Bitwarden MCP — security audit

Risk flags

• Shell execution exposed

  This server can run arbitrary shell commands when invoked by an LLM. Audit prompt injection vectors before exposing it to untrusted text.

• No public repository linked

  Without a public repo we cannot independently audit the code. Caution warranted.

Capability surface

• Shell execution

  High risk

  Executes arbitrary shell commands. Treat as remote code execution if exposed.

  Evidence: cli

• Process spawn

  Medium risk

  Launches subprocesses via docker, npx, uvx — supply-chain risk if package is compromised.

  Evidence: npx

• Secrets handling

  Medium risk

  Requires API keys, tokens or credentials in env vars. Watch for placeholder leaks.

  Evidence: password

Trust signals

Total trust score is the sum of these contributions. Each signal carries a fixed weight.

• Verified by Loadout

  +20 / 20

  Manually verified.

• Official author

  +15 / 15

  Maintained by the official Bitwarden team.

• Community traction

  +15 / 20

  1,100 GitHub stars.

• Public source

  +0 / 15

  No linked public repository.

• Stability

  +15 / 15

  Tagged stable in our last review.

• Capability surface

  +10 / 15

  1 high-risk capability detected.