# icoretech/warden-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/icoretech/warden-mcp  
**GitHub Stars:** 24  
**npm Downloads (last month):** 3750  
**Views:** 8  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/icoretech-warden-mcp

## Description
MCP server for Bitwarden and Vaultwarden vault management. Search, create, edit, and organize logins, notes, cards, identities, SSH keys, folders, collections, attachments, and Sends via the official bw CLI.

## Tools
Capabilities this server exposes over MCP:

- **keychain_status** — inspect raw `bw` status
- **keychain_sync** — pull latest vault data with `bw sync`
- **keychain_search_items** — find items by name, URI, username, folder,
- **keychain_get_item** — read a full item by id, redacted by default

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "warden-mcp": {
    "command": "npx",
    "args": ["-y","@icoretech/warden-mcp@latest"],
    "env": {
      "BW_HOST": "",
      "BW_PASSWORD": "",
      "BW_CLIENTID": "",
      "BW_CLIENTSECRET": "",
      "BW_USER": ""
    }
  }
}
```

**Requires environment variables:** `BW_HOST`, `BW_PASSWORD`, `BW_CLIENTID`, `BW_CLIENTSECRET`, `BW_USER` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What icoretech/warden-mcp MCP server does

icoretech/warden-mcp gives MCP clients access to Bitwarden and Vaultwarden vault operations through the official `bw` command-line client. Its stated scope covers searching, creating, editing, organizing, moving, restoring, and deleting common vault records, including logins, secure notes, cards, identities, SSH keys, folders, collections, attachments, and Sends.

The server is intended for agent workflows that need credentials during browser or administrative tasks. It avoids requiring passwords or one-time codes to be placed directly in prompts or custom scripts. Reads are redacted by default; revealing sensitive fields requires an explicit tool option where supported.

## How it works

The server places an MCP transport in front of the Bitwarden CLI rather than implementing Bitwarden client-side cryptography itself. The request path is MCP client to `warden-mcp`, then `bw`, then the Bitwarden or Vaultwarden service. Bitwarden CLI profile data is stored below `KEYCHAIN_BW_HOME_ROOT`.

Local hosts can launch the process over stdio. In this mode, credentials and the vault host are read from `BW_*` environment variables when the process starts. Streamable HTTP mode runs as a long-lived service and can select credentials per request using `X-BW-*` headers. Its HTTP endpoints include `/healthz` for liveness, `/metricsz` for runtime metrics, and `/sse?v=2` for MCP connections.

The CLI binary is resolved from `BW_BIN` first, then from the bundled `@bitwarden/cli` dependency, and finally from the system `PATH`.

## Setup and configuration

Running from npm or source requires Node.js 22.x and npm 10.x. A Bitwarden or Vaultwarden account is also required. Authentication can use a Bitwarden API key pair (`BW_CLIENTID` and `BW_CLIENTSECRET`) or username login (`BW_USER`), together with `BW_PASSWORD` and `BW_HOST`.

For a local MCP host, run the package with `--stdio`. The package can be invoked through `npx` using the `@latest` tag. Claude Code, Codex, Cursor, and Claude Desktop configuration examples use this transport.

HTTP mode starts without `--stdio` and listens on port 3005 in the documented examples. Requests normally provide the vault host and credentials through `X-BW-Host`, `X-BW-Password`, `X-BW-ClientId`, `X-BW-ClientSecret`, or the username alternatives. `X-BW-Unlock-Interval` controls the optional unlock interval and defaults to 300 seconds.

Set `KEYCHAIN_ALLOW_ENV_FALLBACK=true` only for a trusted, single-tenant network. With that setting, an HTTP service can use its process environment instead of per-request headers, but every reachable client inherits the configured vault identity. Hosted clients that require HTTPS need a protected reverse proxy, private tunnel, VPN, or equivalent in front of the service.

A Docker image is available from `ghcr.io/icoretech/warden-mcp`. It stores profile data under `/data/bw-profiles` by default and runs as a non-root `node` user with uid and gid 1000; bind mounts therefore need matching write permissions.

## Tools and capabilities

The exposed MCP operations include:

- `keychain_status` to inspect the raw `bw` status.
- `keychain_sync` to retrieve the latest vault data with `bw sync`.
- `keychain_search_items` to search by item name, URI, username, or folder.
- `keychain_get_item` to retrieve a complete item by ID, with redaction enabled by default.

The broader vault-management scope covers credential records and organizational objects such as folders, collections, attachments, and Sends. This makes the server relevant to agent login flows, vault maintenance, and automation that needs current vault data.

## Limitations and notes

The server depends on the Bitwarden CLI and its authentication and unlock behavior. Keep the HTTP endpoint behind a trusted boundary when credentials are supplied through environment fallback or request headers. `/healthz` checks liveness only; it does not validate vault credentials. Text-only MCP clients receive safe identifiers mirrored into text output when they do not process structured content.

_Full upstream README: https://allmcps.com/mcp/icoretech-warden-mcp/readme_