Secrets

Secrets provides private text and image input through one-use execution grants, and optional 1Password Connect access for agents. Private-input values stay outside the conversation; Connect item reads return field values to the agent. The request appears as a question card in the current conversation. Fill one field at a time, use the tabs to revisit answers, and select Next or Submit secrets. Completed fields show a check. Select Skip to omit the current field and clear its input, or revisit a skipped field to fill it. Skipping the last field submits the completed selection; skipping every field finishes without creating a grant. The agent receives the skipped field names. Submitting creates a one-use grant and sends the agent its identifier. You can decline a request or revoke an unused grant. Secrets beside the composer also lets you provide input yourself; desktop uses an anchored form and compact layouts use a sheet. /secrets adds an inline form. None of these entries opens a workspace tab.

Text fields become environment values in a separate child process. Image fields become environment variables containing temporary file paths. The child runs in the selected agent's directory. PNG, JPEG and WebP uploads are available on desktop and browser clients, up to four images and 4 MiB combined. Native mobile clients support text input and output review; their plugin SDK does not yet expose an image picker.

For text-only grants, exact secret values are replaced with [REDACTED] in the process output. If a grant includes any image, all stdout and stderr are withheld from the agent. Open Review output, edit the text if needed, and select Release output or Discard output. Only the text you release becomes available through MCP. Releasing it permits it to enter the model context and conversation history. The plugin does not try to infer whether OCR or other derived content is safe.

Requests, unused grants and held output expire after ten minutes. They live in host plugin memory and disappear on plugin reload. The broker removes expired output during its periodic cleanup. Pictures are written to private temporary files only while the consuming command runs and deleted afterward. A host or broker crash can leave temporary files behind; the next successful plugin start cleans its image directory. Deletion is not secure disk erasure. Input values and unreleased output are excluded from ordinary attachments, drafts, timeline data and query/mutation caches.

To use 1Password Connect, open Settings → Plugins → Secrets → ⋯ → 1Password Connect and save your Connect server URL and access token. The configuration survives plugin reload and daemon restart. If the daemon needs a proxy to reach Connect, including Tailscale userspace networking, set an HTTP(S) or SOCKS5 proxy URL. You can save it separately without re-entering the Connect token. All Connect traffic then uses that proxy, retaining HTTPS certificate validation; proxy failures do not fall back to a direct connection. You can test the saved connection, disable agent access without deleting credentials, or delete the saved configuration. The client can browse vaults and item metadata, filter titles and refresh lists even while agent access is disabled. The list does not fetch secret field values; the string labelled Item ID identifies the item.

Connect's MCP tools let agents list vaults and items, read complete items, create items and replace items within the token's permissions. Read and write results include field values in agent context and may be sent to the selected agent provider. This access is shared by callers of the host's loopback MCP endpoint rather than restricted by a per-agent grant. The token is stored as a plaintext file accessible to the daemon user, same-user processes, administrators and backups; it is not returned to the client. Use a token limited to the vaults and operations you intend agents to access. See Connect setup and tool contracts.

Requires Paseo 0.11.2 or later and a macOS or Linux daemon. New Codex, Claude, OpenCode and Copilot agents receive the local MCP configuration automatically. Existing agents need provider MCP configuration and a session reload to discover new tools; a reload alone does not add a missing MCP entry. Interactive sessions for supported providers receive loopback proxy exclusions so their local MCP connection stays direct, while Connect requests use the configured outbound proxy. The plugin uses your existing Paseo connection; its transport security depends on that connection.

Commands have a two-minute deadline and a combined 1 MiB output limit. Excess output is discarded. Interactive commands and background services are unsupported. Admission is bounded to eight concurrent commands, 64 pending grants, approximately 32 MiB of pending input and 16 held outputs.

The child process can read, encode, write or transmit its inputs. It runs as the daemon user with filesystem and network access. Separate-process execution and output review prevent accidental disclosure through the normal tool-result path; they are not an operating-system sandbox. An agent with equivalent host access can bypass that path. Grant and output identifiers are bearer capabilities at a loopback-only MCP endpoint, not authenticated per-agent identities. Managed-runtime strings, swap, crash dumps and same-user inspection are outside the plugin's protection.