Bitwarden MCP Server
The official MCP exposes Bitwarden vault operations and, with separate credentials, organization administration.
- 306 ★ on the repository
- Last commit
- GPL-3.0
Broad access
Why this level
- The agent can read passwords and protected data, create or delete items and administer the organization when given those credentials.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/bitwarden-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent can read passwords and protected data, create or delete items and administer the organization when given those credentials.
This is third-party code. Review the repository files before installing.
What it does
Bitwarden MCP Server connects an agent to a vault through Bitwarden CLI. Tools read and modify items, manage folders, attachments and temporary shares, and retrieve one-time codes. Locking and unlocking have dedicated operations. A separate Public API interface manages organization members, groups, collections and policies with different credentials. Users choose which interface to expose to their local MCP client.
Who it is for. Bitwarden administrators using a local agent for a test vault or authorized organization tasks.
Good fit when
- A test vault needs item lookup by folder or URL.
- An administrator reviews members and collection permissions.
- Vault maintenance requires synchronization or locking.
- An authorized file needs a temporary Bitwarden Send share.
Not a fit when
- The MCP server would be hosted publicly or exposed over a network.
- Passwords and secure notes must not reach the model.
- Configuration containing session and organization credentials cannot be protected.
Example request
Check the test Bitwarden vault status and folders without displaying passwords or one-time codes.MCP
- Transport
- stdio
- Authentication
- API key
Limitations
The server is for local use; the author prohibits public hosting and network exposure. Vault operations need Node.js 22 or later, Bitwarden CLI and an unlocked session. Organization administration requires Teams or Enterprise, owner or admin privileges and separate API credentials. Agent access includes secrets and record changes, so begin with a test vault and understand where the selected model retains responses.
How to disable. Lock the vault, stop MCP and remove the client connection. Revoke unused organization API credentials and remove the saved session token.
FAQ
Are organization keys mandatory?
No. Vault operations use a CLI session; organization credentials are separate.
Where is the master password entered?
Interactive unlocking uses a native operating-system dialog; do not send the password in model chat.
What happens on a headless machine?
The unlock tool refuses; use the manual CLI flow and update configuration outside chat.
Why are file operations denied?
Set `BW_ALLOWED_DIRECTORIES`; file tools are rejected when no directories are allowed.
Can I inspect organization events?
Yes. The administrative interface reads events when credentials permit.
Discussion
No questions or reviews yet.
Related
MCP serversOfficial Auth0 MCP server: tenant applications, Actions, logs and users via the Management API
Official HashiCorp Vault MCP server: mounts, KV secrets and PKI certificates from an agent
A local password manager with MCP: the agent signs in to sites, SSH and APIs while hidden secrets stay out of model context
MCP access to Wazuh for investigating alerts and vulnerabilities, checking SIEM health and invoking response tools
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
Official BunkerWeb MCP server: 44 tools for WAF services, instances, IP bans, configurations and plugins.
README in short
The server uses local stdio and supports self-hosted Bitwarden endpoints. Attachment and Send tools have explicit file restrictions.