Securely access a Bitwarden/Vaultwarden vault through 6 MCP tools, exposing only metadata and delivering secrets via E2E-encrypted Bitwarden Sends.
List vault items from mcp-exposed and mcp-agent-created collections, with optional name/collection filters — metadata only, never secret values or note contents.
Get full metadata for a named item (username, URIs, custom fields, scope, expiry, has_notes) — no passwords, TOTP seeds, api-key values, or notes.
Reveal a secret via a Bitwarden Send one-time URL with configurable TTL and max-views, choosing fields like value, username, password, totp, notes, or uri.
Retrieve the current TOTP code for a login item, including remaining seconds and algorithm.
Save an agent-generated secret (password or api-key) into mcp-agent-created as a secure note — CREATE-only, no overwrite.
Save a login item (username + password + optional URL + optional TOTP seed) into mcp-agent-created as a real login — CREATE-only.
Run a health check for auth status, API version, collection visibility, item counts, and latency.
Security constraints: no update/delete tools; writes blocked when READ_ONLY=1; DRY_RUN=1 logs without executing; secrets are E2E-encrypted locally.
Provides tools for interacting with a Bitwarden vault, including listing items, retrieving metadata, revealing secrets via Bitwarden Sends, getting TOTP codes, and saving generated secrets or login items.
Provides tools for interacting with a Vaultwarden vault, including listing items, retrieving metadata, revealing secrets via Bitwarden Sends, getting TOTP codes, and saving generated secrets or login items.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@aiwerk/mcp-server-vault list vault items"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Bitwarden / Vaultwarden MCP server — BYOK vault access for AI agents.
Security: do not use 0.2.2 or earlier. Those versions returned item notes through list_vault_items (first 80 characters) and get_vault_metadata (full notes) for secure notes and login items. On a secure note the notes are the secret itself. Fixed in 0.2.3, which returns only has_notes. If you ran either tool on an older version, treat the secrets kept in notes as exposed to your agent's context and its model provider.
0.2.3 is on npm (published with provenance) and is the latest tag, so a plain npx -y @aiwerk/mcp-server-vault gets the fixed version. Only an explicit @0.2.2 pin still gets the vulnerable one.
Exposes 6 tools over stdio. Secret values and note contents are never sent in plaintext through list_vault_items or get_vault_metadata. Secrets are delivered only through Bitwarden Sends (E2E-encrypted one-time URLs).
npx -y @aiwerk/mcp-server-vaultRelated MCP server: VaultBridge
Variable | Required | Default | Description |
| ✅ | — | Base URL of your Bitwarden/Vaultwarden instance (no trailing slash), e.g. |
| ✅ | — | Personal API key |
| ✅ | — | Personal API key |
| ✅ | — | Vault master password (used for E2E decryption key derivation) |
| — |
| Name of the collection visible to agents |
| — |
| Name of the collection for agent-created secrets |
| — |
| HTTP timeout in milliseconds |
| — |
| Set |
| — |
| Set |
Log in to your Bitwarden/Vaultwarden instance
Go to Account Settings → Security → Keys → API Key
Note the client_id and client_secret
Reference: https://bitwarden.com/help/personal-api-key/
Before using this server, create two collections in your Vaultwarden organization:
mcp-exposed — items you want to expose to agents (your existing secrets: API keys, passwords, etc.)
mcp-agent-created — items written by agents via save_generated_secret
Add items to mcp-exposed via the Vaultwarden web UI.
Optionally add these custom fields to items in mcp-exposed for fine-grained control:
Field | Type | Purpose |
| text | Comma-separated glob list of tool/server names allowed to use this item (e.g. |
| text |
|
| text |
|
Tool | Description |
| List items from |
| Get full metadata for a named item (name, type, username, URIs, custom fields, expiry). No password/secret. |
| Reveal a secret via a Bitwarden Send (E2E-encrypted one-time URL with configurable TTL and max-views). |
| Get the current TOTP code for a login item, including remaining seconds in the period. |
| Save an agent-generated secret (password / api-key) into |
| Save sign-in credentials (username + password + optional URL + TOTP seed) into |
| Check connectivity: auth status, API version, collection visibility, item counts, latency. |
Opt-in exposure: only items in mcp-exposed or mcp-agent-created are accessible; all other items return item_not_visible
Read-only existing items: no update_*, delete_*, or change_* tools exist
Secret value delivery via Send only: list_vault_items and get_vault_metadata never return passwords, TOTP seeds, or api-key values
E2E encryption preserved: the server decrypts vault data locally (master password stays in env vars, never sent over the wire)
Constrained agent writes: save_generated_secret and save_login_item are CREATE-only into the dedicated mcp-agent-created collection
Note: Actual
{{vault:NAME}}placeholder resolution in tool call arguments happens in the AIWerk hosted bridge, not in this server. The bridge's resolution uses the same BYOC credentials. See the bridge-patch companion document for details.
MIT — AIWerk kontakt@aiwerk.ch
Homepage: https://aiwerkmcp.com
Get the current TOTP code for a vault login item with TOTP configured. Returns the 6-digit code, the remaining seconds in the current period, and the algorithm. Use the remaining_seconds field to decide whether to use the code immediately or wait for a fresh period.
Inputs: name (required).
Get full metadata for a named vault item. Returns name, type, username (for login items), URIs, custom fields, scope, expiry, and whether the item has notes. Password, TOTP seed, api-key values and note contents are NEVER returned. Use reveal_secret_via_send (field "notes" for the notes) or get_totp_code instead.
Inputs: name (required).
Check connectivity and configuration of the Bitwarden/Vaultwarden vault. Authenticates, syncs, and reports: auth status, API version, collection visibility, item counts, latency. Run this first after a new install or after rotating credentials.
Inputs: no named parameters.
List vault items from the mcp-exposed and mcp-agent-created collections. Returns metadata only. Secret values and note contents are NEVER included (has_notes says whether notes exist). Use reveal_secret_via_send to obtain the actual value through a secure Bitwarden Send URL.
Inputs: filter, collection.
Reveal a vault secret through a Bitwarden Send, an E2E-encrypted one-time URL. Creates a temporary Send with a configurable TTL and max-views limit. The secret value is encrypted client-side; only the URL fragment (never sent to server) can decrypt it. Blocked when READ_ONLY=1. Logs to DRY_RUN without creating a real Send when DRY_RUN=1.
Inputs: name (required), field, max_views, ttl_seconds.
Save an agent-generated secret into the mcp-agent-created collection. CREATE-only: cannot overwrite an existing item (name collision returns an error). The secret is E2E-encrypted with the vault org key before transmission. Sets mcp-created-by, mcp-created-at, mcp-expires-at, and mcp-used-in custom fields automatically. Blocked when READ_ONLY=1. Logs to DRY_RUN without creating a real cipher when DRY_RUN=1.
Inputs: name (required), type (required), value (required), notes, +2 more.
Save login credentials (username, password, URL, optional TOTP seed) as a Vaultwarden login item in the mcp-agent-created collection. Use this instead of save_generated_secret when the credential is a sign-in (username + password), so it surfaces as a real login item with get_totp_code support. CREATE-only: cannot overwrite an existing item (name collision returns an error). At least one of username or password is required. All fields are E2E-encrypted with the vault org key before transmission. Sets mcp-created-by, mcp-created-at, mcp-expires-at, and mcp-used-in custom fields automatically. Blocked when READ_ONLY=1. Logs to DRY_RUN without creating a real cipher when DRY_RUN=1.
Inputs: name (required), uri, totp, notes, +4 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 7 tools
Each tool has a largely distinct purpose, and descriptions explicitly cross-reference alternatives (e.g. save_login_item vs save_generated_secret, reveal_secret_via_send vs get_totp_code). The main overlap is list_vault_items vs get_vault_metadata, which both return metadata, though the descriptions clarify listing vs single-item detail.
Most tools follow a clear verb_noun pattern (list_vault_items, get_vault_metadata, reveal_secret_via_send, save_generated_secret, save_login_item, get_totp_code). health_check is the only noun-style outlier, but it is a widely conventional name, so consistency is mostly maintained.
Seven tools is well-scoped for a vault integration, covering listing, reading, revealing, writing, TOTP, and health. No tool appears redundant or filler.
Read and create operations are well covered (list, metadata, reveal, save secret, save login, TOTP, health), but the lifecycle is incomplete: there is no update, delete, or revoke operation for items or Sends. Agents cannot modify or clean up existing vault entries, which is a notable gap for a credential store.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
