Log inSubmit server
Warden MCP logo

Warden MCP

by icoretech

Manage Bitwarden or Vaultwarden vault data through MCP, using the official bw CLI with redacted reads by default.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Warden MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "icoretech-warden-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@icoretech/warden-mcp@latest"
      ],
      "env": {
        "BW_HOST": "YOUR_VALUE_HERE",
        "BW_PASSWORD": "YOUR_VALUE_HERE",
        "BW_CLIENTID": "YOUR_VALUE_HERE",
        "BW_CLIENTSECRET": "YOUR_VALUE_HERE",
        "BW_USER": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

icoretech/warden-mcp connects MCP clients to Bitwarden or Vaultwarden through the official Bitwarden CLI (`bw`). It supports vault status checks, synchronization, item searches, and full-item reads with secrets redacted by default, alongside broader item and vault administration. Use it when an agent needs credential-aware workflows without embedding passwords in prompts or scripts. Local stdio mode suits desktop hosts, while Streamable HTTP mode supports shared services and multiple vault profiles.

Use cases

  • Search vault items during browser automation
  • Retrieve redacted login records by item ID
  • Sync the latest Bitwarden or Vaultwarden data
  • Manage vault records and organizational objects through agent workflows

Key features

  • Bitwarden and Vaultwarden support
  • Official `bw` CLI execution
  • Redacted item reads by default
  • Search by name, URI, username, or folder
  • Stdio and Streamable HTTP transports
  • Per-profile HTTP credential selection

Tools4

What Warden MCP lets your agent do. Expand a tool for its parameters.

Self-reported~53 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

19/19 checks healthy over the last 80d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 10d ago via OSV.dev · @icoretech/warden-mcp@latest (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars24Stargazers on the source repository.
npm downloads3.8kPackage downloads in the last 30 days.
Last commit4d agoMost recent push to the default branch.
Tools exposed4Callable tools this server registers over MCP.
Directory activity8 viewsConfig copies, upvotes, and views on AllMCPs.

How Warden MCP works

What icoretech/warden-mcp MCP server does

icoretech/warden-mcp gives MCP clients access to Bitwarden and Vaultwarden vault operations through the official bw command-line client. Its stated scope covers searching, creating, editing, organizing, moving, restoring, and deleting common vault records, including logins, secure notes, cards, identities, SSH keys, folders, collections, attachments, and Sends.

The server is intended for agent workflows that need credentials during browser or administrative tasks. It avoids requiring passwords or one-time codes to be placed directly in prompts or custom scripts. Reads are redacted by default; revealing sensitive fields requires an explicit tool option where supported.

How it works

The server places an MCP transport in front of the Bitwarden CLI rather than implementing Bitwarden client-side cryptography itself. The request path is MCP client to warden-mcp, then bw, then the Bitwarden or Vaultwarden service. Bitwarden CLI profile data is stored below KEYCHAIN_BW_HOME_ROOT.

Local hosts can launch the process over stdio. In this mode, credentials and the vault host are read from BW_* environment variables when the process starts. Streamable HTTP mode runs as a long-lived service and can select credentials per request using X-BW-* headers. Its HTTP endpoints include /healthz for liveness, /metricsz for runtime metrics, and /sse?v=2 for MCP connections.

The CLI binary is resolved from BW_BIN first, then from the bundled @bitwarden/cli dependency, and finally from the system PATH.

Setup and configuration

Running from npm or source requires Node.js 22.x and npm 10.x. A Bitwarden or Vaultwarden account is also required. Authentication can use a Bitwarden API key pair (BW_CLIENTID and BW_CLIENTSECRET) or username login (BW_USER), together with BW_PASSWORD and BW_HOST.

For a local MCP host, run the package with --stdio. The package can be invoked through npx using the @latest tag. Claude Code, Codex, Cursor, and Claude Desktop configuration examples use this transport.

HTTP mode starts without --stdio and listens on port 3005 in the documented examples. Requests normally provide the vault host and credentials through X-BW-Host, X-BW-Password, X-BW-ClientId, X-BW-ClientSecret, or the username alternatives. X-BW-Unlock-Interval controls the optional unlock interval and defaults to 300 seconds.

Set KEYCHAIN_ALLOW_ENV_FALLBACK=true only for a trusted, single-tenant network. With that setting, an HTTP service can use its process environment instead of per-request headers, but every reachable client inherits the configured vault identity. Hosted clients that require HTTPS need a protected reverse proxy, private tunnel, VPN, or equivalent in front of the service.

A Docker image is available from ghcr.io/icoretech/warden-mcp. It stores profile data under /data/bw-profiles by default and runs as a non-root node user with uid and gid 1000; bind mounts therefore need matching write permissions.

Tools and capabilities

The exposed MCP operations include:

  • keychain_status to inspect the raw bw status.
  • keychain_sync to retrieve the latest vault data with bw sync.
  • keychain_search_items to search by item name, URI, username, or folder.
  • keychain_get_item to retrieve a complete item by ID, with redaction enabled by default.

The broader vault-management scope covers credential records and organizational objects such as folders, collections, attachments, and Sends. This makes the server relevant to agent login flows, vault maintenance, and automation that needs current vault data.

Limitations and notes

The server depends on the Bitwarden CLI and its authentication and unlock behavior. Keep the HTTP endpoint behind a trusted boundary when credentials are supplied through environment fallback or request headers. /healthz checks liveness only; it does not validate vault credentials. Text-only MCP clients receive safe identifiers mirrored into text output when they do not process structured content.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Warden MCP

icoretech/warden-mcp is an MCP server that connects AI clients to Bitwarden or Vaultwarden through the official `bw` CLI. Its main tools inspect vault status, synchronize data, search items by common fields, and retrieve items by ID with sensitive values redacted by default.

Install it by running the npm package with `npx -y @icoretech/warden-mcp@latest --stdio`. Node.js 22.x and npm 10.x are required when running from npm or source, along with a Bitwarden or Vaultwarden account and authentication settings.

Yes, icoretech/warden-mcp works with Cursor through a stdio MCP configuration. Add the package as the command, pass `--stdio`, and provide `BW_HOST`, `BW_PASSWORD`, plus either Bitwarden API-key credentials or `BW_USER`.

Run the package without `--stdio` and connect to its Streamable HTTP endpoint at `/sse?v=2`. MCP requests normally carry vault settings through `X-BW-*` headers, allowing one service to serve multiple clients or profiles. Protect the endpoint before exposing it beyond a trusted network.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewWarden MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/icoretech-warden-mcp?style=directory)](https://allmcps.com/mcp/icoretech-warden-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/icoretech-warden-mcp"><img src="https://allmcps.com/api/badge/icoretech-warden-mcp?style=directory" alt="Warden MCP on AllMCPs" /></a>