Bitwarden MCP Server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BW_SESSION | No | Session token from `bw unlock --raw` | |
| BW_CLIENT_ID | No | Organization API client ID | |
| BW_API_BASE_URL | No | Bitwarden API base URL | https://api.bitwarden.com |
| BW_IDENTITY_URL | No | OAuth2 identity server URL | https://identity.bitwarden.com |
| BW_CLIENT_SECRET | No | Organization API client secret | |
| BW_ALLOWED_DIRECTORIES | No | Comma-separated list of allowed file directories. Required for file-based tools. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lockC | Lock the vault |
| unlockA | Unlock the Bitwarden vault. Takes no parameters. Prompts the user for their master password through a native OS dialog; the password is never exposed to the MCP protocol or the LLM. Not supported in headless or non-interactive environments — run "bw unlock --raw" manually and set BW_SESSION in that case. |
| syncB | Sync vault data from the Bitwarden server |
| statusB | Check the status of the Bitwarden CLI |
| listC | List items from your vault or organization |
| getC | Get a specific item from your vault or organization |
| generateB | Generate a secure password or passphrase |
| create_itemB | Create a new item (login, secure note, card, or identity) in your vault |
| create_folderB | Create a new folder in your vault |
| edit_itemC | Edit an existing item (login, secure note, card, or identity) in your vault |
| edit_folderC | Edit an existing folder in your vault |
| deleteC | Delete an item from your vault |
| confirmA | Confirm an invited organization member who has accepted their invitation |
| create_org_collectionC | Create a new organization collection |
| edit_org_collectionC | Edit an existing organization collection |
| edit_item_collectionsC | Edit which collections an item belongs to |
| moveC | Move (share) a vault item to an organization (formerly the share command) |
| device_approval_listA | List all pending device approval requests for an organization |
| device_approval_approveB | Approve a pending device authorization request |
| device_approval_approve_allB | Approve all current pending device authorization requests |
| device_approval_denyB | Deny a pending device authorization request |
| device_approval_deny_allB | Deny all pending device authorization requests |
| restoreC | Restore an item from trash |
| create_text_sendB | Create a new Bitwarden Send for securely sharing text |
| create_file_sendB | Create a new Bitwarden Send for securely sharing a file |
| list_sendB | List all Bitwarden Sends |
| get_sendB | Get details of a specific Bitwarden Send |
| edit_sendB | Edit an existing Bitwarden Send |
| delete_sendC | Delete a Bitwarden Send |
| remove_send_passwordB | Remove the access password from a Bitwarden Send |
| create_attachmentB | Attach a file to an existing vault item |
| list_org_collectionsB | List all collections |
| get_org_collectionC | Retrieve a collection |
| update_org_collectionC | Update a collection |
| delete_org_collectionC | Delete a collection |
| list_org_membersB | List all members |
| get_org_memberC | Retrieve a member |
| get_org_member_groupsB | Retrieve a member's group ids |
| invite_org_memberC | Create a member |
| update_org_memberC | Update a member |
| update_org_member_groupsC | Update a member's groups |
| remove_org_memberC | Remove a member |
| reinvite_org_memberC | Re-invite a member |
| revoke_org_memberC | Revoke a member's access to an organization |
| restore_org_memberB | Restore a previously revoked member |
| list_org_groupsA | List all groups |
| get_org_groupC | Retrieve a group |
| get_org_group_membersC | Retrieve a group's member ids |
| create_org_groupC | Create a group |
| update_org_groupC | Update a group |
| delete_org_groupC | Delete a group |
| update_org_group_membersC | Update a group's members |
| list_org_policiesC | List all policies |
| get_org_policyC | Retrieve a policy |
| update_org_policyC | Update a policy |
| get_org_eventsC | List all events |
| get_org_subscriptionA | Retrieve the subscription details for the current organization |
| update_org_subscriptionB | Update the organization's current subscription for Password Manager and/or Secrets Manager |
| import_org_users_and_groupsB | Import members and groups from an external system |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 59 tools
Most tools have distinct purposes, but 'edit_org_collection' and 'update_org_collection' appear redundant, creating ambiguity. Otherwise, tools are well-separated by domain (items, folders, sends, org management).
Tools generally follow a verb_noun snake_case pattern, but there are slight inconsistencies such as 'device_approval_approve' (redundant) and 'import_org_users_and_groups' (non-standard verb). Overall pattern holds.
With 59 tools, the set is on the large side but covers the extensive functionality of Bitwarden (personal vault, sends, organization management, device approvals). The scope justifies the count, though it may be heavy for agents.
The tool set covers most CRUD operations for items, folders, sends, and organization entities. Notable gap: no 'delete_folder' tool exists. Otherwise, lifecycle support is strong, including status, sync, and import.