Provides a standardized interface to a Vaultwarden (Bitwarden-compatible) server, enabling management of accounts, ciphers, folders, organizations, sends, two-factor, emergency access, events, and admin operations, plus decrypted vault access, deduplication, and password rotation.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@vaultwarden-mcp List all my login items for GitHub"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Version: 0.1.0
Documentation — Installation, deployment, and usage across the API, CLI, MCP, and A2A agent interfaces are maintained in the official documentation.
Related MCP server: Warden MCP Server
vaultwarden-mcp exposes a standardized interface to a Vaultwarden (Bitwarden-compatible)
server via the Model Context Protocol — 281 REST operations across 13 domains (accounts,
ciphers, folders, organizations, sends, two-factor, emergency access, events, admin,
identity, icons, misc, public), a decrypted-vault layer for item/folder read and edit, and
vault maintenance (deduplication, password rotation). It is built on the shared
agent-utilities framework (auth, the
action router, telemetry, governance) for fleet consistency.
Action-routed MCP tools — eight domain tools (vaultwarden_system,
vaultwarden_accounts, vaultwarden_ciphers, vaultwarden_folders,
vaultwarden_organizations, vaultwarden_sends, vaultwarden_admin,
vaultwarden_maintenance) each route to many underlying operations via an action
argument, keeping the tool surface small. Setting MCP_TOOL_MODE=verbose additionally
registers one fully-typed tool per API operation from the generated operation manifest.
Three interfaces, one package — use it as a Python API client, an MCP server
(stdio / streamable-http / sse), or a Pydantic-AI A2A agent.
Destructive operations require confirm: true. Bulk item removal is soft by
default — see Architecture for the delete-route trap.
Two crypto backends — a pure-Python native implementation, or delegation to an installed Bitwarden CLI. See Architecture.
Metadata-only knowledge-graph ingestion — a Wire-First vaultwarden_maintenance
ingest action pushes identifiers, types, dates, counts, and relationships into the
epistemic-graph Knowledge Graph as typed OWL nodes. Item names, usernames, passwords,
notes, URIs, and every key stay out of the graph.
Per-tool toggles — enable or disable each tool domain with environment switches.
Enterprise-ready — OTEL/Langfuse telemetry and optional Eunomia access governance.
uvx (no install — run on demand)uvx --from "vaultwarden-mcp[mcp]" vaultwarden-mcp # MCP server + full graph engine
uvx --from "vaultwarden-mcp[agent]" vaultwarden-agent # MCP + A2A agent runtimeEvery supported install includes
epistemic-graph[full]. The[mcp]extra adds the MCP serving stack;[agent]adds the currentagent-runtimeand telemetry.
pippython -m pip install vaultwarden-mcp # core (API client)
python -m pip install "vaultwarden-mcp[all]" # + MCP server + A2A agent + telemetryExtra | Installs | Use when |
| Connector-focused MCP server ( | You only run the MCP server (smallest install / image) |
| Agent runtime ( | You run the integrated A2A agent |
| Everything ( | Development / both surfaces |
After installation the following entry points are available on your PATH:
Command | Description |
| Launch the MCP server |
| Launch the A2A agent server |
:mcp vs :agent)One multi-stage docker/Dockerfile builds two right-sized images, selected by --target:
Local build tag | Build target | Contents | Entrypoint |
|
|
|
|
|
|
|
|
docker build --target mcp -t vaultwarden-mcp:mcp-local docker/
docker build --target agent -t vaultwarden-mcp:agent-local docker/from vaultwarden_mcp.auth import get_client, get_vault_crypto
client = get_client() # resolves provider_configs.vaultwarden from AgentConfig
print(client.server_version())
vault = get_vault_crypto() # unlocks the decrypted-vault backend on demand
for item in vault.list_items():
print(item["id"], item["type"])# Local stdio (for IDEs)
vaultwarden-mcp
# Networked streamable-http
vaultwarden-mcp --transport streamable-http --host 127.0.0.1 --port 8000Tools are action-routed — pass an action plus a JSON params_json string:
{
"tool": "vaultwarden_system",
"arguments": {
"action": "version",
"params_json": "{}"
}
}Destructive actions (bulk trash, permanent removal, disabling a user) additionally
require "confirm": true in params_json.
vaultwarden_mcp/api/api_client_base.py (VaultwardenApiBase) owns HTTP transport and
authentication: it never follows redirects, stays pinned to the configured origin, bounds
response size and time, and distinguishes three auth modes per request —
user — a bearer token from the account's personal API key
(grant_type=client_credentials), cached until shortly before expiry and renewed once
on a 401;
admin — the VW_ADMIN session cookie issued after posting the instance admin token
to /admin;
none — public endpoints (/alive, /api/version, /api/config, prelogin).
vaultwarden_mcp/api/_routes.py is a committed, data-only catalog of all 281 Vaultwarden
1.37.3 API operations (accounts 39, ciphers 58, organizations 77, two-factor 26, admin 20,
emergency access 18, sends 14, folders 7, identity 6, misc 9, icons 2, events 4, public 1),
normalized from the server's own Rocket route attributes. api/_operation_manifest.py
derives a fully-typed parameter schema per operation from that catalog, consumed when
MCP_TOOL_MODE=verbose to synthesize one MCP tool per operation instead of a generic
params_json fallback.
The soft-delete trap: PUT /api/ciphers/delete moves items to trash (recoverable for
30 days) — this is the only bulk-delete route this package's tools ever call.
POST /api/ciphers/delete and DELETE /api/ciphers are permanent in Vaultwarden and
are deliberately not wired to any bulk-delete tool action.
Decrypted vault access (vaultwarden_mcp/crypto/) is a pluggable VaultCrypto
backend, selected by selector_refs.CRYPTO_BACKEND:
native (default) — pure-Python key derivation (PBKDF2-SHA256 or Argon2id) and HKDF
stretching (crypto/keys.py), AES-256-CBC + HMAC-SHA256 EncStrings with the MAC
verified before any decryption, and RSA-OAEP unwrap of organization and per-item keys
(crypto/encstring.py). Only strict type-2 EncStrings are decrypted; anything else
passes through unchanged. Validated against Bitwarden's own published SDK test vectors.
bw_cli — delegates key handling to an installed Bitwarden CLI (bw), driving a
private, per-instance CLI data directory rather than the invoking user's real login
state, with credentials passed only through the child process environment.
Both backends produce and accept records in the Bitwarden CLI JSON shape, so
vaultwarden_mcp/vault/dedupe.py (exact or loose duplicate matching, keep-newest
selection, bulk soft-delete apply) behaves identically regardless of backend.
vaultwarden_mcp/kg_ingest.py maps vault entities to typed OWL nodes
(:VaultwardenItem subclasses, :VaultwardenFolder, :VaultwardenCollection,
:VaultwardenServer) and relationships (:vaultwardenInFolder,
:vaultwardenInOrganization, :vaultwardenInCollection) through the required
agent_utilities.knowledge_graph.memory.native_ingest (Wire-First) primitive. Only
identifiers, type codes, lifecycle dates, counts, and relationships are accepted — every
item name, username, password, note, URI, TOTP seed, custom field, attachment, folder
name, collection name, send content, and key is rejected before it ever reaches the graph
(vaultwarden_mcp/ontology/vaultwarden.ttl).
The MCP Server can be run in stdio (local), streamable-http (networked), or
sse mode.
Keep provider_configs.vaultwarden endpoint, credential, selector, and TLS
references in AgentConfig; do not place resolved values in MCP client JSON. See
Environment Variables for the shape of that profile.
Install the connector-focused
[mcp]extra. Examples usevaultwarden-mcp[mcp]to add FastMCP / FastAPI throughagent-utilities[mcp]; the required Agent Utilities core still carriesepistemic-graph[full]. The[agent-runtime]extra additionally enables model orchestration.
{
"mcpServers": {
"vaultwarden-mcp": {
"command": "uvx",
"args": [
"--from",
"vaultwarden-mcp[mcp]",
"vaultwarden-mcp"
],
"env": {
"MCP_TOOL_MODE": "intent",
"ACCOUNTSTOOL": "True",
"ADMINTOOL": "True",
"CIPHERSTOOL": "True",
"FOLDERSTOOL": "True",
"MAINTENANCETOOL": "True",
"ORGANIZATIONSTOOL": "True",
"SENDSTOOL": "True",
"SYSTEMTOOL": "True"
}
}
}
}Runtime references require an alias-aware launcher such as GraphOS. Other launchers must omit those entries and inject the resolved values through their own runtime secret boundary.
{
"mcpServers": {
"vaultwarden-mcp": {
"command": "uvx",
"args": [
"--from",
"vaultwarden-mcp[mcp]",
"vaultwarden-mcp",
"--transport",
"streamable-http",
"--port",
"8000"
],
"env": {
"TRANSPORT": "streamable-http",
"HOST": "127.0.0.1",
"PORT": "8000",
"MCP_TOOL_MODE": "intent",
"ACCOUNTSTOOL": "True",
"ADMINTOOL": "True",
"CIPHERSTOOL": "True",
"FOLDERSTOOL": "True",
"MAINTENANCETOOL": "True",
"ORGANIZATIONSTOOL": "True",
"SENDSTOOL": "True",
"SYSTEMTOOL": "True"
}
}
}
}Alternatively, connect to a pre-deployed Streamable-HTTP instance by url:
{
"mcpServers": {
"vaultwarden-mcp": {
"url": "http://localhost:8000/vaultwarden-mcp/mcp"
}
}
}Run a reviewed container image as a least-privilege stdio child (no listener or published port):
docker run -i --rm \
--read-only \
--cap-drop=ALL \
--security-opt=no-new-privileges \
--pids-limit=256 \
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
-e TRANSPORT=stdio \
-e MCP_TOOL_MODE=intent \
-e ACCOUNTSTOOL=True \
-e ADMINTOOL=True \
-e CIPHERSTOOL=True \
-e FOLDERSTOOL=True \
-e MAINTENANCETOOL=True \
-e ORGANIZATIONSTOOL=True \
-e SENDSTOOL=True \
-e SYSTEMTOOL=True \
registry.example.invalid/vaultwarden-mcp@sha256:<digest> vaultwarden-mcpFor containerized network HTTP, supply an authenticated TLS ingress (or
direct server TLS), exact MCP_ALLOWED_HOSTS, and an exact trusted-proxy
CIDR policy through the operator-owned deployment profile. The generator
does not emit an unauthenticated non-loopback listener.
Auto-generated from the code-read env surface (MCP_TOOL_MODE + package vars) — do not edit.
vaultwarden-mcp can also run as a local container (Docker / Podman / uv) or be
consumed from a remote deployment. The
Deployment guide has full,
copy-paste mcp_config.json for all four transports — stdio, streamable-http,
local container / uv, and remote URL:
Local container — launch a reviewed immutable image as a least-privilege stdio child with no listener or published port.
Remote URL — connect through an operator-supplied authenticated HTTPS ingress.
Keep the URL, outbound identity references, trust profile, and exact
MCP_ALLOWED_HOSTS in AgentConfig.
epistemic-graph)Every image embeds the epistemic-graph[full] engine. For production — or to share one knowledge graph across multiple agents — run epistemic-graph as its own database container and point the agent at it. Deployment recipes (single-node + Raft HA), connection config, and the full database architecture (with diagrams) are in the epistemic-graph deployment guide. Local engine autostart or an operator-configured remote engine is selected through AgentConfig.
Variable | Example | Description |
|
| |
|
| |
|
| options: stdio, streamable-http, sse |
|
| network listeners outside loopback require configured authentication |
|
| |
|
| |
|
| options: none, embedded, remote |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
| — | e.g. registry.example.invalid/vaultwarden-mcp@sha256: |
| — | e.g. registry.example.invalid/vaultwarden-mcp@sha256: |
Variable | Example | Description |
| — | Comma-separated tool allow-list |
| — | Comma-separated tool deny-list |
| — | Comma-separated tag allow-list |
| — | Comma-separated tag deny-list |
| — | Remote Eunomia authorization server URL |
| — | OTLP collector endpoint |
| — | Outbound MCP child auth: |
| — | OIDC client id (service-account auth) |
|
| Runtime secret reference for the OIDC service account |
| — | HTTP Basic username ( |
|
| Runtime secret reference for HTTP Basic auth ( |
|
| Verbose logging |
|
| Unbuffered stdout (recommended in containers) |
|
| URL of the MCP server the agent connects to |
| — | Operator-configured LLM provider for the agent |
| — | Operator-configured model id for the agent |
|
| Serve the AG-UI web interface |
18 package + 17 inherited variable(s). Auto-generated from .env.example + the shared agent-utilities set — do not edit.
The provider_configs.vaultwarden profile referenced above (see vaultwarden_mcp/auth.py)
carries reference-only configuration through AgentConfig:
Field | Notes |
| Toggles the profile. |
| Must resolve to an HTTPS or loopback origin. |
| Exactly one of the two — a named trust policy, e.g. |
| The account's personal API key ( |
| Only needed for decrypted vault operations ( |
| The plaintext instance admin token, only needed for |
|
|
References are env://NAME, vault://…, or secret://…, resolved only at runtime — never
a literal value.
Each tool is action-routed: pass an action and a JSON params_json payload. Tool
domains can be toggled on or off with the listed environment variable. The table below is
auto-generated from the live server by the mcp-readme-table pre-commit hook
(python -m agent_utilities.mcp.readme_tools) — do not edit it by hand.
MCP_TOOL_MODE=condensed)MCP Tool | Toggle Env Var | Description |
|
| Operate the account profile, two-factor methods, emergency access, |
|
| Administer the instance (users, config, diagnostics), plus |
|
| Read and write vault items (ciphers). |
|
| Read and write personal-vault folders. |
|
| Plan/apply vault deduplication, rotate item passwords, generate |
|
| Manage organizations, collections, members, groups, and policies, |
|
| Create, list, update, and remove Bitwarden Sends (text or file). |
|
| Read Vaultwarden server liveness, version, and public configuration. |
MCP_TOOL_MODE=verbose or both)MCP Tool | Toggle Env Var | Description |
|
| Generate/rotate the personal API key (client_credentials login secret) |
|
| Get KDF type/iterations for an email before login (also mounted at /identity/accounts/prelogin) |
|
| Rotate the personal API key |
|
| Enable TOTP 2FA by confirming a generated code |
|
| Enable TOTP 2FA (PUT alias) |
|
| Enable/update Duo (or Duo OIDC) 2FA |
|
| Enable/update Duo 2FA (PUT alias) |
|
| Register a new WebAuthn security key for 2FA |
|
| Register a WebAuthn key (PUT alias) |
|
| Enable YubiKey OTP 2FA |
|
| Enable YubiKey OTP 2FA (PUT alias) |
|
| Permanently delete an organization and all its data |
|
| Liveness/health check (also verifies DB connectivity) |
|
| Grantor approves an in-progress request early (skips wait) |
|
| Archive one cipher (hide from default view, distinct from trash) |
|
| Bulk archive ciphers |
|
| Trigger an on-demand database backup (sqlite only) |
|
| Bulk confirm accepted invites, delivering the org key to each new member |
|
| Bulk delete groups |
|
| Bulk remove members from the org |
|
| Bulk delete collections by id |
|
| Bulk-fetch public keys for a list of user ids |
|
| Bulk resend pending invites |
|
| Bulk restore revoked members |
|
| Bulk revoke members |
|
| Return server config/feature-flags/environment URLs used by clients on startup |
|
| Grantor confirms the grantee, delivering the grantor’s vault key encrypted for the grantee |
|
| Confirm one accepted invite |
|
| Create a new organization |
|
| Force-logout a user (invalidate all sessions/security stamp) |
|
| Delete own account (REST DELETE alias) |
|
| Delete an attachment |
|
| Delete an attachment (admin path) |
|
| Delete an attachment (POST alias) |
|
| Delete an attachment (admin path, POST alias) |
|
| Permanently delete a cipher (REST DELETE) |
|
| Permanently delete via admin path (REST DELETE) |
|
| Permanently delete a cipher (POST alias) |
|
| Permanently delete a cipher via admin path |
|
| Soft-delete (move to trash) a cipher |
|
| Soft-delete via admin path |
|
| Bulk permanently delete ciphers by id list |
|
| Bulk permanent delete via admin path |
|
| Bulk permanent delete (POST alias) |
|
| Bulk permanent delete via admin path (POST alias) |
|
| Bulk soft-delete (move to trash) |
|
| Bulk soft-delete via admin path |
|
| Reset configuration overrides back to defaults |
|
| Delete/revoke an emergency-access relationship |
|
| Delete a folder |
|
| Delete a folder (POST alias) |
|
| Delete a group |
|
| Remove one member from the org |
|
| Delete a collection |
|
| Delete a Send |
|
| Unlink a user’s SSO identity (force back to password login) |
|
| Permanently delete an instance user account |
|
| Remove a registered WebAuthn security key |
|
| Disable TOTP 2FA |
|
| Disable a specific 2FA provider |
|
| Disable a specific 2FA provider (PUT alias) |
|
| Disable (lock) a user account instance-wide |
|
| Anonymous: download the actual (still-encrypted) Send file bytes |
|
| Edit a member (POST alias) |
|
| Confirm email-2FA setup with the emailed code |
|
| Grantee accepts a pending emergency-access invite |
|
| Grantor invites another user (by email) as emergency contact |
|
| Re-enable a disabled user account |
|
| Generate a new TOTP secret + provisioning QR data |
|
| Generate a WebAuthn registration challenge |
|
| Get current YubiKey OTP 2FA configuration (masked) |
|
| List current user devices |
|
| Stub empty passkey list (prevents client errors; Vaultwarden does not support WebAuthn passwordless login) |
|
| Get attachment metadata + a short-lived download URL |
|
| Poll status of one auth request by id |
|
| Anonymous poll for approval + encrypted key once approved |
|
| List all pending/approved auth requests for current user |
|
| List only pending auth requests |
|
| Check whether org auto-enrolls new members into password-reset admin recovery |
|
| Get org billing metadata |
|
| Get org billing warning banners |
|
| Get one cipher by id |
|
| Get one cipher with admin-view fields (org admin bypassing normal access) |
|
| Get one cipher with full details incl. collection ids |
|
| List audit-log events for one cipher |
|
| List all ciphers owned by or shared with the user |
|
| List users/groups with access to one collection |
|
| List people the caller has granted emergency access to (as grantor) |
|
| Get one device by identifier |
|
| Get/return device-verification (new-device email) settings |
|
| Get sanitized server config as JSON for diagnostics |
|
| Diagnostic HTTP echo/status-code test endpoint |
|
| Return an empty master-password-policy stub for a placeholder org id |
|
| Get current Duo 2FA configuration (masked) |
|
| Check whether email 2FA is set up / request setup email |
|
| Get one emergency-access record by id |
|
| Get one folder by id |
|
| List all folders |
|
| List people who have granted the caller emergency access (as grantee) |
|
| Get one group |
|
| Get one group with members + collections |
|
| List members of a group |
|
| List org groups (collections of members for access assignment) |
|
| List groups with member/collection details |
|
| Check whether a device identifier is already known for an email |
|
| Get the effective master-password-complexity policy for the org |
|
| List organization members ("users") |
|
| Get one collection’s details |
|
| List all collections in an org |
|
| List collections with per-collection access details |
|
| Get org-scoped cipher listing with per-cipher collection membership |
|
| Check whether an org’s SSO domain claim is verified |
|
| List audit-log events for an organization |
|
| Export all org cipher data (admin-triggered org vault export) |
|
| List members with minimal fields (id/name/email) for UI pickers |
|
| Get organization details |
|
| Get the org’s public key + (if authorized) encrypted private key |
|
| Get the org’s public RSA key |
|
| List available subscription plans |
|
| Get one policy by type |
|
| Get another user public RSA key by user id |
|
| Get the 2FA recovery code (used if all 2FA devices are lost) |
|
| Get the data needed to perform admin password reset for a member (their reset_password_key + KDF settings) |
|
| Get self-host billing metadata |
|
| Get one of the caller’s own Sends by id |
|
| List the caller’s own Sends |
|
| Get the user’s configured equivalent-domains list (for autofill matching) |
|
| List pending security tasks (at-risk password / admin-assigned tasks) for the current device |
|
| List enabled 2FA methods for the user |
|
| Get one member’s full details |
|
| Look up one instance user by email |
|
| List collections the current user has access to (across all orgs) |
|
| List audit-log events for one org member |
|
| Get one instance user by id |
|
| List all instance users (JSON, for the admin table) |
|
| List registered WebAuthn/FIDO2 2FA security keys |
|
| Proxy a Have I Been Pwned breach lookup for a username |
|
| Fetch/cache a site favicon by hostname from the internet |
|
| Serve a favicon from local cache without external fetch (used when icon fetching is disabled) |
|
| Get a user’s KDF type/iterations/memory/parallelism by email before attempting login |
|
| Register a new account (email, name, master-password hash, encrypted keys, KDF params) |
|
| Grantee starts the takeover/view waiting period |
|
| Create/invite a new instance user from the admin panel |
|
| Bulk-provision/deprovision org members + groups from an external directory (SCIM/LDAP-style) |
|
| Current user leaves an organization |
|
| List all policies configured for the org |
|
| List policies visible to an not-yet-member using their invite token |
|
| Bulk move ciphers into a folder (or remove from folder) |
|
| Bulk move ciphers into a folder (PUT alias) |
|
| Return current server time |
|
| Invited user accepts the org invite |
|
| Delete an organization |
|
| Generate/rotate the org’s API key (for client_credentials / public API access) |
|
| Rotate the org’s API key |
|
| Invite a user to the organization by email |
|
| Grantee completes takeover: uploads the grantor’s user key re-encrypted under a NEW master key/password chosen by the grantee |
|
| Request password hint be emailed |
|
| Get org policies applicable to the emergency-access relationship |
|
| Anonymous: fetch a Send’s metadata by access id (for viewing/decrypting) |
|
| Anonymous: get a download URL for a Send file |
|
| Anonymous: legacy get-download-URL path |
|
| Anonymous: legacy path for fetching a Send by access id |
|
| Upload attachment (legacy single-phase) |
|
| Upload attachment via admin path |
|
| Re-key an attachment when its cipher is shared to an org |
|
| Begin attachment upload (v2): register metadata, get upload URL |
|
| Upload the encrypted attachment bytes (v2 second phase) |
|
| Create a new device "login with device" auth request |
|
| Bulk-set which users/groups can access a set of collections |
|
| Bulk-assign a set of ciphers to collections |
|
| Update a cipher |
|
| Update a cipher via the admin path (POST alias) |
|
| Partial update: only folder assignment / favorite flag (no re-encryption needed) |
|
| Move a personal cipher into an organization ("share") |
|
| Create a cipher (personal or org, no collections in this call) |
|
| Create a cipher as an org admin on behalf of the org (unassigned/admin path) |
|
| Create a cipher, optionally assigning collections in the same call |
|
| Bulk import ciphers + folders in one call |
|
| Clear a device push token (POST alias) |
|
| Set collections (v2, POST alias) |
|
| Set collections via admin path (POST alias) |
|
| Set collections (legacy v1, POST alias) |
|
| Persist configuration overrides (the settings normally set via env vars) |
|
| Delete own account (password/OTP confirmation in body) |
|
| Delete/revoke (POST alias) |
|
| Delete a group (POST alias) |
|
| Remove one member from a group |
|
| Delete an organization (POST alias) |
|
| Request account-deletion email (forgot-password-style deletion init) |
|
| Complete account deletion using emailed token |
|
| Set/update device push token |
|
| Confirm email change with token + new encrypted keys |
|
| Request email-change verification token (send code to new address) |
|
| Update an emergency-access grant (POST alias) |
|
| Client-side telemetry/event ingestion endpoint used by web-vault to batch-report UI events |
|
| Rename a folder (POST alias) |
|
| Create a folder |
|
| Update a group (POST alias, id in path) |
|
| Create a group |
|
| Change KDF algorithm/parameters (PBKDF2↔Argon2id, iterations, memory, parallelism) |
|
| Upload/set the user RSA keypair (encrypted private key + public key) |
|
| Bulk import ciphers directly into an organization (personal-vault-style import scoped to an org) |
|
| Upload the organization’s RSA keypair at org-creation time |
|
| Update organization settings (POST alias) |
|
| Delete a collection (POST alias) |
|
| Update a collection (POST alias) |
|
| Create a collection |
|
| Change master password |
|
| Update profile fields (legacy POST alias of PUT) |
|
| Full account key rotation: re-encrypt user key, private key, and every cipher/folder/send key |
|
| Create a text-type (or metadata-only) Send |
|
| Create a file-type Send (legacy single-phase upload) |
|
| Begin a file-type Send (v2): register metadata, get upload URL |
|
| Upload the encrypted Send file bytes (v2 second phase) |
|
| Set initial master password (post-SSO/key-connector account provisioning) |
|
| Set equivalent-domains list |
|
| Rotate security stamp (invalidates all other sessions/JWTs) |
|
| Request email verification (resend verify link) for current email |
|
| Verify current email address ownership via emailed token |
|
| Variant prelogin returning the newer MasterPasswordUnlockData shape |
|
| Pre-validate an SSO organization identifier before redirecting to the IdP |
|
| Get own user profile (email, name, org memberships, premium status) |
|
| Irreversibly delete ALL ciphers in an organization |
|
| Irreversibly delete ALL of the caller’s personal ciphers (and folders) |
|
| Approve/deny an auth request from an already-approved device |
|
| Set avatar color |
|
| Update a cipher (PUT alias) |
|
| Update a cipher via the admin path |
|
| Partial update (PUT alias) |
|
| Share a cipher (PUT alias) |
|
| Bulk share multiple ciphers to an org |
|
| Clear a device push token (public, used by push relay callbacks) |
|
| Set the collections a cipher belongs to (v2, returns updated cipher) |
|
| Set collections via admin path |
|
| Set the collections a cipher belongs to (legacy v1) |
|
| Set/update device push token (PUT alias) |
|
| Update wait-time/type of an emergency-access grant |
|
| Rename a folder |
|
| Update a group |
|
| Set which members belong to a group |
|
| Edit a member (role, collection access, groups) |
|
| Update organization settings (name, billing email, etc.) |
|
| Update a collection (rename, reassign users/groups) |
|
| Update one policy by type |
|
| Update one policy by type (newer response shape) |
|
| Update profile fields (name, avatar color) |
|
| Admin completes account-recovery: submits a brand-new master key for a member using the org-held reset_password_key |
|
| Remove the password requirement from a Send |
|
| Alias/step of admin-initiated password reset |
|
| Member opts in/out of admin password-reset recovery |
|
| Update a Send (name/notes/text/expiry/password/max access count) |
|
| Set equivalent-domains list (PUT alias) |
|
| Finish registration after email verification (submits the same keyset payload as identity_register) |
|
| Send the registration email-verification code |
|
| Resend one pending invite |
|
| Grantor rejects/cancels an in-progress request |
|
| Strip all 2FA methods from a user (admin recovery action) |
|
| Request an OTP (emailed) to re-verify identity before a sensitive action |
|
| Grantor resends a pending emergency-access invite |
|
| Resend a pending registration invite email |
|
| Restore one cipher from trash |
|
| Restore one cipher from trash via admin path |
|
| Bulk restore from trash |
|
| Bulk restore from trash via admin path |
|
| Restore a revoked member |
|
| Restore a revoked member (newer response shape) |
|
| Get last vault revision timestamp (used by clients to decide whether to sync) |
|
| Revoke one member’s access without removing them (keeps external_id/history) |
|
| Send/resend the email-2FA setup verification code |
|
| Send the 2FA email code during login (pre-auth, device-scoped) |
|
| Full vault sync: ciphers, folders, collections, sends, org/policy/domain metadata in one payload |
|
| Grantee begins password takeover: server returns grantor’s KDF settings + encrypted key |
|
| Send a test email to verify SMTP configuration |
|
| Unarchive one cipher |
|
| Bulk unarchive ciphers |
|
| Change a user’s org role from the admin panel |
|
| Force a client-sync revision bump for one/many users |
|
| Verify the OTP from request_otp |
|
| Verify current master password hash (used before sensitive UI actions) |
|
| Return server version string |
|
| Grantee views the grantor’s vault (read-only) after approval/wait elapses |
8 action-routed tool(s) · 281 verbose 1:1 tool(s). Each is enabled unless its <DOMAIN>TOOL toggle is set false; MCP_TOOL_MODE selects the surface (intent default — the six verb-tools, granular set loaded on demand · condensed action-routed · verbose 1:1 · both). Auto-generated — do not edit.
The tool domains this package registers (final names, once every domain module lands):
vaultwarden_system, vaultwarden_accounts, vaultwarden_ciphers, vaultwarden_folders,
vaultwarden_organizations, vaultwarden_sends, vaultwarden_admin, and
vaultwarden_maintenance. Destructive operations require "confirm": true.
Full documentation is published to the GitHub Pages site and mirrored under docs/:
See AGENTS.md for domain-specific traps (the soft-vs-hard delete routes, the upper-case
credential alias rule, and the KG metadata-only boundary).
Contributions are welcome! Please ensure code quality by executing local checks before submitting pull requests:
Format code using ruff format .
Lint code using ruff check .
Validate type-safety with mypy .
Execute test suites using pytest
agent-utilities-deploymentProvision this package with the consolidated agent-utilities-deployment
workflow. It selects an installed-package, editable-source, or immutable-container
path; records only runtime secret and TLS-profile references in AgentConfig; and
runs doctor, registration, policy, observability, and rollback gates. Ask your agent
to "deploy vaultwarden-mcp with agent-utilities-deployment".
Install mode | Command |
Installed package |
|
Editable source |
|
Immutable container | deploy |
The repository embeds no deployment profile, credential value, certificate path, or
environment-specific endpoint. Supply those at runtime through AgentConfig and the
configured secret provider.
This package ships a compact canonical skill surface with specialist procedures
kept as referenced workflows. The current MCP tools, skill metadata,
connector_manifest.yml, ontology, mappings, shapes, fixtures, migrations,
tool-schema fingerprints, and certification metadata form one versioned
capability contract. Validate them together; do not rely on stale tool names or
historical per-task skill wrappers.
Runtime endpoints, credentials, certificate trust, tenant identity, retention, and observability policy are deployment inputs and are never packaged values. See Configuration, trust, and privacy before enabling a network transport, connector ingestion, GraphOS delegation, or trace export.
This server cannot be deployed
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Agent-native notes, tasks, dev-docs, vaults, sync & handoffs. MCP + OpenAPI dual surface.
Give your AI hands. Identity, credential vault, and API gateway for autonomous agents.
Shared long-term memory vault for AI agents with 20 MCP tools.
