fix: readable onepassword:// resources and security hardening (v5.0.0)

[CakeRepository]

Summary

One release, 5.0.0, combining two pieces of work. Supersedes #32, which can be closed once this merges. 4.0.4 is never published; its notes are folded into the 5.0.0 CHANGELOG entry.

1. Resources fix (breaking URI change). The three MCP resources couldn't be read by real clients:

• The SDK parses every resources/read URI with new URL(), and 1password:// isn't a valid scheme, because a scheme can't start with a digit. Every read failed with -32602 Resource URI … is invalid.
• …/vaults/{vaultId}/items was registered as a static URI, so no concrete vault URI could match it.

Now the URIs use onepassword://. I ruled out op:// because it collides with 1Password secret references. The per-vault items resource is a ResourceTemplate, and vaultId comes from the template variables, percent-decoded.

2. Security hardening from #32, merged in unchanged as d9905bd:

• Deny-by-default item_get masking.
• A server-wide vault allow-list (src/vault-access.ts).
• op_run fixes for redaction, the output cap, and timeouts.
• Hardened CI and publish workflows.
• An absolute path for the Keychain lookup, and a startup warning when the token is passed on the command line.

Breaking and behavior changes

• Resource URIs change from 1password://… to onepassword://…. The old ones never resolved.
• The vault allow-list (OP_MCP_ALLOWED_VAULTS) now applies to every tool and resource. Tools that take a vaultId need the vault's ID, not its name.
• item_get hides SSH keys, OTP seeds, and card numbers unless you pass reveal: true.

How the two fit together

• src/resources/index.ts merged cleanly. filterAllowedVaults() filters onepassword://vaults, and assertVaultIdAllowed() runs on the decoded vaultId, the same value items.list() gets.
• fix(security): harden item_get, vault allow-list, op_run, and CI (v4.0.4) #32's nine resource tests in tests/vault-allowlist.test.ts called the callbacks with the old signatures. The merge commit updates them.
• buildServer() moved to src/server.ts (still re-exported from src/index.ts), so tests can build the real server without starting stdio.

Testing

• New tests/resources.e2e.test.ts: a real @modelcontextprotocol/client (new dev dependency, same version as the server package) reads every advertised resource from serveStdio(() => buildServer()) over InMemoryTransport, in both the 2025 and 2026-07-28 protocol eras. It also covers the allow-list, including a check that percent-encoding can't bypass it. Run against master's code, it fails with exactly the reported error.
• Mutation checks: removing the allow-list wiring, or checking the encoded vaultId instead of the decoded one, makes the new tests fail.
• Full suite (npm run clean && npm ci && npm run build && npm run lint && npm test): 414 passed, 1 skipped (a POSIX-only op_run test, skipped on Windows).
• Publish build job variant (npm ci --ignore-scripts && npm run build && npm test): passes. Versions are aligned at 5.0.0 in package.json, package-lock.json, server.json, and SERVER_VERSION.
• Smoke test: the built server works over real stdio in both protocol eras.

Commits

• 4cb988b fix(resources): onepassword:// URIs and ResourceTemplate (v5.0.0)
• d9905bd security hardening from fix(security): harden item_get, vault allow-list, op_run, and CI (v4.0.4) #32 (unchanged)
• 0a8ae15 merge, with the conflict resolutions and test updates
• ae34267 end-to-end allow-list tests
• 4edf37f CHANGELOG: fold 4.0.4 into 5.0.0

🤖 Generated with Claude Code