offprompt vs 1Password Environments MCP vs Infisical MCP
offprompt is for the moment a coding agent needs a key it does not have. You type the key on a page served from 127.0.0.1, offprompt writes it straight to the project's .env or .env.local, and only the key's name, never its value, enters the agent's transcript. 1Password's and Infisical's MCP servers give the agent access to a secrets store you already keep. They answer different problems, and they work together.
At a glance
| Question | offprompt | 1Password Environments MCP | Infisical MCP |
|---|---|---|---|
| What it is | An MCP server the agent calls to ask you for a value, which it writes into the project | An MCP server, part of the 1Password desktop app, that manages 1Password Environments | Infisical's MCP server, which calls Infisical's API |
| How a new value gets in | You type or paste it on a page served from 127.0.0.1. The agent never handles it | In the 1Password app, or the agent passes values to append_variables. Its Claude Code skill imports a .env by having the agent read the file | The agent passes it as secretValue to create-secret or update-secret |
| Can its tools return a value to the agent | No. Results carry the key names, the file and a four-emoji fingerprint | No. The docs say it "never returns the secrets stored in your Environments" | Yes, by default, from get-secret and list-secrets. Since version 0.0.24, INFISICAL_MASK_SECRET_VALUES=true replaces them with <masked> |
| Where values live | In the project's .env, .env.local or another file the agent names | In 1Password. A mounted .env is a named pipe on Mac and Linux, read on demand and never stored on disk. Once unlocked, any process can read it | In Infisical Cloud or a self-hosted Infisical |
| Checks a key's format | Yes, for 65 providers and 111 kinds of key, such as a prefix and a length, plus 12 formats | Not documented | Not for particular providers. A project can set validation rules, such as a length, a regex or a prefix, that Infisical checks on every write |
| From a cloud sandbox | Yes. A link through a Cloudflare quick tunnel, with values encrypted in your browser to a key only the sandbox holds | The MCP server runs locally in the desktop app, and the docs say remote-only MCP clients are not supported yet. A separate integration, 1Password for NVIDIA OpenShell (beta), gives an agent in an OpenShell sandbox placeholders instead of values | Not documented for the MCP server, which needs Infisical credentials wherever it runs. Infisical's separate Agent Vault (preview) is a proxy that adds the credential to an agent's requests, so the agent never holds it |
| Account needed | None | A 1Password account and the desktop app | An Infisical account, with a machine identity or an access token |
| Agents named in its docs | Claude Code, Codex, Cursor, Pi, and any agent that speaks MCP | Claude Code, Codex, Cursor, Kiro and OpenCode, and any client that speaks MCP over stdio | Claude Desktop, in its configuration example |
| Setup | npx offprompt init | Turn on Integrate with MCP clients under Settings > Developer in the 1Password app, then add 1password-mcp to the agent or install the Claude Code plugin | npx -y @infisical/mcp, with Infisical credentials in its environment |
| License and price | MIT, free | Needs a 1Password subscription. The Claude Code plugin is MIT, and marked beta | The MCP server is Apache-2.0. Infisical has a free plan and paid plans |
What each tool's own docs say, as of 30 October 2026. “Not documented” means its docs do not say.
What offprompt does differently
The value never passes through the agent. The agent calls offprompt with the names of the keys it needs, why, and the file they go in. offprompt opens a page in your browser on 127.0.0.1, you paste each key there, and offprompt writes the file. The agent gets back the key names and a four-emoji fingerprint to compare with the page. The value is never in a prompt, a tool argument or a tool result.
It works from cloud sandboxes. When the agent runs in Claude Code on the web, a Cursor Cloud Agent, Codex cloud or a codespace, it passes you a link through a Cloudflare quick tunnel. Your browser encrypts the values to a key only the sandbox holds, so the tunnel carries ciphertext, and the sandbox needs no login to a secrets store.
It knows what a key looks like. Its registry knows 65 providers and 111 kinds of key: where each is made, and the prefix and length it should have, so a key pasted from the wrong provider is caught before it is written.
It needs nothing else. No account and no server: it is open source under the MIT license, and npx offprompt init sets it up for Claude Code, Codex, Cursor and Pi in the project.
When another tool fits
offprompt does not store, share, sync or rotate secrets, and once the file is written it does not guard it: the agent could still open it, which every result tells it not to do. If your team already keeps its secrets in 1Password or Infisical, their tools keep them there. The contents of 1Password's mounted .env are never stored on disk, and Infisical's MCP server lets an agent manage a project's secrets, with values masked when you turn that on. For an agent that should use a key without seeing it, 1Password for NVIDIA OpenShell (beta) and Infisical's Agent Vault (preview) put the real value in at a gateway or a proxy.
They combine, too. A store's command line, such as op inject or infisical export, writes a file on your machine that you drop on offprompt's page, which takes only the keys the agent asked for. See Values you already keep.
Sources
- offprompt: Docs, Threat model, GitHub
- 1Password Environments MCP: 1Password Environments MCP Server, Local .env files, 1Password Environments, 1Password for NVIDIA OpenShell, Claude Code plugin skill
- Infisical MCP: infisical-mcp-server README, Secret validation rules, Agent Vault, Infisical pricing
Something here out of date? Open an issue on GitHub.
FAQ
What is the difference between offprompt and a secrets manager's MCP server?
A secrets manager's MCP server lets the agent work with a store you already keep: list it, add to it, and with some, read values from it. offprompt keeps no store. It is for the moment a task needs a key the project does not have yet: the agent asks for it by name, you type it on a page in your browser, offprompt writes it to the project's .env, and the agent gets back only the key's name.
Which of these keep secret values out of the agent's context?
offprompt returns key names and a fingerprint, never values. 1Password's docs say its MCP server never returns the secrets stored in your Environments, though its Claude Code skill imports an existing .env by having the agent read the file. Infisical's MCP server returns values from get-secret and list-secrets unless INFISICAL_MASK_SECRET_VALUES is set to true. Both also offer a separate way for an agent to use a key it never sees: 1Password for NVIDIA OpenShell (beta) gives the agent placeholders and swaps in the real values at a gateway, and Infisical's Agent Vault (preview) adds the real credential to the agent's requests at a proxy.
Does offprompt replace 1Password or Infisical?
No. offprompt does not store, share or rotate secrets. It gets a value from you into the project's file without the chat. A team that keeps its secrets in 1Password, Infisical, Doppler or Vercel can use their command line to write a file on the laptop and drop it on offprompt's page, which takes only the keys the agent asked for.
Does offprompt work in cloud sandboxes?
Yes. From Claude Code on the web, a Cursor Cloud Agent, Codex cloud, a codespace or an SSH session, the agent passes you a link to offprompt's page through a Cloudflare quick tunnel. Your browser encrypts the values to a key only the sandbox holds before they leave it, so the tunnel carries ciphertext, and the sandbox needs no login to a secrets store.
Can the agent read the .env file offprompt writes?
It can, if it opens it: the file is on disk, and offprompt does not watch what the agent reads. Every result tells the agent not to open the file and lists the keys it holds, so the agent has no reason to, and a deny rule in Claude Code or .cursorignore in Cursor closes the agent's file tools to it.
How do I install offprompt?
Run npx offprompt init in the project. It adds offprompt to Claude Code, Codex, Cursor and Pi, and the project carries it, so everyone who works on it gets it too. npx offprompt init -g installs it for you, in every project. It is open source under the MIT license.
Try it
In a project, run the command below, then ask the agent for something that needs a key. Or read how to keep secrets out of your AI agent's context.
npx offprompt init