the head of ops
A leaked key, replaced within the hour.
whyThe key was pasted in a chat.
asksThe staging API key leaked. Rotate it.
instibrain / works with / 1password
1Password, read only when used.
Your AI runs op, unlocked by your 1Password app. A page names the item. The value never prints, and never reaches us.
team/tools/1password/1password.md reference onlyasked · an exampleWhich key does the mail relay use? Rotate it.
the AI, from the pageYour page names it: Mail relay, in Engineering. Copy the new value, and I write it from your clipboard, never typed.
op. The page still holds only the reference.who uses it, and why
Who uses 1Password this way, and why.
Three jobs a vault makes slow by hand.
a developer
A migration run, the password never seen.
whyA pasted password stays in your shell history.
asksRun the migration with the staging database credential.
a team lead
A new hire's vault access, in one ask.
whyDay one waits while someone shares vaults by hand.
asksGive the new engineer view access to the Engineering vault.
what you can ask
Your AI reads, adds and shares 1Password items without showing a value.
Every command runs as you, through op. Values are fetched only inside the command that needs them.
Read a secret where it is used
One field, fetched inside the command that needs it.
Find an item by title
Ids, titles and vault names come back. Values never do.
Inspect an item, values hidden
Fields as labels and types. Notes stay unprinted.
Add or rotate a secret
Written from your clipboard, never typed into a command.
Share a vault
Grant a teammate view or edit, or move an item to the team.
Archive, never delete
Archived items stay in the vault. A vault goes only when empty.
where the credential stays
Your 1Password app unlocks each command your AI runs.
Nothing of 1Password's is stored with us. Nothing of ours is in your account.
in 1Password
Touch ID, Windows Hello or your password unlocks op. No token on disk. Claude Code logs each command it runs, so the value is fetched inside the command, never typed into it.
in your brain
A page holds the reference, op://<vault>/<item>/<field>, never the value.
what instibrain never touches
Three lines the AI never crosses.
Our server stores the page that names the item, and nothing else of 1Password's.
- The value of any item.
Read on your computer, inside the command that uses it.
- Your 1Password account.
No integration, no app, no token of ours.
- A bulk change without your go.
Moves, archives and grants show you the list first.
the limits
Your AI stays signed in only while the 1Password app runs.
One limit you meet without the desktop app.
| Limit | What it means |
|---|---|
| Without the desktop app, sessions end | A terminal sign-in ends after 30 idle minutes. |
before you connect it
Your AI reads only the vaults you can read.
Does instibrain store my 1Password items or a token?
No. A page holds an
op:// reference. Your computer reads the value at use.Which items can the AI reach?
What you can: your vaults, and the team vaults you were granted.
Can the AI delete an item or a vault?
It archives items, and deletes only an empty vault, after your go.
The secret stays in your vault.
Write once which item holds each credential. Every AI works from that map.
password managersBitwarden
Collections and your own vault, one field at a time.
password managersKeeperShared folders by seat, through Keeper Commander.
password managersKeychainYour computer's own store, read with no prompt.
every kindWorks withEvery system by kind, and the rule each page shares.