Bitwarden Public API and Secrets Manager (unofficial)

io.github.mguttmann/the-real-bitwarden-mcp · v0.3.1

Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or cloud.

Website Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add the-real-bitwarden-mcp -e BITWARDEN_SELFHOST_API_BASE=<BITWARDEN_SELFHOST_API_BASE> -e BITWARDEN_SELFHOST_IDENTITY_URL=<BITWARDEN_SELFHOST_IDENTITY_URL> -e BITWARDEN_SELFHOST_CLIENT_ID=<BITWARDEN_SELFHOST_CLIENT_ID> -e BITWARDEN_SELFHOST_CLIENT_SECRET=<BITWARDEN_SELFHOST_CLIENT_SECRET> -e BITWARDEN_CLOUD_API_BASE=<BITWARDEN_CLOUD_API_BASE> -e BITWARDEN_CLOUD_IDENTITY_URL=<BITWARDEN_CLOUD_IDENTITY_URL> -e BITWARDEN_CLOUD_CLIENT_ID=<BITWARDEN_CLOUD_CLIENT_ID> -e BITWARDEN_CLOUD_CLIENT_SECRET=<BITWARDEN_CLOUD_CLIENT_SECRET> -e BWS_ACCESS_TOKEN=<BWS_ACCESS_TOKEN> -e BWS_ORG_ID=<BWS_ORG_ID> -e BWS_API_BASE=<BWS_API_BASE> -e BWS_IDENTITY_URL=<BWS_IDENTITY_URL> -e BITWARDEN_CONFIRM_WRITES=<BITWARDEN_CONFIRM_WRITES> -e BITWARDEN_READ_ONLY=<BITWARDEN_READ_ONLY> -e LOG_LEVEL=<LOG_LEVEL> -e BW_MCP_MAX_RESPONSE_BYTES=<BW_MCP_MAX_RESPONSE_BYTES> -- npx -y [email protected]

claude_desktop_config.json

{
  "mcpServers": {
    "the-real-bitwarden-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "BITWARDEN_SELFHOST_API_BASE": "<BITWARDEN_SELFHOST_API_BASE>",
        "BITWARDEN_SELFHOST_IDENTITY_URL": "<BITWARDEN_SELFHOST_IDENTITY_URL>",
        "BITWARDEN_SELFHOST_CLIENT_ID": "<BITWARDEN_SELFHOST_CLIENT_ID>",
        "BITWARDEN_SELFHOST_CLIENT_SECRET": "<BITWARDEN_SELFHOST_CLIENT_SECRET>",
        "BITWARDEN_CLOUD_API_BASE": "<BITWARDEN_CLOUD_API_BASE>",
        "BITWARDEN_CLOUD_IDENTITY_URL": "<BITWARDEN_CLOUD_IDENTITY_URL>",
        "BITWARDEN_CLOUD_CLIENT_ID": "<BITWARDEN_CLOUD_CLIENT_ID>",
        "BITWARDEN_CLOUD_CLIENT_SECRET": "<BITWARDEN_CLOUD_CLIENT_SECRET>",
        "BWS_ACCESS_TOKEN": "<BWS_ACCESS_TOKEN>",
        "BWS_ORG_ID": "<BWS_ORG_ID>",
        "BWS_API_BASE": "<BWS_API_BASE>",
        "BWS_IDENTITY_URL": "<BWS_IDENTITY_URL>",
        "BITWARDEN_CONFIRM_WRITES": "<BITWARDEN_CONFIRM_WRITES>",
        "BITWARDEN_READ_ONLY": "<BITWARDEN_READ_ONLY>",
        "LOG_LEVEL": "<LOG_LEVEL>",
        "BW_MCP_MAX_RESPONSE_BYTES": "<BW_MCP_MAX_RESPONSE_BYTES>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "the-real-bitwarden-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "BITWARDEN_SELFHOST_API_BASE": "<BITWARDEN_SELFHOST_API_BASE>",
        "BITWARDEN_SELFHOST_IDENTITY_URL": "<BITWARDEN_SELFHOST_IDENTITY_URL>",
        "BITWARDEN_SELFHOST_CLIENT_ID": "<BITWARDEN_SELFHOST_CLIENT_ID>",
        "BITWARDEN_SELFHOST_CLIENT_SECRET": "<BITWARDEN_SELFHOST_CLIENT_SECRET>",
        "BITWARDEN_CLOUD_API_BASE": "<BITWARDEN_CLOUD_API_BASE>",
        "BITWARDEN_CLOUD_IDENTITY_URL": "<BITWARDEN_CLOUD_IDENTITY_URL>",
        "BITWARDEN_CLOUD_CLIENT_ID": "<BITWARDEN_CLOUD_CLIENT_ID>",
        "BITWARDEN_CLOUD_CLIENT_SECRET": "<BITWARDEN_CLOUD_CLIENT_SECRET>",
        "BWS_ACCESS_TOKEN": "<BWS_ACCESS_TOKEN>",
        "BWS_ORG_ID": "<BWS_ORG_ID>",
        "BWS_API_BASE": "<BWS_API_BASE>",
        "BWS_IDENTITY_URL": "<BWS_IDENTITY_URL>",
        "BITWARDEN_CONFIRM_WRITES": "<BITWARDEN_CONFIRM_WRITES>",
        "BITWARDEN_READ_ONLY": "<BITWARDEN_READ_ONLY>",
        "LOG_LEVEL": "<LOG_LEVEL>",
        "BW_MCP_MAX_RESPONSE_BYTES": "<BW_MCP_MAX_RESPONSE_BYTES>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "the-real-bitwarden-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "BITWARDEN_SELFHOST_API_BASE": "<BITWARDEN_SELFHOST_API_BASE>",
        "BITWARDEN_SELFHOST_IDENTITY_URL": "<BITWARDEN_SELFHOST_IDENTITY_URL>",
        "BITWARDEN_SELFHOST_CLIENT_ID": "<BITWARDEN_SELFHOST_CLIENT_ID>",
        "BITWARDEN_SELFHOST_CLIENT_SECRET": "<BITWARDEN_SELFHOST_CLIENT_SECRET>",
        "BITWARDEN_CLOUD_API_BASE": "<BITWARDEN_CLOUD_API_BASE>",
        "BITWARDEN_CLOUD_IDENTITY_URL": "<BITWARDEN_CLOUD_IDENTITY_URL>",
        "BITWARDEN_CLOUD_CLIENT_ID": "<BITWARDEN_CLOUD_CLIENT_ID>",
        "BITWARDEN_CLOUD_CLIENT_SECRET": "<BITWARDEN_CLOUD_CLIENT_SECRET>",
        "BWS_ACCESS_TOKEN": "<BWS_ACCESS_TOKEN>",
        "BWS_ORG_ID": "<BWS_ORG_ID>",
        "BWS_API_BASE": "<BWS_API_BASE>",
        "BWS_IDENTITY_URL": "<BWS_IDENTITY_URL>",
        "BITWARDEN_CONFIRM_WRITES": "<BITWARDEN_CONFIRM_WRITES>",
        "BITWARDEN_READ_ONLY": "<BITWARDEN_READ_ONLY>",
        "LOG_LEVEL": "<LOG_LEVEL>",
        "BW_MCP_MAX_RESPONSE_BYTES": "<BW_MCP_MAX_RESPONSE_BYTES>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`BITWARDEN_SELFHOST_API_BASE` Optional	Self-hosted instance: API base URL, e.g. https://vault.example.com/api. Configure all four BITWARDEN_SELFHOST_* or all four BITWARDEN_CLOUD_* variables (or both); a partial set is fatal.
`BITWARDEN_SELFHOST_IDENTITY_URL` Optional	Self-hosted instance: identity URL, e.g. https://vault.example.com/identity.
`BITWARDEN_SELFHOST_CLIENT_ID` Optional	Self-hosted instance: organization Public API client id (organization.<uuid>).
`BITWARDEN_SELFHOST_CLIENT_SECRET` Optional, secret	Self-hosted instance: organization Public API client secret. It can manage members, groups, collections and policies, including creating Owners.
`BITWARDEN_CLOUD_API_BASE` Optional	Bitwarden Cloud: API base URL, e.g. https://api.bitwarden.com. Used for license and subscription tools.
`BITWARDEN_CLOUD_IDENTITY_URL` Optional	Bitwarden Cloud: identity URL, e.g. https://identity.bitwarden.com.
`BITWARDEN_CLOUD_CLIENT_ID` Optional	Bitwarden Cloud: organization Public API client id (organization.<uuid>).
`BITWARDEN_CLOUD_CLIENT_SECRET` Optional, secret	Bitwarden Cloud: organization Public API client secret.
`BWS_ACCESS_TOKEN` Optional, secret	Optional: Secrets Manager machine account access token; enables the bws_* tools. A malformed token is fatal at startup.
`BWS_ORG_ID` Optional	Optional: organization UUID for the Secrets Manager tools, used when a call passes no organizationId.
`BWS_API_BASE` Optional	Optional: Secrets Manager API base URL; defaults to BITWARDEN_SELFHOST_API_BASE.
`BWS_IDENTITY_URL` Optional	Optional: Secrets Manager identity URL; defaults to BITWARDEN_SELFHOST_IDENTITY_URL.
`BITWARDEN_CONFIRM_WRITES` Optional	true: write tools return a preview unless the call carries confirm "YES". The model sets confirm itself, so this is friction, not a security boundary.
`BITWARDEN_READ_ONLY` Optional	true: write tools stay listed but refuse to run, and bw_raw_request allows GET only.
`LOG_LEVEL` Optional	Log level of the JSON log lines on stderr.
`BW_MCP_MAX_RESPONSE_BYTES` Optional	Successful tool output above this many bytes is cut to valid JSON with a responseTruncated marker that says how to narrow or page the query.

Details

Package	`[email protected]` (NPM, stdio)
First published	27 Oct 2026
Last updated	27 Oct 2026
Registry name	`io.github.mguttmann/the-real-bitwarden-mcp`

More security servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use Bitwarden Public API and Secrets Manager (unofficial) often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/io-github-mguttmann-the-real-bitwarden-mcp/badge.svg)](https://nestdaddy.com/mcp/servers/io-github-mguttmann-the-real-bitwarden-mcp)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.