Bitwarden

Bitwarden / Vaultwarden MCP server — BYOK vault access for AI agents.

Exposes 6 tools over stdio. Secret values are never sent in plaintext through list_vault_items or get_vault_metadata — secrets are delivered only through Bitwarden Sends (E2E-encrypted one-time URLs).

Install

npx -y @aiwerk/mcp-server-vault

Configure

Auth — Personal API Key

1. Log in to your Bitwarden/Vaultwarden instance
2. Go to Account Settings → Security → Keys → API Key
3. Note the client_id and client_secret
4. Reference: https://bitwarden.com/help/personal-api-key/

Vault Setup

Before using this server, create two collections in your Vaultwarden organization:

• mcp-exposed — items you want to expose to agents (your existing secrets: API keys, passwords, etc.)
• mcp-agent-created — items written by agents via save_generated_secret

Add items to mcp-exposed via the Vaultwarden web UI.

Custom fields

Optionally add these custom fields to items in mcp-exposed for fine-grained control:

Tools

Security model

• Opt-in exposure: only items in mcp-exposed or mcp-agent-created are accessible; all other items return item_not_visible
• Read-only existing items: no update_*, delete_*, or change_* tools exist
• Secret value delivery via Send only: list_vault_items and get_vault_metadata never return passwords, TOTP seeds, or api-key values
• E2E encryption preserved: the server decrypts vault data locally (master password stays in env vars, never sent over the wire)
• Constrained agent writes: save_generated_secret and save_login_item are CREATE-only into the dedicated mcp-agent-created collection

Note: Actual {{vault:NAME}} placeholder resolution in tool call arguments happens in the AIWerk hosted bridge, not in this server. The bridge's resolution uses the same BYOC credentials. See the bridge-patch companion document for details.

License

MIT — AIWerk [email protected]

Homepage: https://aiwerkmcp.com