1Password Agent Broker

Let agents use credentials without handing them the keys. Approve a capability, let the broker perform the operation, and return the result to the agent. Credential access and authorization stay in a service you control.

Contents

• Quick start
  • Install and try it
  • Use with an AI agent
• Why use this tool?
• How it works
  • Request and credential flow
  • Trust boundary
• Operate the broker
  • Connect 1Password and an agent
  • Review access and recover work
• Documentation
  • Deployment and security
  • Development and releases
• Kubernetes and monitoring

Quick start

Install and try it

Requires Python 3.12 or newer, excluding 3.14.1, and Git. No 1Password account, model API key, or cloud infrastructure is needed for the demo.

python -m pip install 'git+https://github.com/astrivant/1password-agent-broker.git'
agent-broker demo

The local demo reports two healthy operations, successful replay protection, cross-identity denial, and zero external provider calls. It creates temporary certificates and synthetic identities, then removes its temporary data on exit.

Use with an AI agent

Point your agent at SKILL.md for the supported setup, validation, and operating procedures. Once a broker is configured, the MCP setup connects an agent through the Model Context Protocol (MCP), using its workload certificate.

Why use this tool?

• Keep credentials out of agent responses. The broker resolves an approved credential and uses it for a fixed operation.
• Control each identity's access. Workload certificates identify the caller; grants bind approval to a request, capability, policy revision, and expiry.
• Retry without repeating completed work. Recorded results survive a lost response. Uncertain outcomes remain visible instead of being silently resubmitted.
• Attribute operations to reviewed work. Operator policy binds identity, revision, run, and optional task IDs to workload certificates. Denials and replay outcomes retain a validated audit record.
• Recover results after approval expires. Inspect an existing request without renewing its grant or repeating its operation.
• Connect through MCP. An agent-facing stdio adapter delegates execution to the authenticated broker.

The first capability is an authenticated HTTPS health check. Provider and executor interfaces allow additional reviewed capabilities; agents cannot supply arbitrary secret references, URLs, headers, or HTTP methods.

How it works

Request and credential flow

flowchart LR
    A[Agent / MCP client] --> M[MCP stdio adapter]
    M -->|Mutual TLS, capability request| B[Broker]
    P[Operator policy and approvals] --> B
    B --> L[Durable audit and replay ledger]
    B -->|Approved field reference| O[1Password SDK worker]
    O -->|In-memory credential| B
    B -->|Fixed HTTPS operation| S[Approved service]

The operator owns policy and approvals. The broker authenticates the workload, validates its request, and records execution state before accessing a credential. The agent receives a bounded result; authorization remains on the broker.

Trust boundary

The broker and its host can access the credentials they use. Protect that host and the workload certificate keys. This alpha has synthetic integration evidence; live account permissions and deployment isolation require operator validation. See security, architecture, and validation boundaries.

For a wholly local developer environment, consider 1Password's native Environments MCP server. This broker is for credential-backed operations executed by a separately authenticated service.

Operate the broker

Connect 1Password and an agent

The broker includes the official 1Password Python SDK. Create a narrowly scoped service account and follow operator setup. It covers platform requirements, policy, certificates, the broker process, request approvals, and MCP configuration.

Review access and recover work

Use the operations guide for revocation, credential rotation, cancellation, and uncertain outcomes. Keep grant management on the operator side and inspect the durable ledger before retrying work whose result is unknown.

Documentation

Deployment and security

• Operations and CLI: configure and run the broker.
• Architecture: ownership, interfaces, and data flow.
• Security policy: handling credentials and reporting vulnerabilities.
• Validation: covered contracts and remaining integration work.

Development and releases

• Development: local checks, containers, and pinned tools.
• Signed releases: key setup, publishing, and artifact verification.
• Contributing and agent instructions.
• Current RFC review: implemented gaps, evidence, and remaining integration gates for RFC #55.

This is an independent Astrivant project using 1Password's official SDK. It is not an official 1Password product.

Kubernetes and monitoring

The Helm chart supports two broker replicas with a shared PostgreSQL replay ledger, validated ConfigMaps, and private Flask metrics/status endpoints. See operations for database durability, image/Secret prerequisites, CRD design, and sizing guidance.