Vaultwarden Drop Slot MCP server

vaultwarden-drop-slot-mcp

MCP server, CLI and Node.js module for write-only credential deposits into a self-hosted Vaultwarden (Bitwarden-compatible) vault. AI agents such as Claude Code and Codex, and deployment scripts, can save new logins (passwords) and secure notes, encrypted with age before they reach the inbox, without a vault login that can read existing secrets.

TL;DR

Let an agent save a new password without giving it the keys to your vault.

An agent or deployment script creates a credential. You want it saved in Vaultwarden without pasting it into chat, copying it by hand, or giving that agent a vault login that can read existing passwords. This project provides a deposit-only path: encrypt the new item, hand it to an inbox, and receive a receipt. A separate trusted importer saves it as an ordinary login or secure note that you open with your existing Bitwarden clients.

dedicated importer account. No changes to Vaultwarden are required.

• For agents: two MCP tools — deposit a secret and check its delivery status.
• For scripts: a stdin-based CLI and a typed Node.js module.
• For operators: portable Docker containers, your own Vaultwarden, and a

The restriction applies to the producer. The importer has vault access; keep its account and host private. Secrets included in AI tool arguments can still be seen by the AI provider. Use the CLI or Node module directly when a script can generate and deposit a secret without involving the model.

Release 0.1.0. Install from npm (npm install vaultwarden-drop-slot-mcp, or run npx -y vaultwarden-drop-slot-mcp), from this repository, or from a locally packed tarball. The MCP server is also listed in the MCP Registry as io.github.ip2k/vaultwarden-drop-slot-mcp. Containers are built locally. Original code is Apache-2.0. This is an independent project, not affiliated with Bitwarden or Vaultwarden. See the verification record for tested behavior and limits.

Start here: Setup walkthrough · MCP connections · Operations · Security design

From a new credential to your vault

flowchart TB
    producer["Agent or deployment script"]
    client["Local MCP, CLI or Node client<br/>Encrypt with pinned age public key"]
    inbox["HTTPS inbox<br/>Store ciphertext and receipt state"]
    importer["Private importer<br/>Decrypt with age private key"]
    vault["Vaultwarden<br/>Dedicated organization and collection"]
    owner["You<br/>Existing Bitwarden clients"]
    producer -->|New login or secure note| client
    client -->|Ciphertext plus writer authentication| inbox
    importer -->|Claim encrypted job| inbox
    inbox -->|Ciphertext job| importer
    importer -->|Create and privately verify| vault
    vault -->|Normal vault sync| owner
    importer -.->|Verified delivery acknowledgment| inbox
    inbox -.->|Opaque receipt and status only| client
    classDef publicSide fill:#e8f1ff,stroke:#315f99,color:#122842
    classDef privateSide fill:#e7f4ec,stroke:#36704a,color:#173422
    class producer,client,inbox publicSide
    class importer,vault,owner privateSide

The inbox cannot decrypt the payload. Only the private importer holds the age identity and the dedicated Bitwarden CLI session. The public API has no vault read, search, list, edit, or delete operations. Item URLs are stored as text; the service never fetches them.

How it fits together

Shortened. The full README is on GitHub.