release: v3.0.0

.github/workflows/release-v3.yml

@@ -0,0 +1,38 @@
+name: Release v3.0.0
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - package.json
+      - server.json
+      - src/config.ts
+      - CHANGELOG.md
+      - .github/workflows/release-v3.yml
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate release version
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          test "$VERSION" = "3.0.0"
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view v3.0.0 >/dev/null 2>&1; then
+            echo "Release v3.0.0 already exists."
+          else
+            gh release create v3.0.0 \
+              --target "$GITHUB_SHA" \
+              --title "v3.0.0" \
+              --notes "Major security-focused release. password_read is now metadata-only unless reveal: true is explicitly supplied. Adds op_run and op_check_ref so agents can use and validate 1Password references without exposing plaintext secrets."
+          fi

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.0] - 2026-07-29
+
+### Added
+
+- **`op_run` tool** — Run local commands with `op://` secret references injected into child-process environment variables without returning plaintext secret values to the model. Resolved values are redacted from command output and errors.
+- **`op_check_ref` tool** — Validate a 1Password secret reference and return only non-secret metadata.
+- **Optional vault allow-list** — Restrict `op_run` and `op_check_ref` to configured vault names or IDs with `OP_MCP_ALLOWED_VAULTS` or `--allowed-vaults`.
+
+### Changed
+
+- **Breaking: `password_read` is metadata-only by default** — Callers must now pass `reveal: true` to receive a plaintext secret value.
+- Updated `password_read` and `item_get` tool guidance to prefer `op_run` when a secret needs to be used rather than revealed.
+- `op_run` resolves multiple secret environment references in one bulk SDK request.
+
+### Security
+
+- Reduced accidental secret exposure in model context and conversation transcripts by making explicit plaintext reveal opt-in.
+
 ## [2.5.0] - 2026-07-04
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takescake/1password-mcp",
-  "version": "2.5.0",
+  "version": "3.0.0",
   "private": false,
   "type": "module",
   "description": "MCP server for 1Password service accounts — tools, prompts, and resources for vault and credential management",
@@ -59,4 +59,4 @@
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   }
-}
+}

server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/CakeRepository/1Password-MCP.git",
     "source": "github"
   },
-  "version": "2.5.0",
+  "version": "3.0.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@takescake/1password-mcp",
-      "version": "2.5.0",
+      "version": "3.0.0",
       "transport": {
         "type": "stdio"
       },
@@ -40,4 +40,4 @@
       ]
     }
   ]
-}
+}

src/config.ts

@@ -6,7 +6,7 @@ import { execFileSync } from "node:child_process";
 import { LOG_LEVEL_VALUES, type LogLevel } from "./types.js";
 
 export const SERVER_NAME = "1password-mcp";
-export const SERVER_VERSION = "2.5.0";
+export const SERVER_VERSION = "3.0.0";
 
 /** Parse a `--flag value` or `--flag=value` argument from process.argv. */
 function getArgValue(name: string): string | undefined {