Bitrix24 MCP with confirmation-gated writes

Install

npx skillfoxx add mcp/ericvanin-bitrix24-mcp-server

claude mcp add --transport http bitrix24 https://your-server.example.com/mcp

{
  "mcpServers": {
    "bitrix24": {
      "type": "http",
      "url": "https://your-server.example.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "bitrix24": {
      "url": "https://your-server.example.com/mcp"
    }
  }
}

code --add-mcp '{"name":"bitrix24","type":"http","url":"https://your-server.example.com/mcp"}'

{
  "servers": {
    "bitrix24": {
      "type": "http",
      "url": "https://your-server.example.com/mcp"
    }
  }
}

codex mcp add bitrix24 --url https://your-server.example.com/mcp

[mcp_servers.bitrix24]
url = "https://your-server.example.com/mcp"

gemini mcp add -s user -t http bitrix24 https://your-server.example.com/mcp

{
  "mcpServers": {
    "bitrix24": {
      "httpUrl": "https://your-server.example.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "bitrix24": {
      "serverUrl": "https://your-server.example.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "bitrix24": {
      "type": "streamableHttp",
      "url": "https://your-server.example.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "bitrix24": {
      "type": "streamable-http",
      "url": "https://your-server.example.com/mcp"
    }
  }
}

{
  "mcp": {
    "bitrix24": {
      "type": "remote",
      "url": "https://your-server.example.com/mcp"
    }
  }
}

{
  "context_servers": {
    "bitrix24": {
      "url": "https://your-server.example.com/mcp"
    }
  }
}

cp .env.example .env && npm ci && npm run build && npm start

This is third-party code. Review the repository files before installing.

What it does

The server is self-hosted (Docker Compose or Coolify) with its own Bitrix24 OAuth app and a PostgreSQL database. Each MCP client goes through its own OAuth 2.1 authorization with PKCE and dynamic registration; Bitrix24 tokens are encrypted with AES-256-GCM and refreshed in a concurrency-safe way. Read tools discover a specific portal's schema: CRM entity types including smart processes via crm.type.list, fields, pipelines, stages, users, and items through the universal crm.item.* methods. Writes are deliberately two-step: a prepare tool (create, update, stage move) returns a human-readable summary and a pending operation, which only executes after a separate confirmation call; the operation is atomic and cannot run twice under concurrent requests, and pending operations expire after ten minutes. Every write leaves an audit record with its status. Raw REST calls, deletion, schema administration, robots, business processes and event binding are deliberately not exposed in this release.

Who it is for. For teams that need per-client multi-user authorization and tight control over CRM writes with confirmation on every operation.

Example request

Prepare moving deal 4821 to the "Paid" stage and show a summary before confirming

Limitations

This is an independent project, not an official Bitrix24 product, and the author recommends testing against a non-production portal first. Requires Node.js 20.11+, PostgreSQL 14+ and your own Bitrix24 OAuth app with a public HTTPS handler URL. Version 0.3.1 accepts hosted *.bitrix24.* cloud domains and exactly one configured custom portal domain; other on-premise domains are currently rejected. Effective access is always limited by the rights of the Bitrix24 user who completed OAuth and the OAuth app's own scopes.

How to disable. Stop the deployed server (docker compose down), remove the OAuth app in the portal, and revoke the MCP_AUTH_TOKEN.

MCP

Transport

http

Authentication

OAuth

Security check

• With write_with_confirmation mode enabled, it can create and change CRM entities after confirmation
• Stores encrypted portal users' OAuth tokens in its own PostgreSQL database

README in short

The README lists what is included (a bring-your-own OAuth app, token encryption, read-only tools, SPA discovery, a schema metadata cache, confirmation-gated write operations, an audit trail, stateless Streamable HTTP with OAuth 2.1), a quick start with environment variables, setting up the Bitrix24 local app, connecting clients (Claude custom connector, Claude Code, Codex, generic static-bearer), a full configuration table, Docker and Coolify instructions, and an architecture diagram. It points to SECURITY.md before production deployment.

Related