Connect Bitwarden to Claude: Automate access control and auditing

If you need to connect Bitwarden to Claude to automate user provisioning, enforce access policies, or audit event logs, you need a Model Context Protocol (MCP) server. This server acts as the secure translation layer between Claude's JSON-RPC tool calls and Bitwarden's enterprise REST APIs. You can either build and maintain this token lifecycle infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL. If your team uses ChatGPT, check out our guide on /connect-bitwarden-to-chatgpt-manage-members-groups-and-policies/ or explore our broader architectural overview on /connect-bitwarden-to-ai-agents-provision-users-and-collections/.

Giving a Large Language Model (LLM) read and write access to a core security infrastructure component like Bitwarden is a high-stakes engineering challenge. You have to handle API authentication, map nested enterprise schemas to MCP tool definitions, and deal with strict UUID constraints. Every time Bitwarden updates a resource schema, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Bitwarden, connect it natively to Claude Desktop, and execute complex access control workflows using natural language.

The Engineering Reality of the Bitwarden API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against Bitwarden's Enterprise API is unforgiving. Bitwarden is built for strict zero-knowledge security and access control, and its API design reflects that rigidity.

If you decide to build a custom Bitwarden MCP server, here are the specific integration challenges you will face:

Destructive PUT Updates Bitwarden's API heavily relies on PUT requests for resource modification. This means any property omitted from the request body during an update is immediately reset or nullified. If an LLM attempts to update a Bitwarden group's name but fails to include the existing list of collections, those collections will be stripped from the group. To prevent Claude from accidentally destroying access configurations, your MCP tools must explicitly enforce a read-modify-write pattern, forcing the model to fetch the entire object first.

Bulk Replacement Associations Managing relationships in Bitwarden - like adding a member to a group - does not typically happen via a simple POST /group/{id}/member append operation. Instead, endpoints like bitwarden_group_member_ids_bulk_update require the client to supply the entire list of member UUIDs to associate with the group. If the LLM sends only the new member's UUID, it inadvertently kicks everyone else out of the group. The MCP server must provide tools that make this array-replacement logic completely transparent to the LLM.

Continuation Tokens for Audit Logs Bitwarden's public event logs (audit logs) can contain millions of records across a large enterprise. Bitwarden does not use standard page numbers or offset pagination. Instead, it relies on opaque continuation tokens. An LLM has a habit of hallucinating or truncating these tokens. Your MCP layer must inject explicit instructions into the schema descriptions, demanding that the model pass the cursor value back unchanged without attempting to decode or modify it.

Creating the Bitwarden MCP Server

Truto dynamically generates MCP tools based on the available Bitwarden integration resources and your specific configuration filters. The resulting server exposes a standard JSON-RPC 2.0 endpoint that any MCP client can consume.

You can generate this server via the Truto dashboard or programmatically via the API.

Method 1: Via the Truto UI

1. Log into your Truto account and navigate to your Integrated Accounts.
2. Select the connected Bitwarden enterprise account you want to use.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Configure the server (name, allowed methods, tags, and optional expiration).
6. Click Save and copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the Truto API

If you are dynamically provisioning AI workspaces for your own users, you can generate MCP servers programmatically.

Make an authenticated POST request to /integrated-account/:id/mcp. Truto will validate that the integration has tools available and store the generated token securely in a highly available key-value store.

curl -X POST https://api.truto.one/integrated-account/<BITWARDEN_ACCOUNT_ID>/mcp \
  -H "Authorization: Bearer <YOUR_TRUTO_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Claude IT Ops Bot",
    "config": {
      "methods": ["read", "write"],
      "tags": ["directory", "compliance"]
    }
  }'

The API responds with the persistent MCP token configuration and the ready-to-use endpoint URL:

{
  "id": "mcp_srv_998877",
  "name": "Claude IT Ops Bot",
  "config": {
    "methods": ["read", "write"],
    "tags": ["directory", "compliance"]
  },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}

Connecting Claude to Bitwarden

Once you have your Truto MCP server URL, you must configure Claude to route tool execution requests to it.

Method A: Via the Claude UI

If you are using the Claude desktop app or web interface (for Enterprise/Team plans that support custom connectors):

1. Open Claude and navigate to Settings.
2. Select Integrations or Connectors (depending on your plan).
3. Click Add MCP Server.
4. Paste the Truto MCP URL (https://api.truto.one/mcp/...).
5. Click Add.

Claude will immediately send an initialize request to the URL, handshake via JSON-RPC, and populate its context with the available Bitwarden tools.

Method B: Via Manual Config File

For local development or deployment with custom AI agents using the Claude Desktop App, you can configure the MCP connection manually using the Server-Sent Events (SSE) transport wrapper.

Open your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the Truto URL to the mcpServers object using the official SSE client:

{
  "mcpServers": {
    "bitwarden-truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f67890"
      ]
    }
  }
}

Restart Claude Desktop. The Bitwarden tools will now appear in the UI as available operations.

Hero Tools for Bitwarden

Truto automatically maps the Bitwarden API into a flat input namespace for JSON-RPC tool calls. When Claude calls a tool, Truto separates the flat arguments into the correct query parameters and request bodies based on the underlying schema.

Here are 6 high-leverage tools available on the Bitwarden MCP server.

list_all_bitwarden_members

Retrieves a complete list of members in your Bitwarden organization. This is typically the first tool Claude calls to resolve a human-readable email or name into a Bitwarden UUID.

"Get a list of all current members in our Bitwarden organization and find the ID for alice@example.com."

get_single_bitwarden_member_by_id

Fetches the complete profile of a specific organization member using their UUID. Essential for the read-modify-write pattern before attempting updates.

"Look up the full profile details for the Bitwarden member with ID 8f14e45f-...

update_a_bitwarden_member_by_id

Modifies a member's attributes (e.g., changing their role from User to Manager). Because Bitwarden uses PUT, Claude must send the full object payload. Truto's dynamically generated tool schema forces Claude to include all required fields to prevent accidental data destruction.

"Update Bob's Bitwarden profile to change his role to 'Manager'. Ensure you retain all of his existing attributes when sending the update."

bitwarden_group_member_ids_bulk_update

Updates a Bitwarden group's member associations by replacing them with a supplied list of member IDs. Claude must fetch the existing IDs first, append the new user, and send the full array to avoid wiping existing group memberships.

"Add member ID 9a2b3c... to the 'DevOps' group. First, get all current members of the DevOps group, then send the updated list of IDs in a bulk update."

list_all_bitwarden_public_events

Retrieves the enterprise audit logs. Useful for security investigations, access reviews, and identifying anomalous vault behavior. Supports date range filters and continuation tokens for pagination.

"Pull the Bitwarden event logs for the last 7 days and summarize any instances where a user exported their vault."

update_a_bitwarden_public_policy_by_id

Toggles enterprise policies on or off (e.g., enforcing Two-Factor Authentication or Master Password requirements). The ID corresponds to the specific policy type number defined in Bitwarden's documentation.

"Check our current Two-Factor Authentication policy status in Bitwarden. If it is disabled, update it to enabled."

To view the complete inventory of available tools, including resource definitions and schema parameters, visit the Bitwarden integration page.

Workflows in Action

Once connected, Claude can execute complex, multi-step Bitwarden administrative tasks. Here are two real-world scenarios showing how Claude navigates the API via Truto.

Scenario 1: IT Admin Offboarding

When an employee leaves, IT needs to rapidly revoke their access to the Bitwarden organization and audit their recent activity to ensure no sensitive passwords were exported right before departure.

"Alice is leaving the company. Revoke her access to our Bitwarden organization immediately, and pull her event logs from the last 14 days to check if she exported any vault data."

Tool Execution Sequence:

1. list_all_bitwarden_members: Claude searches the member directory to resolve "Alice" to her Bitwarden UUID.
2. create_a_bitwarden_member_revoke: Claude passes the resolved UUID to this endpoint, instantly disabling her organizational vault access.
3. list_all_bitwarden_public_events: Claude queries the audit logs, filtering by memberId and a 14-day date range, searching for export event types.

Result: The user's access is safely revoked, and the IT admin receives a summarized security report of Alice's final weeks in the system.

Scenario 2: Security Engineer Group Provisioning

sequenceDiagram
    participant Claude as Claude Desktop
    participant MCP as Truto MCP
    participant Bitwarden as Bitwarden API

    Claude->>MCP: call list_all_bitwarden_group_member_ids(group_id)
    MCP->>Bitwarden: GET /groups/{id}/member-ids
    Bitwarden-->>MCP: ["uuid1", "uuid2"]
    MCP-->>Claude: Return existing IDs
    Claude->>MCP: call bitwarden_group_member_ids_bulk_update(group_id, member_ids)
    MCP->>Bitwarden: PUT /groups/{id}/member-ids <br> payload: ["uuid1", "uuid2", "new_uuid"]
    Bitwarden-->>MCP: 200 OK
    MCP-->>Claude: Success

A security engineer wants to grant a new contractor access to the "Infrastructure Secrets" group without breaking existing access.

"Add the user with email contractor@example.com to the 'Infrastructure Secrets' group in Bitwarden."

Tool Execution Sequence:

1. list_all_bitwarden_members: Claude finds the UUID for contractor@example.com.
2. list_all_bitwarden_groups: Claude finds the UUID for the "Infrastructure Secrets" group.
3. list_all_bitwarden_group_member_ids: Claude fetches the array of users currently in the group.
4. bitwarden_group_member_ids_bulk_update: Claude appends the contractor's UUID to the array and issues the bulk update.

Result: The contractor is provisioned securely, and the read-modify-write pattern prevents existing engineers from losing access.

Security and Access Control

Exposing an enterprise password manager API to an LLM requires strict boundary enforcement. Truto's MCP servers provide four layers of configuration to limit what the model can do:

• Method Filtering (config.methods): Restrict the server to specific operation types. Set methods: ["read"] to allow Claude to audit logs and read directory data without the ability to update policies or revoke users.
• Tag Filtering (config.tags): Scope the server to specific functional areas. For example, filtering by ["audit"] exposes only the event log tools, keeping user provisioning tools completely hidden from the LLM.
• Additional Authentication (require_api_token_auth): By default, the MCP token URL is sufficient for access. Setting this flag to true requires the MCP client to also pass a valid Truto API token in the Authorization header, adding a second layer of security.
• Automatic Expiration (expires_at): Schedule the MCP server to self-destruct at a specific ISO datetime. Excellent for granting temporary IT contractors time-bound AI tooling access for specific audit sprints.

Handling Bitwarden API Rate Limits

When automating Bitwarden via LLMs, the model can generate API calls rapidly—especially during bulk event log retrieval or directory mapping.

Truto does not silently absorb, throttle, or apply exponential backoff to rate limit errors. If the Bitwarden API rejects a request due to quota exhaustion, Truto passes the HTTP 429 error directly back to Claude. Truto normalizes the upstream rate limit data into standard IETF headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset). It is the responsibility of the client or the LLM's system prompt to read these headers, pause execution, and retry the tool call when the reset window clears.

Automate Identity with Confidence

Connecting Bitwarden to Claude using a managed MCP server removes the overhead of building OAuth pipelines, dealing with destructive PUT schemas, and handling token refreshes. By exposing highly curated, dynamically generated tools to your AI agents, you can safely automate onboarding, enforce security policies, and conduct natural-language audits across your entire Bitwarden organization.