Can I use Bitwarden as a CLI?

Yes. KosmoKrator exposes a Bitwarden CLI through kosmo integrations:call and the provider shortcut command. Commands can return JSON for scripts, CI, and coding agents.

Can I expose Bitwarden through MCP?

Yes. The KosmoKrator MCP gateway can expose selected Bitwarden tools to clients such as Claude Code, Cursor, Codex, and other MCP-compatible tools.

Where are Bitwarden credentials stored?

Bitwarden credentials are configured in KosmoKrator's local integration settings and reused by CLI, Lua, and MCP gateway surfaces.

Can I deny write access for Bitwarden MCP tools?

Yes. Start the gateway with --write=deny for read-only clients, or use ask/allow only for trusted workspaces.

productivity

Bitwarden CLI for AI Agents

Use the Bitwarden CLI from KosmoKrator to call Bitwarden tools headlessly, return JSON, inspect schemas, and automate workflows from coding agents, scripts, and CI.

Bitwarden CLI Setup

Bitwarden can be configured headlessly with `kosmokrator integrations:configure bitwarden`.

Install, configure, and verify

# Install KosmoKrator first if it is not available on PATH.
curl -fsSL https://raw.githubusercontent.com/OpenCompanyApp/kosmokrator/main/install.sh | bash

# Configure and verify this integration.
kosmokrator integrations:configure bitwarden --enable --read allow --write ask --json
kosmokrator integrations:doctor bitwarden --json
kosmokrator integrations:status --json

Credentials

Authentication type: oauth client credentials oauth_client_credentials. Configure credentials once, then reuse the same stored profile from scripts, coding CLIs, Lua, and MCP.

Key	Env var	Type	Required	Label
`client_id`	`BITWARDEN_CLIENT_ID`	Text `string`	no	Client ID
`client_secret`	`BITWARDEN_CLIENT_SECRET`	Secret `secret`	no	Client Secret
`access_token`	`BITWARDEN_ACCESS_TOKEN`	Secret `secret`	no	Access Token
`api_url`	`BITWARDEN_API_URL`	URL `url`	no	API URL
`identity_url`	`BITWARDEN_IDENTITY_URL`	URL `url`	no	Identity Token URL

Command Patterns

The generic command is stable across every integration. The provider shortcut is shorter for humans.

Generic CLI call

kosmo integrations:call bitwarden.bitwarden_collections_get '{}' --json

Provider shortcut

kosmo integrations:bitwarden bitwarden_collections_get '{}' --json

Discovery

These commands return structured output for coding agents that need to inspect capabilities before choosing a function.

Discovery commands

kosmo integrations:docs bitwarden --json
kosmo integrations:docs bitwarden.bitwarden_collections_get --json
kosmo integrations:schema bitwarden.bitwarden_collections_get --json
kosmo integrations:search "Bitwarden" --json
kosmo integrations:list --json

Automation Contexts

The same configured command surface works in these environments. The command does not change unless the host wrapper, credentials, or permissions change.

CI Run integration calls from CI jobs with JSON output, explicit credentials, and predictable exit status. Cron Jobs Schedule repeatable integration workflows from cron while keeping credentials in KosmoKrator config. Shell Scripts Call integration functions from shell scripts with stable JSON input and output. Headless Automation Use KosmoKrator as a non-interactive integration runtime for local automations and wrappers. Coding Agents Let coding agents discover schemas and execute integration functions through CLI commands or MCP.

CLI Functions

Every function below can be called headlessly. Commands are highlighted, copyable, and scroll horizontally when payloads are long.

`bitwarden.bitwarden_collections_get`

Retrieves the details of an existing collection. You need only supply the unique collection identifier that was returned upon collection creation.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_collections_get '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_collections_get '{}' --json

`bitwarden.bitwarden_collections_put`

Updates the specified collection object. If a property is not provided, the value of the existing property will be reset.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_collections_put '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_collections_put '{}' --json

`bitwarden.bitwarden_collections_delete`

Permanently deletes a collection. This cannot be undone.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_collections_delete '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_collections_delete '{}' --json

`bitwarden.bitwarden_collections_list`

Returns a list of your organization's collections. Collection objects listed in this call do not include information about their associated groups.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_collections_list '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_collections_list '{}' --json

`bitwarden.bitwarden_events_list`

Returns a filtered list of your organization's event logs, paged by a continuation token. If no filters are provided, it will return the last 30 days of event for the organization.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_events_list '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_events_list '{}' --json

`bitwarden.bitwarden_groups_get`

Retrieves the details of an existing group. You need only supply the unique group identifier that was returned upon group creation.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_groups_get '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_groups_get '{}' --json

`bitwarden.bitwarden_groups_put`

Updates the specified group object. If a property is not provided, the value of the existing property will be reset.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_groups_put '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_groups_put '{}' --json

`bitwarden.bitwarden_groups_delete`

Permanently deletes a group. This cannot be undone.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_groups_delete '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_groups_delete '{}' --json

`bitwarden.bitwarden_groups_get_member_ids`

Retrieves the unique identifiers for all members that are associated with this group. You need only supply the unique group identifier that was returned upon group creation.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_groups_get_member_ids '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_groups_get_member_ids '{}' --json

`bitwarden.bitwarden_groups_put_member_ids`

Updates the specified group's member associations.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_groups_put_member_ids '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_groups_put_member_ids '{}' --json

`bitwarden.bitwarden_groups_list`

Returns a list of your organization's groups. Group objects listed in this call include information about their associated collections.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_groups_list '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_groups_list '{}' --json

`bitwarden.bitwarden_groups_post`

Creates a new group object.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_groups_post '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_groups_post '{}' --json

`bitwarden.bitwarden_members_get`

Retrieves the details of an existing member of the organization. You need only supply the unique member identifier that was returned upon member creation.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_get '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_get '{}' --json

`bitwarden.bitwarden_members_put`

Updates the specified member object. If a property is not provided, the value of the existing property will be reset.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_put '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_put '{}' --json

`bitwarden.bitwarden_members_remove`

Removes a member from the organization. This cannot be undone. The user account will still remain.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_remove '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_remove '{}' --json

`bitwarden.bitwarden_members_get_group_ids`

Retrieves the unique identifiers for all groups that are associated with this member. You need only supply the unique member identifier that was returned upon member creation.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_get_group_ids '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_get_group_ids '{}' --json

`bitwarden.bitwarden_members_put_group_ids`

Updates the specified member's group associations.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_put_group_ids '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_put_group_ids '{}' --json

`bitwarden.bitwarden_members_list`

Returns a list of your organization's members. Member objects listed in this call include information about their associated collections.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_list '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_list '{}' --json

`bitwarden.bitwarden_members_post`

Creates a new member object by inviting a user to the organization.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_post '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_post '{}' --json

`bitwarden.bitwarden_members_post_reinvite`

Re-sends the invitation email to an organization member.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_post_reinvite '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_post_reinvite '{}' --json

`bitwarden.bitwarden_members_revoke`

Revoke a member's access to an organization.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_revoke '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_revoke '{}' --json

`bitwarden.bitwarden_members_restore`

Restores a previously revoked member of the organization.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_members_restore '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_members_restore '{}' --json

`bitwarden.bitwarden_organization_get_subscription`

Retrieves the subscription details for the current organization.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_organization_get_subscription '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_organization_get_subscription '{}' --json

`bitwarden.bitwarden_organization_post_subscription`

Update the organization's current subscription for Password Manager and/or Secrets Manager.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_organization_post_subscription '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_organization_post_subscription '{}' --json

`bitwarden.bitwarden_organization_import`

Import members and groups from an external system.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_organization_import '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_organization_import '{}' --json

`bitwarden.bitwarden_policies_get`

Retrieves the details of a policy.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_policies_get '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_policies_get '{}' --json

`bitwarden.bitwarden_policies_put`

Updates the specified policy. If a property is not provided, the value of the existing property will be reset.

Write write

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_policies_put '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_policies_put '{}' --json

`bitwarden.bitwarden_policies_list`

Returns a list of your organization's policies.

Read read

Parameters: none

Generic call

kosmo integrations:call bitwarden.bitwarden_policies_list '{}' --json

Shortcut

kosmo integrations:bitwarden bitwarden_policies_list '{}' --json

Function Schemas

Use these parameter tables when building CLI payloads without calling integrations:schema first.

bitwarden.bitwarden_collections_get 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_collections_get --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_collections_put 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_collections_put --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_collections_delete 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_collections_delete --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_collections_list 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_collections_list --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_events_list 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_events_list --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_groups_get 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_groups_get --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_groups_put 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_groups_put --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_groups_delete 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_groups_delete --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_groups_get_member_ids 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_groups_get_member_ids --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_groups_put_member_ids 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_groups_put_member_ids --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_groups_list 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_groups_list --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_groups_post 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_groups_post --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_get 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_get --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_put 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_put --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_remove 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_remove --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_get_group_ids 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_get_group_ids --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_put_group_ids 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_put_group_ids --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_list 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_list --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_post 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_post --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_post_reinvite 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_post_reinvite --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_revoke 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_revoke --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_members_restore 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_members_restore --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_organization_get_subscription 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_organization_get_subscription --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_organization_post_subscription 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_organization_post_subscription --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_organization_import 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_organization_import --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_policies_get 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_policies_get --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_policies_put 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_policies_put --json

Parameter	Type	Required	Description
No parameters.

bitwarden.bitwarden_policies_list 0 parameters

Schema command

kosmo integrations:schema bitwarden.bitwarden_policies_list --json

Parameter	Type	Required	Description
No parameters.

Permissions

Headless calls still follow the integration read/write permission policy. Configure read/write defaults with integrations:configure. Add --force only for trusted automation that should bypass that policy.