Bws-MCP-server – giving AI agents a controlled path to Bitwarden secrets(blog.crawley.systems)
blog.crawley.systems
Bws-MCP-server – giving AI agents a controlled path to Bitwarden secrets
https://blog.crawley.systems/posts/bws-mcp-server
https://blog.crawley.systems/posts/bws-mcp-server
This wraps the bws CLI as an MCP server with explicit CRUD tools for projects and secrets, plus a bws_run that takes an argv array instead of a shell string. First draft of bws_run accepted "sh -c ..."; that's the eval surface I wanted to remove. Shipped version forces explicit program invocation, and if you genuinely want a shell pipeline you have to put sh as argv[0], which is both visible in audit logs and trivially noticed.
A few things I thought worth calling out:
- Destructive tools (*_delete, bws_run) require confirm: true. Not a safety net (the model will set it); a hook point for your approval tooling so you don't have to pattern-match argument shapes.
- Wraps the CLI, not the Rust SDK. Subprocess + JSON parse is 350 lines. SDK path would have been weeks.
- No mocks in the test suite. Three of four integration tests failed against the real bws binary on first run. Caught a bws secret delete returns-plain-text bug that the JSON-stub protocol tests missed.
Code: https://github.com/kvncrw/bws-mcp-server (GPL-3.0). Issues and PRs welcome, especially from anyone running Vaultwarden with Secrets Manager — I don't have one to test against.