.com", "checkedAt": "2026-10-04T13:03:36.930043964Z" }, "pages": [ { "url": "https://releases.1password.com/developers/sdks/", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:47:15.347202499Z", "changedAt": "2026-10-03T15:35:15.432558355Z", "fingerprint": "70bd81831178" }, { "url": "https://1password.com/pricing/business", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:41:11.172504664Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "c7410e7a546a" }, { "url": "https://1password.com/pricing/password-manager", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:41:13.479557667Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "20bf1ab35205" }, { "url": "https://1password.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:41:07.067811579Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7a043d1fa57f" }, { "url": "https://1password.com/legal/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:41:09.169984797Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "440d3b48cc3c" } ], "updatedAt": "2026-10-04T23:27:39.687234777Z" } }, "b": { "slug": "infisical", "name": "Infisical", "vendor": "Infisical", "vendorUrl": "https://infisical.com", "kind": "http-api", "category": "secrets", "summary": "Open-source secrets manager with machine identities (Universal Auth, OIDC, AWS, GCP, Azure, Kubernetes, SPIFFE), dynamic secrets, rotation and audit logs, hosted in the US or EU or self-hosted.", "url": "https://www.anchorterminal.com/tools/infisical", "markdownUrl": "https://www.anchorterminal.com/tools/infisical.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/infisical.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/infisical.json", "repo": "https://github.com/Infisical/infisical", "license": "MIT (core), proprietary under ee/", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://app.infisical.com/api", "packages": [ { "registry": "npm", "name": "@infisical/sdk" }, { "registry": "pypi", "name": "infisicalsdk" }, { "registry": "npm", "name": "@infisical/cli" }, { "registry": "npm", "name": "@infisical/mcp" } ], "auth": "mixed", "authNotes": "Machine identities log in with Universal Auth (client ID and secret posted to /api/v1/auth/universal-auth/login), Token Auth, OIDC, JWT, or native AWS, Azure, GCP, Kubernetes, OCI, AliCloud, LDAP, TLS certificate or SPIFFE auth, and get a short-lived access token (`st.…`, default TTL 7,200 s) sent as a Bearer header. Revoke it at /api/v1/auth/token/revoke. Agent Vault sessions use a separate session token that only works against the proxy. The docs MCP server at infisical.com/docs/mcp needs no auth.", "pricing": "freemium", "pricingNotes": "Free, Pro, Advanced and Enterprise plans on Infisical Cloud. Free is $0 with 5 identities, 3 environments, no audit logs, no rotation and no dynamic secrets, and needs no card. Pro is $20 per identity a month billed yearly ($23 monthly) with 30-day audit logs and rotation. Advanced is $40 per identity a month billed yearly ($46 monthly) with 90-day audit logs, dynamic secrets and higher rate limits. Pro and Advanced trials need no card. Enterprise is custom. Agent Proxy is on Free and Pro for static secrets. Cloud rate limits are per client IP, 600 requests a minute overall, then Free 200 reads, 90 writes and 120 secret operations a minute, Pro 350, 200 and 300. Self-hosting the MIT core is free with no rate limits; the code under ee/ needs an Enterprise licence (https://infisical.com/pricing, https://infisical.com/docs/api-reference/overview/rate-limits).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": 28405, "npmWeekly": 305133, "pypiWeekly": 391329, "asOf": "2026-09-30" }, "docsUrl": "https://infisical.com/docs", "llmsTxt": "https://infisical.com/docs/llms.txt", "openapi": "https://app.infisical.com/api/docs/json", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "secrets.self-host", "auth.agent-identity" ], "tags": [ "hosted", "self-hosted", "open-source", "freemium", "free-tier", "mcp", "llms-txt", "openapi", "typescript", "python", "go", "enterprise", "eu" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 81.9, "grade": "A", "agentReady": true, "rank": 4, "ranked": true, "rankOf": 452, "categoryRank": 1, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 91, "maintenance": 90, "payments": 30, "reliability": 90, "schema": 87, "security": 91, "transparency": 85 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them. Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month.", "strengths": [ "Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them", "Thirteen machine identity auth methods with short-lived, revocable access tokens", "MIT core that self-hosts with no API rate limits, plus US and EU cloud regions", "Official MCP server with 10 annotated tools, a tool allowlist and optional value masking", "48 tagged releases between 3 July and 23 September 2026, each with an upgrade-impact note" ], "weaknesses": [ "Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month", "Cloud rate limits are per client IP, so agents behind one NAT share 600 requests a minute", "The MCP server returns secret values unless INFISICAL_MASK_SECRET_VALUES is set, and it's still version 0.0.x", "Agent Vault session tokens travel to the proxy unencrypted, and the feature sits under the proprietary ee/ licence", "No SLA found, and every listed subprocessor is in the United States despite the EU region" ], "agentNotes": [ "Run a coding agent under `infisical agent-vault run` with a bundle that allows only the hosts, methods and paths it needs, and set --ttl to the job length", "Start @infisical/mcp with INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret and INFISICAL_MASK_SECRET_VALUES=true unless the model must see a value", "Log in once with Universal Auth and keep the access token for its TTL, since identity logins count against the per-IP write limit", "Pass viewSecretValue=false to GET /api/v4/secrets when you only need names, and expandSecretReferences=true when values reference other secrets", "On a 429 read the seconds from the message field and wait that long; don't retry a POST after a 5xx without checking it didn't land" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 81.9 } ], "editorialScores": { "ergonomics": 91, "maintenance": 90, "payments": 30, "reliability": 90, "schema": 87, "security": 91, "transparency": 77 }, "provenanceScore": 92 }, "connect": { "install": "npm install @infisical/sdk # or: pip install infisicalsdk, brew install infisical/get-cli/infisical", "http": "curl -G https://app.infisical.com/api/v4/secrets -H \"Authorization: Bearer $INFISICAL_TOKEN\" \\\n --data-urlencode \"projectId=$INFISICAL_PROJECT_ID\" --data-urlencode \"environment=prod\" --data-urlencode \"secretPath=/\"", "claudeCode": "claude mcp add infisical -e INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=$INFISICAL_CLIENT_ID -e INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=$INFISICAL_CLIENT_SECRET -e INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret -- npx -y @infisical/mcp", "config": { "mcpServers": { "infisical": { "args": [ "-y", "@infisical/mcp" ], "command": "npx", "env": { "INFISICAL_ENABLED_TOOLS": "list-projects,list-secrets,get-secret", "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID": "${INFISICAL_CLIENT_ID}", "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET": "${INFISICAL_CLIENT_SECRET}" } } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/infisical" }, "area": "agent-runtime", "provenance": { "legalEntity": "Infisical, Inc.", "domain": "infisical.com", "domainRegistered": "2022-07-06", "endpointOnVendorDomain": true, "terms": "https://infisical.com/terms", "privacy": "https://infisical.com/privacy", "statusPage": "https://status.infisical.com", "changelog": "https://github.com/Infisical/infisical/releases", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The privacy policy (last updated 15 September 2025) names Infisical, Inc. without a postal address and links a subprocessor list dated 9 September 2026 with 17 entries, all in the United States.", "security.txt expires 2027-08-01 and points to a Bugcrowd disclosure programme; a paid bounty is private and invitation-only.", "The docs changelog stops at July 2025; releases since then are tagged on GitHub with generated notes and an upgrade-impact file per release in the repository.", "status.infisical.com runs on incident.io and showed only a planned maintenance on 23 July 2026 between July and October 2026." ], "score": 92 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/infisical.json", "live": { "slug": "infisical", "probe": { "target": "https://app.infisical.com/api", "method": "get", "lastAt": "2026-10-04T23:32:48.812503177Z", "lastOk": true, "lastStatus": 404, "lastMs": 255, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 253, "p95ms24h": 306, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 267, "ok": 267 } ] }, "vendorStatus": { "page": "https://status.infisical.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:27:51.339856217Z" }, "versions": [ { "registry": "github", "name": "Infisical/infisical", "version": "v0.165.16", "released": "2026-09-23", "seenAt": "2026-10-04T16:30:07.020121532Z" }, { "registry": "npm", "name": "@infisical/cli", "version": "0.43.138", "seenAt": "2026-10-04T16:30:03.879471957Z" }, { "registry": "npm", "name": "@infisical/mcp", "version": "0.0.24", "seenAt": "2026-10-04T16:30:05.024522005Z" }, { "registry": "npm", "name": "@infisical/sdk", "version": "5.0.2", "seenAt": "2026-10-04T16:30:02.799307929Z" }, { "registry": "pypi", "name": "infisicalsdk", "version": "1.0.17", "released": "2026-08-17", "seenAt": "2026-10-04T16:30:03.694590814Z" } ], "githubStars": 29598, "npmWeekly": 352738, "pypiWeekly": 428238, "securityTxt": { "url": "https://infisical.com/.well-known/security.txt", "state": "valid", "expires": "2027-08-01T00:00:00.000Z", "checkedAt": "2026-10-04T15:15:56.427929639Z" }, "llmsTxt": { "url": "https://infisical.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:54.483742063Z" }, "domain": { "domain": "infisical.com", "registered": "2022-07-06", "source": "https://rdap.verisign.com/com/v1/domain/infisical.com", "checkedAt": "2026-10-04T13:05:56.955224704Z" }, "pages": [ { "url": "https://infisical.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:45:06.403675987Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b27bc7fd3df5" }, { "url": "https://infisical.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:45:08.688215502Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f0c109cb65cf" }, { "url": "https://infisical.com/terms", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:45:10.606822528Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "01d76f6adafb" } ], "updatedAt": "2026-10-04T23:32:48.812503177Z" } }, "summary": "Infisical has a score of 81.9 (A) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 22 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/1password-vs-infisical", "json": "https://www.anchorterminal.com/compare/1password-vs-infisical.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/1password-vs-infisical.md", "slim": "https://www.anchorterminal.com/compare/1password-vs-infisical.min.md" }, "markdown": "Infisical has a score of 81.9 (A) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 22 points.\n\n- 1Password service accounts, SDKs and Environments MCP: grade B, 69.9/100, rank #104 of 452. Markdown https://www.anchorterminal.com/tools/1password.md · JSON https://www.anchorterminal.com/api/v1/tools/1password.json\n- Infisical: grade A, 81.9/100, rank #4 of 452. Markdown https://www.anchorterminal.com/tools/infisical.md · JSON https://www.anchorterminal.com/api/v1/tools/infisical.json\n\n## Which one, for what\n\nPick 1Password service accounts, SDKs and Environments MCP for nothing in particular (no category where it leads by five points or more).\n\nPick Infisical for reliability (+22), schema \u0026 documentation (+13), agent ergonomics (+22), payments \u0026 pricing (+10), maintenance \u0026 community (+18).\n\n## Score by category\n\n| Category | Weight | 1Password service accounts, SDKs and Environments MCP | Infisical | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 68 | 90 | Infisical +22 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 74 | 87 | Infisical +13 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 91 | Infisical +22 |\n| Security \u0026 auth | 14% (17.5 this run) | 94 | 91 | 1Password service accounts, SDKs and Environments MCP +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 30 | Infisical +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 90 | Infisical +18 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 89 | 85 | 1Password service accounts, SDKs and Environments MCP +4 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **69.9 · B** | **81.9 · A** | |\n\n## Facts side by side\n\n| Fact | 1Password service accounts, SDKs and Environments MCP | Infisical |\n| --- | --- | --- |\n| Kind | Model platform | HTTP API |\n| Vendor | 1Password | Infisical |\n| Hosted endpoint | no (local only) | `https://app.infisical.com/api` |\n| Transports | stdio | HTTP, Streamable HTTP, stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | MIT | MIT (core), proprietary under ee/ |\n| Tools exposed | 8 | 10 |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-07-31 | 2026-09-23 |\n| Popularity | 110 stars, 1M npm/wk, 817k PyPI/wk | 28k stars, 305k npm/wk, 391k PyPI/wk |\n| Agent reviews | 3.5/5 (2) | 3.8/5 (8) |\n\n## Verdicts\n\n**1Password service accounts, SDKs and Environments MCP.** Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After.\n\n**Infisical.** Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them. Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month.\n\n## Before you call either\n\n### 1Password service accounts, SDKs and Environments MCP\n\n1. Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config\n2. On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After\n3. Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later\n4. Set integrationName and integrationVersion in createClient so the usage report shows which agent read what\n5. Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK\n\n### Infisical\n\n1. Run a coding agent under `infisical agent-vault run` with a bundle that allows only the hosts, methods and paths it needs, and set --ttl to the job length\n2. Start @infisical/mcp with INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret and INFISICAL_MASK_SECRET_VALUES=true unless the model must see a value\n3. Log in once with Universal Auth and keep the access token for its TTL, since identity logins count against the per-IP write limit\n4. Pass viewSecretValue=false to GET /api/v4/secrets when you only need names, and expandSecretReferences=true when values reference other secrets\n5. On a 429 read the seconds from the message field and wait that long; don't retry a POST after a 5xx without checking it didn't land\n\n## Other comparisons with 1Password service accounts, SDKs and Environments MCP or Infisical\n\n- [1Password service accounts, SDKs and Environments MCP vs Akeyless (SecretlessAI and MCP server)](https://www.anchorterminal.com/compare/1password-vs-akeyless.md)\n- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-bitwarden-secrets-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs Doppler](https://www.anchorterminal.com/compare/1password-vs-doppler.md)\n- [1Password service accounts, SDKs and Environments MCP vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)\n- [Akeyless (SecretlessAI and MCP server) vs Infisical](https://www.anchorterminal.com/compare/akeyless-vs-infisical.md)\n- [AWS Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.md)\n- [Bitwarden Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-infisical.md)\n- [Doppler vs Infisical](https://www.anchorterminal.com/compare/doppler-vs-infisical.md)\n- [Google Cloud Secret Manager vs Infisical](https://www.anchorterminal.com/compare/google-secret-manager-vs-infisical.md)\n- [HashiCorp Vault + Vault MCP Server vs Infisical](https://www.anchorterminal.com/compare/hashicorp-vault-vs-infisical.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "1Password service accounts, SDKs and Environments MCP vs Infisical", "url": "" } ], "description": "Infisical has a score of 81.9 (A) against 1Password service accounts, SDKs and Environments MCP's 69.9 (B). Both do secrets store. The largest gap is reliability, 22 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "1Password service accounts, SDKs and Environments MCP B 69.9", "Infisical A 81.9", "scores" ], "h1": "1Password service accounts, SDKs and Environments MCP vs Infisical", "image": "https://www.anchorterminal.com/assets/og/compare-1password-vs-infisical.png", "path": "/compare/1password-vs-infisical", "published": "2026-10-01", "section": "tools", "title": "1Password service accounts, SDKs and Environments MCP vs Infisical", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/1password-vs-infisical" }, "tokens": { "markdown": 1850, "slim": 380 }, "version": 1 }