{
  "markdown": "# @aiwerk/mcp-server-vault\n\nBitwarden / Vaultwarden MCP server — BYOK vault access for AI agents.\n\nExposes 6 tools over stdio. Secret values are **never** sent in plaintext through `list_vault_items` or `get_vault_metadata` — secrets are delivered only through Bitwarden Sends (E2E-encrypted one-time URLs).\n\n## Install\n\n```bash\nnpx -y @aiwerk/mcp-server-vault\n```\n\n## Configure\n\n| Variable | Required | Default | Description |\n|---|---|---|---|\n| `VAULT_API_BASE` | ✅ | — | Base URL of your Bitwarden/Vaultwarden instance (no trailing slash), e.g. `https://pass.aiwerk.ch` |\n| `VAULT_CLIENT_ID` | ✅ | — | Personal API key `client_id` (e.g. `user.abc-def-1234`) |\n| `VAULT_CLIENT_SECRET` | ✅ | — | Personal API key `client_secret` |\n| `VAULT_MASTER_PASSWORD` | ✅ | — | Vault master password (used for E2E decryption key derivation) |\n| `VAULT_EXPOSED_COLLECTION` | — | `mcp-exposed` | Name of the collection visible to agents |\n| `VAULT_AGENT_CREATED_COLLECTION` | — | `mcp-agent-created` | Name of the collection for agent-created secrets |\n| `VAULT_API_TIMEOUT_MS` | — | `15000` | HTTP timeout in milliseconds |\n| `DRY_RUN` | — | `0` | Set `1` to log write operations without executing them |\n| `READ_ONLY` | — | `0` | Set `1` to block all write operations (Send creation and save) |\n\n## Auth — Personal API Key\n\n1. Log in to your Bitwarden/Vaultwarden instance\n2. Go to **Account Settings → Security → Keys → API Key**\n3. Note the `client_id` and `client_secret`\n4. Reference: https://bitwarden.com/help/personal-api-key/\n\n## Vault Setup\n\nBefore using this server, create two collections in your Vaultwarden organization:\n- **`mcp-exposed`** — items you want to expose to agents (your existing secrets: API keys, passwords, etc.)\n- **`mcp-agent-created`** — items written by agents via `save_generated_secret`\n\nAdd items to `mcp-exposed` via the Vaultwarden web UI.\n\n### Custom fields\n\nOptionally add these custom fields to items in `mcp-exposed` for fine-grained control:\n\n| Field | Type | Purpose |\n|---|---|---|\n| `mcp-scope` | text | Comma-separated glob list of tool/server names allowed to use this item (e.g. `stripe.*,openai`) |\n| `mcp-chat-reveal-allowed` | text | `\"true\"` to allow chat delivery of the Send URL |\n| `mcp-delivery-channel` | text | `\"chat\"` (default), `\"telegram\"`, or `\"email\"` |\n\n## Tools\n\n| Tool | Description |\n|---|---|\n| `list_vault_items` | List items from `mcp-exposed` and `mcp-agent-created`. Returns metadata only — no secret values. |\n| `get_vault_metadata` | Get full metadata for a named item (name, type, username, URIs, custom fields, expiry). No password/secret. |\n| `reveal_secret_via_send` | Reveal a secret via a Bitwarden Send (E2E-encrypted one-time URL with configurable TTL and max-views). |\n| `get_totp_code` | Get the current TOTP code for a login item, including remaining seconds in the period. |\n| `save_generated_secret` | Save an agent-generated secret (password / api-key) into `mcp-agent-created` as a secure note. CREATE-only — no overwrite. |\n| `save_login_item` | Save sign-in credentials (username + password + optional URL + TOTP seed) into `mcp-agent-created` as a real login item. CREATE-only — no overwrite. |\n| `health_check` | Check connectivity: auth status, API version, collection visibility, item counts, latency. |\n\n## Security model\n\n- **Opt-in exposure**: only items in `mcp-exposed` or `mcp-agent-created` are accessible; all other items return `item_not_visible`\n- **Read-only existing items**: no `update_*`, `delete_*`, or `change_*` tools exist\n- **Secret value delivery via Send only**: `list_vault_items` and `get_vault_metadata` never return passwords, TOTP seeds, or api-key values\n- **E2E encryption preserved**: the server decrypts vault data locally (master password stays in env vars, never sent over the wire)\n- **Constrained agent writes**: `save_generated_secret` and `save_login_item` are CREATE-only into the dedicated `mcp-agent-created` collection\n\n> **Note:** Actual `{{vault:NAME}}` placeholder resolution in tool call arguments happens in the AIWerk hosted bridge, not in this server. The bridge's resolution uses the same BYOC credentials. See the bridge-patch companion document for details.\n\n## License\n\nMIT — AIWerk <kontakt@aiwerk.ch>\n\nHomepage: https://aiwerkmcp.com\n",
  "bytes": 4275,
  "sha": "27abfd0cb00a633807ac5f39a653cfb8cde041939969137c480eca33143c80ce",
  "repo_slug": "aiwerk/mcp-server-vault",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_aiwerk_mcp_server_vault_1873ee05/readme"
}