From a49c947d285b460645730a308cd7f67351eefb23 Mon Sep 17 00:00:00 2001
From: Justin Trantham <takescake@outlook.com>
Date: Wed, 29 Jul 2026 19:26:02 -0500
Subject: [PATCH 1/5] release: bump package version to 3.0.0

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 67f4f16..6e0cf38 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@takescake/1password-mcp",
-  "version": "2.5.0",
+  "version": "3.0.0",
   "private": false,
   "type": "module",
   "description": "MCP server for 1Password service accounts — tools, prompts, and resources for vault and credential management",
@@ -59,4 +59,4 @@
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   }
-}
+}
\ No newline at end of file

From cb4f72c72a2fb28808a741280ad07ff4cc379c5e Mon Sep 17 00:00:00 2001
From: Justin Trantham <takescake@outlook.com>
Date: Wed, 29 Jul 2026 19:26:09 -0500
Subject: [PATCH 2/5] release: align server manifest to 3.0.0

---
 server.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server.json b/server.json
index a0d2d90..327c6e6 100644
--- a/server.json
+++ b/server.json
@@ -6,12 +6,12 @@
     "url": "https://github.com/CakeRepository/1Password-MCP.git",
     "source": "github"
   },
-  "version": "2.5.0",
+  "version": "3.0.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@takescake/1password-mcp",
-      "version": "2.5.0",
+      "version": "3.0.0",
       "transport": {
         "type": "stdio"
       },
@@ -40,4 +40,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file

From d4d6f89777ed8cb60b2de895d172c29a54bd525d Mon Sep 17 00:00:00 2001
From: Justin Trantham <takescake@outlook.com>
Date: Wed, 29 Jul 2026 19:26:23 -0500
Subject: [PATCH 3/5] release: align runtime version to 3.0.0

---
 src/config.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/config.ts b/src/config.ts
index a718342..428db67 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -6,7 +6,7 @@ import { execFileSync } from "node:child_process";
 import { LOG_LEVEL_VALUES, type LogLevel } from "./types.js";
 
 export const SERVER_NAME = "1password-mcp";
-export const SERVER_VERSION = "2.5.0";
+export const SERVER_VERSION = "3.0.0";
 
 /** Parse a `--flag value` or `--flag=value` argument from process.argv. */
 function getArgValue(name: string): string | undefined {

From 002169a978c06812817d80e48a5e88b8ab553739 Mon Sep 17 00:00:00 2001
From: Justin Trantham <takescake@outlook.com>
Date: Wed, 29 Jul 2026 19:26:37 -0500
Subject: [PATCH 4/5] docs: add 3.0.0 release notes

---
 CHANGELOG.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4a7688..27616a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.0] - 2026-07-29
+
+### Added
+
+- **`op_run` tool** — Run local commands with `op://` secret references injected into child-process environment variables without returning plaintext secret values to the model. Resolved values are redacted from command output and errors.
+- **`op_check_ref` tool** — Validate a 1Password secret reference and return only non-secret metadata.
+- **Optional vault allow-list** — Restrict `op_run` and `op_check_ref` to configured vault names or IDs with `OP_MCP_ALLOWED_VAULTS` or `--allowed-vaults`.
+
+### Changed
+
+- **Breaking: `password_read` is metadata-only by default** — Callers must now pass `reveal: true` to receive a plaintext secret value.
+- Updated `password_read` and `item_get` tool guidance to prefer `op_run` when a secret needs to be used rather than revealed.
+- `op_run` resolves multiple secret environment references in one bulk SDK request.
+
+### Security
+
+- Reduced accidental secret exposure in model context and conversation transcripts by making explicit plaintext reveal opt-in.
+
 ## [2.5.0] - 2026-07-04
 
 ### Added

From e35eb82ff6f8c97123da78f244243471bd1c21ea Mon Sep 17 00:00:00 2001
From: Justin Trantham <takescake@outlook.com>
Date: Wed, 29 Jul 2026 19:26:49 -0500
Subject: [PATCH 5/5] ci: add one-time v3.0.0 release trigger

---
 .github/workflows/release-v3.yml | 38 ++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .github/workflows/release-v3.yml

diff --git a/.github/workflows/release-v3.yml b/.github/workflows/release-v3.yml
new file mode 100644
index 0000000..692f8a1
--- /dev/null
+++ b/.github/workflows/release-v3.yml
@@ -0,0 +1,38 @@
+name: Release v3.0.0
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - package.json
+      - server.json
+      - src/config.ts
+      - CHANGELOG.md
+      - .github/workflows/release-v3.yml
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate release version
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          test "$VERSION" = "3.0.0"
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view v3.0.0 >/dev/null 2>&1; then
+            echo "Release v3.0.0 already exists."
+          else
+            gh release create v3.0.0 \
+              --target "$GITHUB_SHA" \
+              --title "v3.0.0" \
+              --notes "Major security-focused release. password_read is now metadata-only unless reveal: true is explicitly supplied. Adds op_run and op_check_ref so agents can use and validate 1Password references without exposing plaintext secrets."
+          fi