get_secretLABSCO SUMMARY
Handing over the master password is the decision, not the install.
The session management is genuinely the hard part it solves — the bw CLI expects an interactive human, and this makes it behave for a non-interactive caller. But the configuration includes the vault's master password in plain environment variables, which is why the README steers production users toward orchestrator secrets rather than a .env file. Run it somewhere you control, and start from get_secret_template when creating items: the item JSON has to arrive as an escaped string.
What it is
An MCP wrapper around the official Bitwarden bw CLI, pointed at a self-hosted Vaultwarden instance. It unlocks the vault on the first request, caches the session key, and holds a lock so concurrent calls cannot trigger competing unlocks — the part that makes the CLI awkward to automate.
What you get
get_secretretrieves an item by name or by IDlist_secretssearches the vault for items matching a termget_secret_templatereturns a JSON skeleton for a new item, withlogin,note,cardandidentityas the valid typescreate_secretadds an item from that JSON, andupdate_secretedits an existing one by IDdelete_secretremoves an item by IDsyncforces the local vault to catch up with the remote server- Session handling built in — automatic unlock with the key cached, a lock against concurrent unlocks, and timeouts so a stuck call does not block the rest
Requirements
The Bitwarden CLI (bw) installed on the machine running the server and available on the PATH — every cryptographic operation goes through it. Node.js 18.0.0 or newer. Configuration is four environment variables: BITWARDEN_HOST for your instance URL, BW_CLIENTID and BW_CLIENTSECRET for the API credentials, and BW_MASTER_PASSWORD. The npm package mcp-vaultwarden-server (1.1.1) declares no executable, so run server.js from a clone of the repository.
Setup effort
Build from source — git clone https://github.com/fkom13/mcp-vaultwarden.git
USE CASES
01
Fetching a credential mid-task
Ask for the secret by name and get it back without opening the vault UI.
02
Finding out what is stored for a service
Search the vault by keyword before guessing at an item name.
03
Storing a new credential correctly the first time
Get the template for the item type, fill it, and create the entry from it.
04
Keeping the local vault current
Force a sync when an item was changed elsewhere and the read looks stale.
7 tools
Listed in project docs. Your client may show a different list.
list_secretsget_secret_templatecreate_secretupdate_secretdelete_secretsyncBEFORE YOU INSTALL
What to know first
Tools you get
7 tools named in the project's documentation.
Requires
- Bitwarden CLI (bw) on PATH
- Node.js 18.0.0+
- BITWARDEN_HOST in your environment
- BW_CLIENTID in your environment
- BW_CLIENTSECRET in your environment
- BW_MASTER_PASSWORD in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
git clone https://github.com/fkom13/mcp-vaultwarden.git
cd mcp-vaultwarden
npm installMCP Clients
Gemini CLI
GEMINI CLI · JSON
{
"mcpServers": {
"vaultwarden": {
"command": "node",
"args": [
"<YOUR_PATH_TO_MCP_VAULTWARDEN>/server.js"
],
"env": {
"BITWARDEN_HOST": "https://<YOUR_INSTANCE>.vaultwarden.com",
"BW_CLIENTID": "<YOUR_BW_CLIENTID>",
"BW_CLIENTSECRET": "<YOUR_BW_CLIENTSECRET>",
"BW_MASTER_PASSWORD": "<YOUR_BW_MASTER_PASSWORD>"
}
}
}
}<YOUR_PATH_TO_MCP_VAULTWARDEN> is the full path to your clone. The README's own block launches it with npx, but the published package declares no executable, so start server.js from the clone instead (the README's source method runs node server.js).
