Bitrix24 MCP with two access tiers
bitrix24-mcp
A Bitrix24 MCP server with two separate endpoints: full admin access and a restricted staff tier gated by guard.cjs
- 0 ★ on the repository
- Last commit
Broad access
Why this level
- The admin endpoint can call any Bitrix24 method without limits
- The generic bitrix_call gives direct REST API access
- Secrets are passed in a header or URL with no rotation
A similar tool with a larger community: Bitrix24 MCP Server, 65 ★ on the repository
Install
- Works in
- Services
Manual install
npm install && node index.jsBefore running, set BITRIX_WEBHOOK_URL, BITRIX_ADMIN_WEBHOOK_URL and MCP_SHARED_SECRET in the environment.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The admin endpoint can call any Bitrix24 method without limits
- The generic bitrix_call gives direct REST API access
- Secrets are passed in a header or URL with no rotation
This is third-party code. Review the repository files before installing.
What it does
Built on Express and the official Model Context Protocol SDK, the server exposes two endpoints over one tool set. /mcp uses a personal admin webhook and calls Bitrix24 directly, while /mcp-staff goes through a separate webhook and is checked by guard.cjs, which allows or rejects a method by policy. Tools cover CRM deals (list, get, create) and a generic bitrix_call for any REST API method, and for staff the tool descriptions state what is actually allowed rather than promising unlimited access. The secret is passed via an X-MCP-Secret header or a key query parameter, since the Claude connector cannot always send arbitrary headers.
Who it is for. For a Bitrix24 portal owner who wants full MCP access for themselves and a restricted operation set for staff.
Good fit when
- You want to split agent access: full for yourself, restricted for the team
- You need a generic bitrix_call for methods without a dedicated tool
- Your agent connector cannot send custom headers, so you need query-parameter auth
Not a fit when
- You need detailed docs: the repo has no README, and behavior is visible only in the code
- You want a ready CRM tool set without deploying your own server
- You need a documented guard.cjs policy that states exactly which methods it allows
Example request
Show open deals and create a new one for contact IvanovMCP
- Transport
- http
- Authentication
- API key
Environment variables
BITRIX_WEBHOOK_URLrequired, secret- Webhook for the staff tier, used through guard.cjs
BITRIX_ADMIN_WEBHOOK_URLrequired, secret- Personal admin webhook with full rights for /mcp
MCP_SHARED_SECRETrequired, secret- Secret for authorizing the personal /mcp endpoint
MCP_STAFF_SHARED_SECRETsecret- Separate secret for the /mcp-staff endpoint
Limitations
The repository has no README; this description was written by reading index.js, guard.cjs and public/index.html. There is no license or tests, a single author, and no stars. The guard.cjs staff policy is not documented separately and should be read in the code before relying on it with real staff.
How to disable. Stop the service and remove the server block from your MCP client config.
FAQ
How does /mcp differ from /mcp-staff?
/mcp calls Bitrix24 directly with the full admin webhook, while /mcp-staff goes through guard.cjs, which checks the method against a policy before calling it.
How do I pass the secret if my connector cannot send headers?
Add it as a ?key=<secret> query parameter on the endpoint URL.
Discussion
No questions or reviews yet.
Related
All Bitrix24 toolsBitrix24 MCP by Bit2Beat
Bitrix24 MCP Server
Bitrix24 MCP server over an inbound webhook: CRM, tasks, disk, calendar, chat, business processes and config migration between portals
Bitrix24 MCP Server (qwito)
Bitrix24 MCP Server
A TypeScript MCP server with 45-plus tools for Bitrix24 CRM: contacts, deals, leads, companies, tasks and activity analytics
Bitrix24 MCP server with real calls
MCP Server for Bitrix24
A Bitrix24 MCP server with 43 tools and about 870 actions that executes real REST API calls instead of just serving documentation
Bitrix24 MCP Server (gunnit)
Bitrix24 MCP Server
A TypeScript MCP server for Bitrix24 CRM: contacts, companies, leads, deals, tasks and sales rep performance reports
Bitrix24 MCP Server (lstkhN)
Bitrix24 MCP Server
A module for on-premise Bitrix24: an agent safely reads CRM, the MySQL schema, code and business processes over SSH stdio or HTTP with a Bearer token
Bitrix24 MCP server with per-employee OAuth
bitrix-mcp-server
A company-wide Bitrix24 MCP server where every employee signs in through their own OAuth, so every agent action is attributed to the actual user
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Bitrix24 MCP with two access tiers (this card) | no | API key | 0 | |
| Bitrix24 MCP server with sales analytics | no | not required | 0 | in TypeScript, with manager analytics |
| Bitrix24 MCP server for Open WebUI | no | not required | 0 | 32 tools over HTTP, for Open WebUI |
| Bitrix24 MCP server in Go | no | not required | 0 | single binary |
README in short
There is no separate README. The index.js code shows two endpoints with different access models, with Russian comments explaining each environment variable and both ways to pass the secret. package.json describes the project as an MCP server connecting Claude to Bitrix24 via a two-way webhook.