feat(security): default password_read to metadata-only (breaking)#13
Open
u2giants wants to merge 1 commit into
Open
feat(security): default password_read to metadata-only (breaking)#13u2giants wants to merge 1 commit into
u2giants wants to merge 1 commit into
Conversation
…toward op_run Flips password_read's `reveal` default from true to false so that reading a secret does not, by default, place its plaintext into the model context and transcript. Callers who genuinely need the value pass `reveal: true` explicitly. item_get already conceals by default; its description and password_read's are updated to point agents at op_run as the way to USE a secret without revealing it. BREAKING CHANGE: password_read no longer returns the secret value unless `reveal: true` is passed. Previously the value was returned by default. Test updated to pass reveal explicitly where the value is asserted, plus a new test locking in the metadata-only default. Build + 80 tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
u2giants
added a commit
to u2giants/1Password-MCP
that referenced
this pull request
Jul 16, 2026
…sitory#11; CakeRepository#12/CakeRepository#13 open) PR CakeRepository#7 is closed — the maintainer merged its item tools upstream through his own PR CakeRepository#11 (2026-07-04), so feat/item-get-edit-list is now historical, not the base for an open PR. Adds an "Upstream contributions" section documenting how new contributions are cut from fresh branches off upstream/master (genericizing fork-only defaults like the vibe_coding vault allow-list) and tracking the two currently-open PRs: CakeRepository#12 (op_run/op_check_ref) and CakeRepository#13 (reveal-default hardening). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
By default,
password_readcurrently returns the secret value in plaintext. In an MCP/agent setting that means simply reading a credential places it into the model's context and the conversation transcript — often when the agent only needed to confirm a secret exists or wanted to use it, not see it.This PR makes the safe path the default:
password_read:revealnow defaults tofalse(metadata-only). Callers who genuinely need the plaintext passreveal: trueexplicitly.item_get: already conceals by default — unchanged behavior; only its description is updated.op_run(added in feat: add op_run and op_check_ref (use secrets without revealing plaintext) #12) as the way to use a secret without ever revealing its plaintext.password_readno longer returns the secret value unlessreveal: trueis passed. Any caller relying on the value coming back by default must addreveal: true. This is intentional — it trades a small ergonomic change for a meaningful reduction in accidental secret exposure.Relationship to #12
This complements #12 (
op_run/op_check_ref); the updated descriptions referenceop_run. The two can be reviewed/merged independently — this PR stands on its own, but lands best alongside #12 so the "prefer op_run" guidance points at a tool that exists in-tree.Tests
password_readsecret-reference test to passreveal: truewhere it asserts the value.npm run build && npm testgreen — 80 tests passing.🤖 Generated with Claude Code