List vault items from the mcp-exposed and mcp-agent-created collections. Returns metadata only — secret values are NEVER included. Use reveal_secret_via_send to obtain the actual value through a secure Bitwarden Send URL.

Get full metadata for a named vault item. Returns name, type, username (for login items), URIs, custom fields, scope, expiry. Password, TOTP seed, and api-key values are NEVER returned — use reveal_secret_via_send or get_totp_code instead.

Reveal a vault secret through a Bitwarden Send — an E2E-encrypted one-time URL. Creates a temporary Send with a configurable TTL and max-views limit. The secret value is encrypted client-side; only the URL fragment (never sent to server) can decrypt it. Blocked when READ_ONLY=1. Logs to DRY_RUN without creating a real Send when DRY_RUN=1.

Get the current TOTP code for a vault login item with TOTP configured. Returns the 6-digit code, the remaining seconds in the current period, and the algorithm. Use the remaining_seconds field to decide whether to use the code immediately or wait for a fresh period.

Save an agent-generated secret into the mcp-agent-created collection. CREATE-only — cannot overwrite an existing item (name collision returns an error). The secret is E2E-encrypted with the vault org key before transmission. Sets mcp-created-by, mcp-created-at, mcp-expires-at, and mcp-used-in custom fields automatically. Blocked when READ_ONLY=1. Logs to DRY_RUN without creating a real cipher when DRY_RUN=1.

Save login credentials (username, password, URL, optional TOTP seed) as a Vaultwarden login item in the mcp-agent-created collection. Use this instead of save_generated_secret when the credential is a sign-in (username + password), so it surfaces as a real login item with get_totp_code support. CREATE-only — cannot overwrite an existing item (name collision returns an error). At least one of username or password is required. All fields are E2E-encrypted with the vault org key before transmission. Sets mcp-created-by, mcp-created-at, mcp-expires-at, and mcp-used-in custom fields automatically. Blocked when READ_ONLY=1. Logs to DRY_RUN without creating a real cipher when DRY_RUN=1.

Check connectivity and configuration of the Bitwarden/Vaultwarden vault. Authenticates, syncs, and reports: auth status, API version, collection visibility, item counts, latency. Run this first after a new install or after rotating credentials.