Bitwarden MCP Server

The Bitwarden MCP Server connects AI assistants to Bitwarden, a widely used password manager for individuals and businesses. MCP, the Model Context Protocol, is an open standard. Through it, an assistant such as Claude Desktop, Claude Code or Cursor calls external tools. The server comes from Bitwarden itself, is written in TypeScript and is published on GitHub as open source under the GPL-3.0. It ships as the npm package @bitwarden/mcp-server and, judging by the repository, is actively maintained; the latest release is v2026.7.0.

One thing up front: a password manager is the most sensitive place you can open to an AI assistant. Bitwarden says so very plainly in its README. The server is meant for local use only. It must not be hosted publicly, moved to the cloud or into containers, or made reachable over a network. Anyone using it should know exactly why they want to.

Two areas: the vault and organisation admin

The server covers two separate jobs. The first is vault management. For this it relies on the Bitwarden CLI, the bw command line tool. The assistant can list, fetch, create, edit, delete and restore items. It can create folders, upload attachments, move items into an organisation's collections and use generate to produce strong passwords or TOTP codes. Bitwarden Send is covered too, the service for sharing text and files securely with an expiry date.

The second area is organisation administration through the Bitwarden Public API. This is about running an organisation rather than handling passwords. The assistant lists members, invites new ones, changes roles and removes accounts. It manages groups and collections, reads and updates policies and pulls the event log, in other words the audit trail, with get_org_events. On top come tools for device approvals, the subscription and importing users and groups. According to the README, this area requires a Teams or Enterprise organisation and owner or admin rights.

What it is good for

For administrators, the second area is where the real value lies. Questions like "Who joined the organisation in the last 30 days?" or "Which members have not been confirmed yet?" get answered directly instead of clicking through the Admin Console. Onboarding becomes simpler as well: invite a member, assign a group, grant the right collection, all in one conversation. Bitwarden expanded the admin features in October 2025 specifically with this kind of AI-assisted workflow in mind.

For personal use, the server helps with housekeeping: finding duplicate items, setting up a folder structure, or generating a strong password for a new service and saving it straight away. Developers can have the assistant pull credentials for a test system from the vault. This is exactly where caution is needed, though, because the password then ends up in the model's context.

Safety: what Bitwarden recommends

The README is upfront about the risks. A connected client can read passwords and secure notes, change or delete items and reveal credentials in its replies. Configuration files hold session tokens and API keys and do not belong in a Git repository. Bitwarden advises connecting trusted clients only, monitoring logs and considering self-hosted or local language models for sensitive data.

The unlock flow is a thoughtful touch: according to the README, the unlock tool opens a native operating system password dialog. The master password therefore never passes through MCP or the language model. On headless machines you unlock the vault yourself with bw unlock --raw instead. File tools stay disabled until the BW_ALLOWED_DIRECTORIES variable names the directories they may use.

Cost

The server is free and open source. For the vault features a Bitwarden account is enough; according to the pricing page there is a plan that stays free as well as paid plans such as Premium and Families. Organisation admin through the Public API requires the Teams or Enterprise business plans. Current terms are on Bitwarden's official pricing page. Self-hosted Bitwarden servers can be connected through the BW_API_BASE_URL and BW_IDENTITY_URL variables.

Who is the Bitwarden MCP Server for?

It pays off most clearly for administrators of Bitwarden organisations who manage members, groups and policies and need to review audit logs. Here the assistant saves clicks without passwords having to be involved at all. For a personal vault it is more of a tool for experienced users who weigh the risk deliberately. If you are unsure, stick to the admin part, lock the vault with lock after each session and connect the server only to clients you genuinely trust.

Node.js 22 or later, the Bitwarden CLI (bw) and a Bitwarden account. For organisation admin, additionally a Teams or Enterprise organisation with owner or admin rights. An MCP client with stdio transport, for example Claude Desktop, Claude Code or Cursor.

With the Bitwarden MCP Server, an AI assistant accesses your Bitwarden vault and the administration of your organisation. This guide walks through the setup step by step and what to watch out for with access this sensitive.

Step 1: First: run it locally only

Bitwarden states unmistakably in the README that the server may only run locally. Do not host it publicly, do not put it in a cloud container and do not expose it over the network. It runs as a local process over stdio that your AI client starts itself.

Step 2: Prerequisites

You need Node.js 22 or later, a Bitwarden account and the Bitwarden CLI. Install the CLI with npm install -g @bitwarden/cli. For organisation admin you also need a Teams or Enterprise organisation and owner or admin rights.

npm install -g @bitwarden/cli

Step 3: Create a session token

Sign in once with bw login. Then unlock the vault with bw unlock --raw. The command prints a session token, which the server expects in the BW_SESSION variable. Sessions expire after inactivity. When that happens, create a new token or ask the assistant to call the unlock tool. It opens a password dialog from your operating system, so the master password never reaches the language model.

Step 4: Register it in Claude Code or Claude Desktop

In Claude Code the command is claude mcp add bitwarden -e BW_SESSION=<session-token> -- npx -y @bitwarden/mcp-server. In Claude Desktop, add an entry to claude_desktop_config.json with the command npx, the arguments -y and @bitwarden/mcp-server, and BW_SESSION in the env block. Other clients with stdio transport, such as Cursor, work the same way. Restart the client afterwards.

claude mcp add bitwarden -e BW_SESSION=<session-token> -- npx -y @bitwarden/mcp-server

Step 5: Connect organisation admin

For the Public API, open your organisation in the web vault, then Settings and My Organization. In the API Key section, choose View API Key. Enter the client ID and secret as BW_CLIENT_ID and BW_CLIENT_SECRET. The client ID starts with organization. For self-hosted Bitwarden, also set BW_API_BASE_URL and BW_IDENTITY_URL to your own server addresses.

Step 6: First tasks

To start, ask for the vault status or have a strong password generated. As an admin, ask for example for a list of all members who have not been confirmed yet, or for last week's events. Review every write action before you approve it, especially removing members and deleting items.

Work safely

Never put configuration files with tokens and keys into a Git repository. Lock the vault with the lock tool when you are done. File tools stay disabled until you list allowed directories in BW_ALLOWED_DIRECTORIES. Connect the server only to clients you trust. For particularly sensitive data, Bitwarden recommends local or self-hosted models.

Bitwarden CLI session token in BW_SESSION (vault) plus the organisation's client ID and client secret in BW_CLIENT_ID and BW_CLIENT_SECRET (Public API). Unlocking through the unlock tool uses a native operating system password dialog.

Vault: read, create, edit and delete items, folders, attachments and Sends, generate passwords and TOTP. Organisation: read and change members, groups, collections and policies, fetch event logs, approve devices, change the subscription.

The server runs locally. Passwords, notes, member data and logs it retrieves do enter the AI client context, however, and therefore reach the model provider. Bitwarden recommends self-hosted or local models for sensitive data.

Very high: the assistant can read credentials and reveal them in replies, delete items and remove organisation members. Session tokens and API keys sit in configuration files. Content from notes or Sends can carry prompt injection. According to Bitwarden, never host it publicly or expose it over a network.