Warden MCP Server
Vaultwarden and Bitwarden vault item management for AI agents.
Data last scanned today · Reviewed today
Overview
Warden MCP Server allows AI agents to interface with Bitwarden or Vaultwarden instances. By leveraging the official Bitwarden CLI, it enables agents to search, read, create, update, and move vault items, including credentials, TOTP codes, secure notes, and attachments directly within their workflow. This server is designed to eliminate the need for hardcoded credentials in configuration files or prompts. By facilitating secure access to vault data, it supports automation tasks that require logging into external systems, all while maintaining the integrity of the user's existing vault organization.
Our verdict
With a security score of 56/100, this tool is categorized as high risk. The primary concern is the lack of a read-only mode, meaning any connected MCP host is granted full write access to your entire vault. Given this broad permission set, it is recommended only for power users who understand the implications of granting AI agents persistent access to credentials, and it should not be used in environments where read-only access is a requirement.
- Built for direct integration with official Bitwarden CLI.
- Small dependency surface with only three direct dependencies.
- Maintained by the official vendor with recent repository activity.
- Supports TOTP codes, secure notes, folders, and collections.
- No read-only mode restricts permission granularity for connected agents.
- Authentication method has not yet been editorially reviewed.
- Lack of OAuth support requires handling raw credentials.
Setup
{
"mcpServers": {
"warden-mcp": {
"args": [
"-y",
"@icoretech/warden-mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| keychain_status | Inspect raw bw status | low |
| keychain_sync | Pull latest vault data with bw sync | medium |
| keychain_sdk_version | Get the SDK version | low |
| keychain_encode | Encode data | low |
| keychain_generate | Generate data | low |
| keychain_generate_username | Generate a username | low |
| keychain_search_items | Find items by name, URI, username, folder, collection, or type | low |
| keychain_get_item | Read a full item by id, redacted by default | low |
| keychain_update_item | Update an item | medium |
| keychain_create_login | Create a login item | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the core system requirements to run the server?
You need Node.js version 24 or higher, npm installed, and either a Vaultwarden or Bitwarden account.
›Does the server support multiple authentication methods?
Yes, you can authenticate using either a Bitwarden API key pair (Client ID and Secret) or a standard email username and password.
›How do I provide credentials when using stdio mode?
Credentials are loaded from environment variables like BW_HOST, BW_CLIENTID, BW_CLIENTSECRET, and BW_PASSWORD when the server process starts.
›Can I run this server as a shared HTTP service?
Yes, running in HTTP mode allows one service to handle multiple vault hosts or identities by providing credentials and host details via request headers like X-BW-Host and X-BW-Password.
›Is the vault data safe when accessed by agents?
The server is designed to keep secret fields redacted by default, only revealing them if the tool supports a specific reveal flag and the client explicitly requests it.
›How does the server handle vault state?
It shells out to the official Bitwarden CLI (bw) and maintains profile state locally under the KEYCHAIN_BW_HOME_ROOT directory.
Badge
Maintain this server? Add the live badge to your README.