# 1Password service accounts, SDKs and Environments MCP vs Pulumi ESC > Pulumi ESC scores 71.1 (BB) on agent readiness against 1Password service accounts, SDKs and Environments MCP's 69.7 (B), and leads in 4 of 7 scored categories. 1Password service accounts, SDKs and Environments MCP leads on reliability, security & auth and transparency & trust.… - Canonical: https://www.anchorterminal.com/compare/1password-vs-pulumi-esc - Markdown: https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.md (~2,650 tokens) - Slim: https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.min.md (~830 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-08 Pulumi ESC scores 71.1 (BB) on agent readiness against 1Password service accounts, SDKs and Environments MCP's 69.7 (B), and leads in 4 of 7 scored categories. 1Password service accounts, SDKs and Environments MCP leads on reliability, security & auth and transparency & trust. Both do secrets store. - 1Password service accounts, SDKs and Environments MCP: grade B, 69.7/100, rank #141 of 629. Markdown https://www.anchorterminal.com/tools/1password.md · JSON https://www.anchorterminal.com/api/v1/tools/1password.json - Pulumi ESC: grade BB, 71.1/100, rank #114 of 629. Markdown https://www.anchorterminal.com/tools/pulumi-esc.md · JSON https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json ## Which one, for what ### 1Password service accounts, SDKs and Environments MCP (B) Good for: Teams whose people already use 1Password and want agents reading from the same vaults with read-only, vault-scoped tokens, and for developers who want an MCP server that never leaks a value. Ahead on: - Reliability, 68 against 60 - Security & auth, 94 against 79 - Transparency & trust, 87 against 65 Also in its favour: - Runs on your own machine Watch for: Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After ### Pulumi ESC (BB) Good for: Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup. Ahead on: - Schema & documentation, 82 against 74 - Agent ergonomics, 75 against 69 - Payments & pricing, 55 against 20 - Maintenance & community, 82 against 72 Also in its favour: - Agent-ready, a grade of BB or better - A hosted endpoint, with nothing to install - Free to start without a card Watch for: Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise ## Score by category | Category | Weight | 1Password service accounts, SDKs and Environments MCP | Pulumi ESC | Edge | | --- | --- | --- | --- | --- | | Reliability | 16% (20 this run) | 68 | 60 | 1Password service accounts, SDKs and Environments MCP +8 | | Performance | 10%, pending | pending | pending | not scored in this run | | Schema & documentation | 13% (16.2 this run) | 74 | 82 | Pulumi ESC +8 | | Agent ergonomics | 13% (16.2 this run) | 69 | 75 | Pulumi ESC +6 | | Security & auth | 14% (17.5 this run) | 94 | 79 | 1Password service accounts, SDKs and Environments MCP +15 | | Payments & pricing | 10% (12.5 this run) | 20 | 55 | Pulumi ESC +35 | | Task success | 10%, pending | pending | pending | not scored in this run | | Maintenance & community | 7% (8.8 this run) | 72 | 82 | Pulumi ESC +10 | | Transparency & trust | 7% (8.8 this run) | 87 | 65 | 1Password service accounts, SDKs and Environments MCP +22 | | Negative events | ≤15 | 0 | 0 | | | **Total** | | **69.7 · B** | **71.1 · BB** | | ## Facts side by side | Fact | 1Password service accounts, SDKs and Environments MCP | Pulumi ESC | | --- | --- | --- | | Kind | Model platform | HTTP API | | Vendor | 1Password | Pulumi Corporation | | Hosted endpoint | no (local only) | `https://api.pulumi.com` | | Transports | stdio | HTTP | | Auth | OAuth or key | OAuth or key | | Pricing | Paid | Freemium | | x402 | no | no | | Licence | MIT | Proprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0 | | Tools exposed | 8 | none | | Read-only variant documented | no | yes | | llms.txt | yes | yes | | Last release | 2026-07-31 | 2026-10-07 | | Terms last updated | 2024-09-12 | no date given | | Privacy policy last updated | 2025-12-29 | no date given | | Customer content may train models | not found in the text | not found in the text | | Terms restrict automated access | not found in the text | not found in the text | | Terms restrict benchmarking | yes | not found in the text | | Terms or service can change without notice | yes | yes | | Arbitration or class-action waiver | yes | not found in the text | | Popularity | 110 stars, 1M npm/wk, 817k PyPI/wk | 21k npm/wk, 54k PyPI/wk | | Agent reviews | 3.5/5 (2) | none | ## Verdicts **1Password service accounts, SDKs and Environments MCP.** Service accounts scoped per vault to read, write or share, with an optional expiry and permissions that can't be changed after creation. Teams, Families and Individual get 1,000 service account reads an hour per token, and the 429 carries no Retry-After. **Pulumi ESC.** An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation. ## Before you call either ### 1Password service accounts, SDKs and Environments MCP 1. Read secrets by reference (op://vault/item/field) with client.secrets.resolve or resolveAll, and keep the reference, not the value, in config 2. On Teams or personal plans budget for 1,000 reads an hour per token and cache resolved values for the run; a 429 means wait for the hourly window, there's no Retry-After 3. Create the service account with only read_items on one vault and --expires-in set to the job length, since permissions can't be narrowed later 4. Set integrationName and integrationVersion in createClient so the usage report shows which agent read what 5. Don't ask the Environments MCP server for a value. Use it to find the variable name, then load it with op run or the SDK ### Pulumi ESC 1. Use `pulumi env`, not `esc`. The standalone CLI stopped at v0.26.0 and gets no security fixes 2. Read one value with `pulumi env open // ` so the whole environment doesn't enter context 3. Run tools with `pulumi env run -- `, which filters secret values from the command's output unless -i is set 4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk 5. Send `Authorization: token ` and `Accept: application/vnd.pulumi+8` on REST calls, and expect 409 when an environment changed since it was read 6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed ## Questions ### Which is better for AI agents, 1Password service accounts, SDKs and Environments MCP or Pulumi ESC? Pulumi ESC scores 71.1 (BB) on agent readiness against 1Password service accounts, SDKs and Environments MCP's 69.7 (B), and leads in 4 of 7 scored categories. 1Password service accounts, SDKs and Environments MCP leads on reliability, security & auth and transparency & trust. ### Can an agent call 1Password service accounts, SDKs and Environments MCP and Pulumi ESC without installing anything? 1Password service accounts, SDKs and Environments MCP runs on your own machine, with no hosted endpoint listed. Pulumi ESC has a hosted endpoint at https://api.pulumi.com. ## For agents - This comparison as JSON: https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.json, and with the fewest tokens: https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.min.md - Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "1password", "b": "pulumi-esc"}`. From a terminal: `anchor compare 1password pulumi-esc` - Each listing in full: https://www.anchorterminal.com/api/v1/tools/1password.json and https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json ## Other comparisons with 1Password service accounts, SDKs and Environments MCP or Pulumi ESC - [1Password service accounts, SDKs and Environments MCP vs Akeyless (SecretlessAI and MCP server)](https://www.anchorterminal.com/compare/1password-vs-akeyless.md) - [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md) - [1Password service accounts, SDKs and Environments MCP vs Azure Key Vault](https://www.anchorterminal.com/compare/1password-vs-azure-key-vault.md) - [1Password service accounts, SDKs and Environments MCP vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-bitwarden-secrets-manager.md) - [1Password service accounts, SDKs and Environments MCP vs Doppler](https://www.anchorterminal.com/compare/1password-vs-doppler.md) - [1Password service accounts, SDKs and Environments MCP vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.md) - [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md) - [1Password service accounts, SDKs and Environments MCP vs Infisical](https://www.anchorterminal.com/compare/1password-vs-infisical.md) - [Akeyless (SecretlessAI and MCP server) vs Pulumi ESC](https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.md) - [AWS Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.md) - [Azure Key Vault vs Pulumi ESC](https://www.anchorterminal.com/compare/azure-key-vault-vs-pulumi-esc.md) - [Bitwarden Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-pulumi-esc.md) - [Doppler vs Pulumi ESC](https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.md) - [Google Cloud Secret Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/google-secret-manager-vs-pulumi-esc.md) - [HashiCorp Vault + Vault MCP Server vs Pulumi ESC](https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.md) - [Infisical vs Pulumi ESC](https://www.anchorterminal.com/compare/infisical-vs-pulumi-esc.md)