Bitwarden Public API and Secrets Manager (unofficial)

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-10-27T18:54:50.022712Z",
      "publishedAt": "2026-10-27T18:54:50.022712Z",
      "statusChangedAt": "2026-10-27T18:54:50.022712Z"
    }
  },
  "server": {
    "name": "io.github.mguttmann/the-real-bitwarden-mcp",
    "title": "Bitwarden Public API and Secrets Manager (unofficial)",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "0.3.1",
    "packages": [
      {
        "version": "0.3.1",
        "transport": {
          "type": "stdio"
        },
        "identifier": "the-real-bitwarden-mcp",
        "runtimeHint": "npx",
        "registryType": "npm",
        "environmentVariables": [
          {
            "name": "BITWARDEN_SELFHOST_API_BASE",
            "format": "string",
            "description": "Self-hosted instance: API base URL, e.g. https://vault.example.com/api. Configure all four BITWARDEN_SELFHOST_* or all four BITWARDEN_CLOUD_* variables (or both); a partial set is fatal."
          },
          {
            "name": "BITWARDEN_SELFHOST_IDENTITY_URL",
            "format": "string",
            "description": "Self-hosted instance: identity URL, e.g. https://vault.example.com/identity."
          },
          {
            "name": "BITWARDEN_SELFHOST_CLIENT_ID",
            "format": "string",
            "description": "Self-hosted instance: organization Public API client id (organization.<uuid>)."
          },
          {
            "name": "BITWARDEN_SELFHOST_CLIENT_SECRET",
            "format": "string",
            "isSecret": true,
            "description": "Self-hosted instance: organization Public API client secret. It can manage members, groups, collections and policies, including creating Owners."
          },
          {
            "name": "BITWARDEN_CLOUD_API_BASE",
            "format": "string",
            "description": "Bitwarden Cloud: API base URL, e.g. https://api.bitwarden.com. Used for license and subscription tools."
          },
          {
            "name": "BITWARDEN_CLOUD_IDENTITY_URL",
            "format": "string",
            "description": "Bitwarden Cloud: identity URL, e.g. https://identity.bitwarden.com."
          },
          {
            "name": "BITWARDEN_CLOUD_CLIENT_ID",
            "format": "string",
            "description": "Bitwarden Cloud: organization Public API client id (organization.<uuid>)."
          },
          {
            "name": "BITWARDEN_CLOUD_CLIENT_SECRET",
            "format": "string",
            "isSecret": true,
            "description": "Bitwarden Cloud: organization Public API client secret."
          },
          {
            "name": "BWS_ACCESS_TOKEN",
            "format": "string",
            "isSecret": true,
            "description": "Optional: Secrets Manager machine account access token; enables the bws_* tools. A malformed token is fatal at startup."
          },
          {
            "name": "BWS_ORG_ID",
            "format": "string",
            "description": "Optional: organization UUID for the Secrets Manager tools, used when a call passes no organizationId."
          },
          {
            "name": "BWS_API_BASE",
            "format": "string",
            "description": "Optional: Secrets Manager API base URL; defaults to BITWARDEN_SELFHOST_API_BASE."
          },
          {
            "name": "BWS_IDENTITY_URL",
            "format": "string",
            "description": "Optional: Secrets Manager identity URL; defaults to BITWARDEN_SELFHOST_IDENTITY_URL."
          },
          {
            "name": "BITWARDEN_CONFIRM_WRITES",
            "format": "boolean",
            "default": "true",
            "description": "true: write tools return a preview unless the call carries confirm \"YES\". The model sets confirm itself, so this is friction, not a security boundary."
          },
          {
            "name": "BITWARDEN_READ_ONLY",
            "format": "boolean",
            "default": "false",
            "description": "true: write tools stay listed but refuse to run, and bw_raw_request allows GET only."
          },
          {
            "name": "LOG_LEVEL",
            "format": "string",
            "choices": [
              "debug",
              "info",
              "warn",
              "error"
            ],
            "default": "warn",
            "description": "Log level of the JSON log lines on stderr."
          },
          {
            "name": "BW_MCP_MAX_RESPONSE_BYTES",
            "format": "number",
            "default": "1048576",
            "description": "Successful tool output above this many bytes is cut to valid JSON with a responseTruncated marker that says how to narrow or page the query."
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/mguttmann/the-real-bitwarden-mcp",
      "source": "github"
    },
    "websiteUrl": "https://github.com/mguttmann/the-real-bitwarden-mcp#readme",
    "description": "Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or cloud."
  }
}