MCP Vaultwarden Server

You can manage Vaultwarden secrets programmatically with an MCP server that wraps the official Bitwarden CLI. It auto-handles unlocking, keeps sessions cached, and exposes simple MCP tools to read, create, update, and delete secrets, making it ideal for agents and automation scripts.

How to use

Connect to Vaultwarden through an MCP client and call the available tools to fetch, list, or modify secrets. The server handles automatic unlocking on first use, prevents concurrent unlocks with a built-in lock, and keeps a local cache of your session so subsequent requests stay responsive. Use the provided tools to integrate secrets management into your automation pipelines without writing interactive login logic.

How to install

Prerequisites: you need Node.js and npm installed on the machine that will run the MCP server. You also need the Bitwarden CLI (bw) installed and accessible in your PATH.

{
  "mcpServers": {
    "vaultwarden": {
      "command": "npx",
      "args": [
        "mcp-vaultwarden-server"
      ],
      "env": {
        "BITWARDEN_HOST": "https://votre-instance.vaultwarden.com",
        "BW_CLIENTID": "user.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "BW_CLIENTSECRET": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "BW_MASTER_PASSWORD": "votre-mot-de-passe-maitre"
      }
    }
  }
}
```"},{

How to install (alternative from source)

If you prefer to work from source, you can clone the project, install dependencies, configure environment variables, and run the server.

# Clone the repository
git clone https://github.com/fkom13/mcp-vaultwarden.git
cd mcp-vaultwarden

# Install dependencies
npm install

# Configure and run the server
cp .env.example .env
nano .env
node server.js
```"}]} ,{

Configuration & security

Configure the server with environment variables. The server relies on the official bw CLI for cryptographic operations and requires proper handling of your master password.

Environment variables shown: BITWARDEN_HOST, BW_CLIENTID, BW_CLIENTSECRET, BW_MASTER_PASSWORD. Do not commit secret values to any repository. Use a secrets manager or orchestration secrets (e.g., Kubernetes Secrets or Docker Secrets) for production deployments.

Tools reference

The MCP exposes a set of tools to manage Vaultwarden secrets. Use these through your MCP client by calling the tool name and providing the required arguments.

• get_secret: Retrieve a secret by name or ID.

• list_secrets: Search for secrets by a term.

• get_secret_template: Obtain a JSON template for creating a new secret.

• create_secret: Create a new secret using a template with item_json.

• update_secret: Update an existing secret by its ID with new item_json.

• delete_secret: Remove a secret by its ID.

• sync: Force a synchronization between the local vault and the remote Vaultwarden server.

Available tools

get_secret

Retrieve a secret by name or ID. Returns the secret metadata and value as stored in Vaultwarden.

list_secrets

Search and list secrets that match a given term or filter.

get_secret_template

Provide a JSON template suitable for creating a new secret of a given type (login, note, card, identity).

create_secret

Create a new secret using a provided JSON payload that matches Vaultwarden item structure.

update_secret

Update an existing secret identified by its ID with new data.

delete_secret

Delete a secret by its ID from Vaultwarden.

sync

Synchronize the local cache with the remote Vaultwarden server to ensure consistency.