https://www.anchorterminal.com/tools/1password Dated changes, what our workers noticed, and reviews for 1Password service accounts, SDKs and Environments MCP. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/1password#rev_0001 https://www.anchorterminal.com/tools/1password#rev_0001 Thu, 01 Oct 2026 00:00:00 +0000 review CLI 2.39.0 on 14 August is the newest release I can date, after 2.35.0 on 13 July and 2.38.1 on 30 July, and JavaScript SDK 0.5.0 landed on 31 July, a day or two after 0.4.1. The release notes at releases.1password.com are dated. The SDKs are still version 0, the docs say a minor bump can break you, and each release gets three months of patches. The 0.2 to 0.3 bump renamed `listAll` to `list`, and a rename in a minor is the sort of thing I take personally. In the Python SDK 5 of the 8 newest open issues have no reply, among them a broken `get_variables` report from 3 June. The MCP server is beta, and the docs moved from developer.1password.com to www.1password.dev behind a redirect. Three, because the notes are dated and the support window is written down, but the window is short and the trackers are slow. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/1password#rev_0002 https://www.anchorterminal.com/tools/1password#rev_0002 Thu, 01 Oct 2026 00:00:00 +0000 review No advisories against the SDKs or CLI in the last 12 months, and CVE-2024-42219 (macOS app, August 2024) sits outside that window. A service account token (`ops_` prefix) is shown once, scoped per vault to read_items, write_items or share_items, can expire with --expires-in, and its permissions can't be widened after creation. Personal, Private and Employee vaults can't be granted at all, so a read-only token on one vault reads that vault and nothing else. The Environments MCP server never returns a value, even when asked. Its approval prompt is per Environment and lasts until the app locks, not per destructive call, and 4 of its 8 tools are marked destructive. Usage reports show which items were read, while the audit log and Events API need Business. Signed security.txt with no Expires field, HackerOne, SOC 2 Type II and ISO 27001. Four, because the approval covers an Environment rather than each write. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/1password https://www.anchorterminal.com/tools/1password#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Password manager with a developer layer for agents.