Bitwarden Public API and Secrets Manager (unofficial)

claude mcp add bitwarden-public-api-and-secrets-manager -e 'BITWARDEN_SELFHOST_API_BASE=<BITWARDEN_SELFHOST_API_BASE>' -e 'BITWARDEN_SELFHOST_IDENTITY_URL=<BITWARDEN_SELFHOST_IDENTITY_URL>' -e 'BITWARDEN_SELFHOST_CLIENT_ID=<BITWARDEN_SELFHOST_CLIENT_ID>' -e 'BITWARDEN_SELFHOST_CLIENT_SECRET=<your bitwarden_selfhost_client_secret>' -e 'BITWARDEN_CLOUD_API_BASE=<BITWARDEN_CLOUD_API_BASE>' -e 'BITWARDEN_CLOUD_IDENTITY_URL=<BITWARDEN_CLOUD_IDENTITY_URL>' -e 'BITWARDEN_CLOUD_CLIENT_ID=<BITWARDEN_CLOUD_CLIENT_ID>' -e 'BITWARDEN_CLOUD_CLIENT_SECRET=<your bitwarden_cloud_client_secret>' -e 'BWS_ACCESS_TOKEN=<your bws_access_token>' -e 'BWS_ORG_ID=<BWS_ORG_ID>' -e 'BWS_API_BASE=<BWS_API_BASE>' -e 'BWS_IDENTITY_URL=<BWS_IDENTITY_URL>' -e 'BITWARDEN_CONFIRM_WRITES=true' -e 'BITWARDEN_READ_ONLY=false' -e 'LOG_LEVEL=warn' -- npx -y the-real-bitwarden-mcp@0.2.0

{
    "mcpServers": {
        "bitwarden-public-api-and-secrets-manager": {
            "command": "npx",
            "args": [
                "-y",
                "the-real-bitwarden-mcp@0.2.0"
            ],
            "env": {
                "BITWARDEN_SELFHOST_API_BASE": "<BITWARDEN_SELFHOST_API_BASE>",
                "BITWARDEN_SELFHOST_IDENTITY_URL": "<BITWARDEN_SELFHOST_IDENTITY_URL>",
                "BITWARDEN_SELFHOST_CLIENT_ID": "<BITWARDEN_SELFHOST_CLIENT_ID>",
                "BITWARDEN_SELFHOST_CLIENT_SECRET": "<your bitwarden_selfhost_client_secret>",
                "BITWARDEN_CLOUD_API_BASE": "<BITWARDEN_CLOUD_API_BASE>",
                "BITWARDEN_CLOUD_IDENTITY_URL": "<BITWARDEN_CLOUD_IDENTITY_URL>",
                "BITWARDEN_CLOUD_CLIENT_ID": "<BITWARDEN_CLOUD_CLIENT_ID>",
                "BITWARDEN_CLOUD_CLIENT_SECRET": "<your bitwarden_cloud_client_secret>",
                "BWS_ACCESS_TOKEN": "<your bws_access_token>",
                "BWS_ORG_ID": "<BWS_ORG_ID>",
                "BWS_API_BASE": "<BWS_API_BASE>",
                "BWS_IDENTITY_URL": "<BWS_IDENTITY_URL>",
                "BITWARDEN_CONFIRM_WRITES": "true",
                "BITWARDEN_READ_ONLY": "false",
                "LOG_LEVEL": "warn"
            }
        }
    }
}

Environment variables

• BITWARDEN_SELFHOST_API_BASE Self-hosted instance: API base URL, e.g. https://vault.example.com/api. Configure all four BITWARDEN_SELFHOST_* or all four BITWARDEN_CLOUD_* variables (or both); a partial set is fatal.
• BITWARDEN_SELFHOST_IDENTITY_URL Self-hosted instance: identity URL, e.g. https://vault.example.com/identity.
• BITWARDEN_SELFHOST_CLIENT_ID Self-hosted instance: organization Public API client id (organization.<uuid>).
• BITWARDEN_SELFHOST_CLIENT_SECRET secret Self-hosted instance: organization Public API client secret. It can manage members, groups, collections and policies, including creating Owners.
• BITWARDEN_CLOUD_API_BASE Bitwarden Cloud: API base URL, e.g. https://api.bitwarden.com. Used for license and subscription tools.
• BITWARDEN_CLOUD_IDENTITY_URL Bitwarden Cloud: identity URL, e.g. https://identity.bitwarden.com.
• BITWARDEN_CLOUD_CLIENT_ID Bitwarden Cloud: organization Public API client id (organization.<uuid>).
• BITWARDEN_CLOUD_CLIENT_SECRET secret Bitwarden Cloud: organization Public API client secret.
• BWS_ACCESS_TOKEN secret Optional: Secrets Manager machine account access token; enables the bws_* tools. A malformed token is fatal at startup.
• BWS_ORG_ID Optional: organization UUID for the Secrets Manager tools, used when a call passes no organizationId.
• BWS_API_BASE Optional: Secrets Manager API base URL; defaults to BITWARDEN_SELFHOST_API_BASE.
• BWS_IDENTITY_URL Optional: Secrets Manager identity URL; defaults to BITWARDEN_SELFHOST_IDENTITY_URL.
• BITWARDEN_CONFIRM_WRITES true: write tools return a preview unless the call carries confirm "YES". The model sets confirm itself, so this is friction, not a security boundary.
• BITWARDEN_READ_ONLY true: write tools stay listed but refuse to run, and bw_raw_request allows GET only.
• LOG_LEVEL Log level of the JSON log lines on stderr.