Warden MCP Server
The Warden MCP Server enables programmatic management of Bitwarden/Vaultwarden password vaults through the Model Context Protocol, allowing LLM agents and automation tools to securely interact with vault items without implementing client-side cryptography (backed by the official Bitwarden CLI).
Vault Item Management
Search, retrieve, create, update, delete, restore, and bulk-manage vault items (logins, secure notes, cards, identities, SSH keys)
Set/merge URIs, custom fields, and attachments on login items
Secret & Credential Retrieval
Get usernames, passwords, TOTP codes, notes, URIs, and password history
Sensitive fields are redacted by default; use
reveal: trueto expose themCheck if a password has been exposed in a data breach
Folder & Organization Management
Full CRUD on personal folders
List organizations and collections; create, edit, delete org collections; move items to organizations
Attachment Handling
Create, delete, and download file attachments (base64-encoded)
Bitwarden Sends
List, create (text or file), edit, set/remove passwords, delete, and receive Sends from URLs
Generation & Utilities
Generate passwords/passphrases and usernames with customizable parameters
Base64-encode strings, check vault status (locked/unlocked), sync vault, get SDK version
Security Controls
Forced redaction (
NOREVEAL), read-only mode (READONLY), session guardrails, and network isolation support
Deployment Flexibility
stdiomode for local single-tenant use orHTTPmode for shared multi-tenant access; Docker supportedDesigned to integrate with browser-capable LLM agents for end-to-end authenticated workflows (e.g., logging into websites using retrieved credentials and TOTP codes)
Enables programmatic management of Bitwarden vaults, allowing agents to create, search, read, update, and move vault items, manage attachments, and handle organization or collection operations.
Enables programmatic management of Vaultwarden vaults, allowing agents to create, search, read, update, and move vault items, manage attachments, and handle organization or collection operations.
warden-mcp
Vaultwarden / Bitwarden MCP server for credential-aware AI agents.
warden-mcp lets MCP clients search, create, update, move, and read
Vaultwarden or Bitwarden vault items through the official Bitwarden CLI (bw).
It is built for agents and automation that need credentials, TOTP codes, secure
notes, attachments, Sends, folders, organizations, and collections without
re-implementing Bitwarden client-side crypto.
Use it when an agent needs to log in to real systems during a browser or admin workflow, but you do not want passwords hardcoded in prompts, config files, or one-off scripts.
Quick Start
Use stdio mode when a local MCP host launches the server directly. It is the simplest and most portable setup for desktop agents.
Prerequisites:
Node.js 22.x
npm 10.x
a Vaultwarden or Bitwarden account
either a Bitwarden API key pair or username/password login
Run the server:
BW_HOST=https://vaultwarden.example.com \
BW_CLIENTID=user.xxxxx \
BW_CLIENTSECRET=xxxxx \
BW_PASSWORD='your-master-password' \
npx -y @icoretech/warden-mcp@latest --stdioUsername login also works:
BW_HOST=https://vaultwarden.example.com \
BW_USER=user@example.com \
BW_PASSWORD='your-master-password' \
npx -y @icoretech/warden-mcp@latest --stdioIf the package is useful, star the repository so other agent builders can find it.
Related MCP server: VaultBridge
Install In MCP Hosts
Most local hosts should use stdio. The examples below use API-key auth; replace
BW_CLIENTID and BW_CLIENTSECRET with BW_USER if you prefer username login.
Claude Code
claude mcp add-json warden '{"command":"npx","args":["-y","@icoretech/warden-mcp@latest","--stdio"],"env":{"BW_HOST":"https://vaultwarden.example.com","BW_CLIENTID":"user.xxxxx","BW_CLIENTSECRET":"xxxxx","BW_PASSWORD":"your-master-password"}}'Codex
codex mcp add warden \
--env BW_HOST=https://vaultwarden.example.com \
--env BW_CLIENTID=user.xxxxx \
--env BW_CLIENTSECRET=xxxxx \
--env BW_PASSWORD='your-master-password' \
-- npx -y @icoretech/warden-mcp@latest --stdioCodex TOML config:
[mcp_servers.warden]
command = "npx"
args = ["-y", "@icoretech/warden-mcp@latest", "--stdio"]
startup_timeout_sec = 30
[mcp_servers.warden.env]
BW_HOST = "https://vaultwarden.example.com"
BW_CLIENTID = "user.xxxxx"
BW_CLIENTSECRET = "xxxxx"
BW_PASSWORD = "your-master-password"startup_timeout_sec = 30 gives npx enough time for a cold first launch.
Cursor, Claude Desktop, And JSON Config Hosts
{
"mcpServers": {
"warden": {
"command": "npx",
"args": ["-y", "@icoretech/warden-mcp@latest", "--stdio"],
"env": {
"BW_HOST": "https://vaultwarden.example.com",
"BW_CLIENTID": "user.xxxxx",
"BW_CLIENTSECRET": "xxxxx",
"BW_PASSWORD": "your-master-password"
}
}
}
}Common locations:
Host | Config file |
Cursor |
|
Claude Desktop |
|
Codex |
|
Why Use It
Agent login flows - fetch usernames, passwords, and TOTP codes during real browser automation without storing secrets in the agent prompt
Safe by default - secret fields stay redacted unless a tool supports
reveal: trueand the client explicitly asks for itVault administration - create, update, move, restore, and delete common Bitwarden item types, folders, organization collections, attachments, and Sends
Shared HTTP mode - one long-running service can front multiple vault hosts or identities through per-request
X-BW-*headersText-only client support - safe identifiers are mirrored into text output for MCP hosts that ignore
structuredContentVaultwarden-first CI - the integration suite exercises real local Vaultwarden and
bwauth/session flows, not only mocked SDK behavior
How It Works
flowchart LR
Agent["AI agent or MCP client"] --> Transport["stdio or Streamable HTTP"]
Transport --> Server["warden-mcp"]
Server --> BW["Bitwarden CLI (bw)"]
BW --> Vault["Vaultwarden or Bitwarden"]
Server --> State["per-profile bw state"]warden-mcp shells out to bw and keeps profile state under
KEYCHAIN_BW_HOME_ROOT. In HTTP mode, profile selection and credentials come
from request headers. In stdio mode, credentials are loaded from BW_* env vars
when the process starts.
The HTTP server exposes:
Endpoint | Purpose |
| liveness check; does not validate vault credentials |
| session and runtime guardrail metrics |
| MCP Streamable HTTP endpoint |
Run As A Shared HTTP Service
HTTP mode is useful when one service should serve multiple clients or multiple vault profiles.
Start the server:
npx -y @icoretech/warden-mcp@latestVerify liveness:
curl -fsS http://localhost:3005/healthzMCP tool calls must include these headers unless env fallback is explicitly enabled:
Header | Meaning |
| HTTPS origin only, for example |
| master password used to unlock the vault |
| Bitwarden API key client id |
| Bitwarden API key client secret |
| username/email alternative to API key login |
| optional unlock interval in seconds; default |
Example HTTP MCP config for hosts that support custom headers:
{
"mcpServers": {
"warden": {
"url": "http://localhost:3005/sse?v=2",
"headers": {
"X-BW-Host": "https://vaultwarden.example.com",
"X-BW-ClientId": "user.xxxxx",
"X-BW-ClientSecret": "xxxxx",
"X-BW-Password": "your-master-password"
}
}
}
}Some browser-hosted MCP clients can connect to an HTTP/SSE endpoint but cannot
send custom X-BW-* headers. For those clients, run a single-tenant HTTP server
with env fallback:
BW_HOST=https://vaultwarden.example.com \
BW_CLIENTID=user.xxxxx \
BW_CLIENTSECRET=xxxxx \
BW_PASSWORD='your-master-password' \
KEYCHAIN_ALLOW_ENV_FALLBACK=true \
npx -y @icoretech/warden-mcp@latestOnly use KEYCHAIN_ALLOW_ENV_FALLBACK=true behind a trusted network boundary.
Every client that can reach the endpoint inherits the configured vault identity.
For hosted clients that require HTTPS, put a reverse proxy, private tunnel, VPN,
or equivalent protected endpoint in front of warden-mcp, then connect to:
https://warden-mcp.example.com/sse?v=2Docker
docker run --rm \
-p 127.0.0.1:3005:3005 \
-v warden-mcp-data:/data \
ghcr.io/icoretech/warden-mcp:latestThe production image runs as the non-root node user with uid/gid 1000, sets
HOME=/data, and stores Bitwarden profile state under /data/bw-profiles by
default. If you use a bind mount, make it writable by uid/gid 1000.
Runtime Requirements
warden-mcp requires Node.js 22.x and npm 10.x when running from npm or source.
The Docker image includes the supported Node runtime.
The server resolves bw in this order:
BW_BIN, when setbundled
@bitwarden/clidependencysystem
bwfromPATH
The bundled @bitwarden/cli version is currently 2026.8.0. This project keeps
that version vetted instead of blindly tracking every upstream release, because
auth and unlock behavior can change in ways that break automation.
If bw is missing, install the CLI explicitly or point BW_BIN to a known
binary:
npm install -g @bitwarden/cli@2026.8.0
BW_BIN=/absolute/path/to/bw npx -y @icoretech/warden-mcp@latest --stdioSecurity Model
There is no built-in authentication layer in v1. Protect the transport before you expose it.
Bind locally by default - use
WARDEN_MCP_HOST=127.0.0.1, Docker-p 127.0.0.1:3005:3005, a firewall, VPN, or an authenticated reverse proxyUse TLS for HTTP mode -
X-BW-*headers carry vault credentialsAvoid env fallback on shared networks -
KEYCHAIN_ALLOW_ENV_FALLBACK=truemakes server-side vault credentials available to headerless clientsUse read-only mode when writes are not needed -
READONLY=trueorKEYCHAIN_READONLY=truehides mutating tools and rejects direct write callsUse no-reveal mode for untrusted agent contexts -
NOREVEAL=trueorKEYCHAIN_NOREVEAL=trueforces all secret-returning tools to stay redactedKeep debug logs off in production - do not enable
KEYCHAIN_DEBUG_BWorKEYCHAIN_DEBUG_HTTPunless actively troubleshootingRestrict profile storage - protect
KEYCHAIN_BW_HOME_ROOT, which stores localbwprofile stateProtect
/metricszif needed - it is unauthenticated for scraper compatibility and exposes runtime/session counters
Redacted fields include login passwords, TOTP seeds/codes, card numbers and codes, identity SSNs/passport/license numbers, hidden custom fields, SSH private keys stored through the secure-note convention, signed attachment URLs, and password history entries.
Configuration
Variable | Default | Purpose |
|
| HTTP listen port |
| all interfaces | HTTP bind host |
|
| force stdio mode without |
|
| advertised MCP server name |
|
| public tool namespace |
|
| public tool separator; set |
|
| root for per-profile |
|
| allow HTTP calls to inherit server |
|
| run |
|
| hide and reject mutating tools |
|
| force |
| unset | set |
|
| max tracked HTTP sessions |
|
| inactive session TTL |
|
| session cleanup interval |
|
| memory fuse; set |
|
| periodic metrics logging; |
KEYCHAIN_TEXT_COMPAT_MODE=structured_json mirrors supported
structuredContent into plain text. That helps MCP clients that only pass
content[] to the model, but any revealed secret will also appear in the text
transcript.
Tool Reference
Tool names default to keychain_*. Change the prefix with TOOL_PREFIX and the
separator with TOOL_SEPARATOR.
Start with these:
keychain_status- inspect rawbwstatuskeychain_sync- pull latest vault data withbw synckeychain_search_items- find items by name, URI, username, folder, collection, or typekeychain_get_item- read a full item by id, redacted by defaultkeychain_get_username,keychain_get_password,keychain_get_totp- fetch common login values; password and TOTP requirereveal: truekeychain_create_login,keychain_update_item,keychain_move_item_to_organization- common write paths
Full tool groups:
Group | Tools |
Vault/session |
|
Items |
|
Folders |
|
Organizations and collections |
|
Attachments |
|
Sends |
|
Direct |
|
Notes:
keychain_create_loginscreates several independent login items in one call and reports per-item failures without aborting the whole batchkeychain_set_login_urisreplaces or merges a login item's URI list without editing the entire item payloadkeychain_delete_itemssupports bulk soft-delete or hard-delete by idkeychain_get_itemexposes safe attachment metadata, includingid,fileName, and size, while redacting signed download URLskeychain_get_attachmentaccepts an attachment id or an unambiguous filename and returns{ filename, bytes, contentBase64 }keychain_send_getreturns owned Send metadata and text content; usekeychain_receivewith a SendaccessUrlto receive shared Sends or download file Send bytesAmbiguous login lookups return
AMBIGUOUS_LOOKUPwith visible candidate ids; retry with the exact item id
Local Development
Use Docker Compose when you need the full Vaultwarden-backed stack.
cp .env.example .env
make upmake up starts local Vaultwarden, an HTTPS proxy for bw, bootstraps a test
account, and runs the MCP server in the foreground.
Useful commands:
Command | Purpose |
| watch-mode server from source |
| compile TypeScript to |
| run the compiled server |
| Biome autofix plus |
| build, then run all compiled tests |
| build, then run compose-backed integration tests |
| build, then run Node test coverage |
| run the compose-backed Vaultwarden integration path |
| run the organization-focused compose stack |
| stop the local compose stack |
For a quick live MCP smoke against local Vaultwarden, see agent-instructions/testing.md.
Compatibility
Vaultwarden is the continuously proven target in CI. Official Bitwarden compatibility is intended, but it is not continuously proven without a real Bitwarden tenant.
@bitwarden/cli upgrades are treated as compatibility decisions. The suite
checks direct bw auth behavior, SDK behavior, and MCP integration behavior
against a local Vaultwarden instance before a CLI bump should ship.
Known Limitations
bw list items --search, and thereforekeychain_search_items, does not reliably search inside custom field valuesSSH keys are stored as secure notes with standard fields until
bwsupports native SSH key item creationhigh-risk
bwfeatures such as export/import are intentionally not exposedVaultwarden report pages are not mirrored as MCP tools; the current report-like helper is
keychain_get_exposed
Project Links
npm package:
@icoretech/warden-mcpDocker image:
ghcr.io/icoretech/warden-mcpChangelog: CHANGELOG.md
Security policy: SECURITY.md
Threat model: THREAT_MODEL.md
Repository guidance: AGENTS.md
Contributing
Issues and PRs are welcome. Run npm run lint and the relevant test command
before opening a PR; use make test when behavior depends on real Vaultwarden
or bw interaction.
License
Available Tools
53 toolskeychain_create_attachmentCreate AttachmentA
Attach base64-encoded file bytes to an existing item. Returns the updated item summary with normal redaction rules, so secrets stay hidden unless reveal is allowed.
| Name | Required | Description | Default |
|---|---|---|---|
| itemId | Yes | Parent Bitwarden item id for attachment or item-specific operations. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. | |
| filename | Yes | Visible attachment or send filename stored in Bitwarden metadata. | |
| contentBase64 | Yes | Base64-encoded file bytes, not a filesystem path. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false and destructiveHint=false, so the tool is a non-destructive mutation. The description adds valuable context: it returns the updated item summary with redaction rules (secrets hidden unless reveal is allowed), and explicitly ties to the reveal parameter. This goes beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and resource. Every clause adds value: attaching bytes, return format, redaction rule. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, the description covers core behavior (attach, return summary with redaction) and mentions the reveal parameter. However, it omits edge cases like non-existent items or size limits, which are minor given the schema and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds meaning by explaining that contentBase64 is not a filesystem path and that reveal controls secret redaction. It links the return behavior to the reveal parameter, enriching understanding beyond schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's action: attaching base64-encoded file bytes to an existing item. It specifies the resource (existing Bitwarden item) and distinguishes from sibling tools like keychain_get_attachment or keychain_delete_attachment by focusing on creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for attaching files to items but does not provide explicit guidance on when to use this tool versus alternatives like keychain_get_attachment or keychain_delete_attachment. No when-not or alternative tools are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_cardCreate CardA
Create a payment card item. Use this for cardholder name, brand, number, expiry, and code, not for login credentials or notes. Accepts custom fields plus folder/organization/collection scoping, and returned summaries redact the card number, code, and hidden fields.
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | Card security code or CVV. | |
| name | Yes | Display name for the payment card item. | |
| brand | No | Card brand, such as visa or mastercard. | |
| notes | No | Optional note text stored on the item. | |
| fields | No | Custom fields to store on the item. Hidden fields are redacted in summaries. | |
| number | No | Primary card number to store on the card. | |
| expYear | No | Card expiration year. | |
| expMonth | No | Card expiration month. | |
| favorite | No | Mark the item as a favorite when true. | |
| folderId | No | Personal folder id, not an organization collection id. | |
| collectionIds | No | Bitwarden collection ids, not folder ids. | |
| cardholderName | No | Cardholder name to store on the card. | |
| organizationId | No | Bitwarden organization id; used for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint=false, destructiveHint=false), the description adds key behavior: returned summaries redact card number, code, and hidden fields. No contradiction. Useful for an agent to understand data exposure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences, front-loaded with purpose, then guidelines, then behavioral note. No wasted words; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage, scoping, and redaction behavior. Lacks explicit mention of return value format (no output schema), but redaction hint helps. Adequate for a creation tool with many parameters and siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline 3. Description adds context like mapping to 'cardholder name, brand, number, expiry, and code' and mentions redaction of hidden fields, but does not significantly deepen per-parameter understanding beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a payment card item' and lists specific data fields (cardholder name, brand, number, expiry, code), distinguishing it from login credentials or notes. Sibling tools like keychain_create_login and keychain_create_note confirm differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('Use this for cardholder name...') and when not to use ('not for login credentials or notes'). Provides context on scoping (folder/organization/collection) but does not give detailed alternatives or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_folderCreate FolderA
Create a personal Bitwarden folder. Use this to organize items outside organization collections.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Display name for the personal folder. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=false and readOnlyHint=false. The description adds 'Create' which aligns with write behavior, but provides no additional behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, and contains no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple creation tool with one parameter and no output schema, the description adequately explains its purpose and distinguishes from related sibling tools. Annotations cover behavioral safety.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter, and the description does not add meaning beyond the schema's description of 'name' as the display name. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Create') and resource ('personal Bitwarden folder'), and distinguishes it from organization collections, which is a sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context by specifying 'outside organization collections', implying when to use this tool versus keychain_create_org_collection, though it does not explicitly list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_identityCreate IdentityA
Create an identity item. Use this for personal, contact, and address data instead of a login or card. Accepts structured identity fields plus custom fields and scoping, and returned summaries redact sensitive identity fields and hidden custom fields.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Display name for the identity item. | |
| notes | No | Optional note text stored on the item. | |
| fields | No | Custom fields to store on the item. Hidden fields are redacted in summaries. | |
| favorite | No | Mark the item as a favorite when true. | |
| folderId | No | Personal folder id, not an organization collection id. | |
| identity | No | Structured identity profile data to store on the item. | |
| collectionIds | No | Bitwarden collection ids, not folder ids. | |
| organizationId | No | Bitwarden organization id; used for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds context beyond annotations: summaries redact sensitive fields and hidden custom fields. Annotations only say not read-only and not destructive, so this is useful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no redundancy. First sentence states purpose, second adds behavioral detail. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but description notes redaction behavior. Covers key aspects given complexity, though could detail return format more. Schema fills in parameter details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed descriptions, so baseline is 3. Description mentions 'structured identity fields plus custom fields and scoping' but adds little extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Create an identity item' with verb and resource. Distinguishes from siblings by specifying 'instead of a login or card.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use for personal/contact/address data and not for login or card. Provides alternative tool types but lacks when-not-to-use or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_loginCreate LoginA
Create a login item with username/password/TOTP/URI data. Use this for website or app credentials instead of a secure note, card, or identity. Accepts custom fields and attachments, supports folder/organization/collection scoping, and returns a redacted item summary by default.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Display name for the login item. | |
| totp | No | TOTP secret or otpauth value for the login item. | |
| uris | No | URI entries to store or update on the login item. | |
| notes | No | Optional free-form notes for the login item. | |
| fields | No | Custom fields to store on the item. Hidden fields are redacted in summaries. | |
| favorite | No | Mark the item as a favorite when true. | |
| folderId | No | Personal folder id, not an organization collection id. | |
| password | No | Password to store on the login item. | |
| username | No | Login username or email address. | |
| attachments | No | Attachments to add to the item. | |
| collectionIds | No | Bitwarden collection ids, not folder ids. | |
| organizationId | No | Bitwarden organization id; used for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds that the tool returns a redacted item summary by default, which supplements the annotations (readOnlyHint=false, destructiveHint=false). No contradictions. However, it does not disclose other behavioral aspects like permission requirements or side effects, so additional context beyond annotations is limited.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences) and well-structured: first sentence states the core action and data types, second provides usage guidance and lists additional capabilities. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (12 parameters, no output schema), the description covers the primary inputs and return behavior. It lacks details on error handling or validation, but for a creation tool with well-documented schema, it is fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with descriptions for all 12 parameters. The description does not add significant additional meaning beyond what the schema provides, justifying the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a login item with specific data types (username, password, TOTP, URI) and explicitly distinguishes it from other item types like secure note, card, or identity. This provides clear purpose and differentiation from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises using this for website/app credentials instead of other item types, providing clear context for when to use the tool. It lacks explicit guidance on when not to use it, but the positive direction is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_loginsCreate LoginsA
Create multiple login items in one call. Use this when you need several independent credentials at once, with the same login-item behavior as create_login. Set continueOnError to keep going after a failure and receive per-item ok/error results; returned items are redacted by default.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Login item payloads to create; each item follows create_login fields and returns its own ok/error result. | |
| continueOnError | No | Continue after failures and return per-item ok/error results when true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint=false and destructiveHint=false, indicating writes. The description adds that returned items are redacted by default and that continueOnError yields per-item ok/error results. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core purpose, and contains no filler. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 2 parameters, no output schema, and high schema coverage, the description covers batch creation, behavioral similarity to create_login, continueOnError, and redaction. Could elaborate on output format, but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents parameters well. The description adds behavioral context (e.g., per-item results, redaction) but does not significantly enrich the meaning of individual fields beyond what's in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates multiple login items in one call and references the same behavior as create_login. It distinguishes itself from sibling keychain_create_login by specifying batch creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using this tool for several independent credentials at once and explains the continueOnError feature for per-item results. While it effectively signals when to use it, it could more explicitly contrast with single-item creation or mention when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_noteCreate NoteA
Create a secure note item. Use this for free-form text or secrets that do not belong in a login, card, identity, or SSH key item. Accepts custom fields plus folder/organization/collection scoping, and returns a redacted item summary by default.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Display name for the secure note item. | |
| notes | No | Optional note text stored on the item. | |
| fields | No | Custom fields to store on the item. Hidden fields are redacted in summaries. | |
| favorite | No | Mark the item as a favorite when true. | |
| folderId | No | Personal folder id, not an organization collection id. | |
| collectionIds | No | Bitwarden collection ids, not folder ids. | |
| organizationId | No | Bitwarden organization id; used for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only and non-destructive. Description adds behavioral context: returns a redacted item summary by default. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and usage, then features and return behavior. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage, accepted parameters, and return value despite no output schema. Parameter count and schema descriptions are sufficient. Minor omission: no error or idempotency info, but acceptable for a create tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description summarizes parameters (custom fields, scoping) but adds no new semantic detail beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it creates a secure note item and distinguishes from siblings by listing what it is not for (login, card, identity, SSH key). Verb and resource are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use for free-form text or secrets that do not belong in other item types, implying alternatives. Does not name sibling tools directly but gives clear use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_org_collectionCreate Org CollectionA
Create a new organization-scoped collection inside the required organizationId. Use this for shared vault grouping; returns the created collection summary.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Display name for the organization collection. | |
| organizationId | Yes | Bitwarden organization id; required for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the tool is not read-only (destructiveHint=false) and not destructive (destructiveHint=false). The description adds no further behavioral traits beyond stating it returns a summary, which is sufficient but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys purpose, usage hint, and return value, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With two required parameters and no output schema, the description covers purpose, usage context, and what is returned, making it complete for this simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to add much. It mentions 'inside the required organizationId' but that repeats the schema. No new semantics added beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Create' and the resource 'organization-scoped collection', and distinguishes from sibling tools like keychain_create_folder by specifying 'organization-scoped'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says 'Use this for shared vault grouping', providing clear context for when to use. It does not explicitly state when not to use or mention alternatives, but the specificity is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_create_ssh_keyCreate SSH KeyA
Create an SSH key object stored as a secure note with standard fields. Use this when you need a public/private key pair plus optional fingerprint or comment, not a login or payment card. The private key is stored in a hidden field and redacted in returned summaries; folder, organization, and collection scoping is supported.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Display name for the SSH key item. | |
| notes | No | Optional note text stored on the item. | |
| comment | No | Optional SSH key comment or label. | |
| favorite | No | Mark the item as a favorite when true. | |
| folderId | No | Personal folder id, not an organization collection id. | |
| publicKey | Yes | SSH public key material to store on the item. | |
| privateKey | Yes | SSH private key material to store on the item. | |
| fingerprint | No | Optional SSH key fingerprint. | |
| collectionIds | No | Bitwarden collection ids, not folder ids. | |
| organizationId | No | Bitwarden organization id; used for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are minimal (non-read-only, non-destructive). Description adds crucial info: private key hidden field, redacted in summaries, and scoping support, which annotations lack.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences pack purpose, usage guidance, and key behavioral note without fluff. Front-loaded with primary action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but description covers essential points: creation, scope, private key handling. Could mention that it does not generate keys, but not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with descriptions. Description adds value by explaining behavior of privateKey (hidden/redacted) and role of scoping parameters, going beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool creates an SSH key object stored as a secure note, and differentiates from login or payment card types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use (need public/private key pair) and what not to use (not login or payment card). Could mention alternatives like other create tools but sibling context is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_delete_attachmentDelete AttachmentADestructive
Delete an attachment from its parent item using itemId plus attachmentId. The attachment id comes from item attachment metadata; this is destructive for that attachment and then refetches the parent item. Returns the updated item summary with normal redaction rules.
| Name | Required | Description | Default |
|---|---|---|---|
| itemId | Yes | Parent Bitwarden item id for attachment or item-specific operations. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. | |
| attachmentId | Yes | Attachment id returned by item metadata, or an unambiguous filename selector for downloads. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds valuable behavioral context beyond annotations (destructiveHint=true): explains that the action is destructive, refetches the parent item, and returns updated summary with redaction. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with action and key details. No extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers action, parameters, behavior, and return type. Minor gaps: no mention of error conditions or prerequisites (e.g., permissions). Still sufficient for a delete tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, providing detailed parameter descriptions. Description mentions itemId and attachmentId but does not significantly add meaning beyond schema. The optional 'reveal' parameter is not explained in description, but schema covers it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb (delete), resource (attachment), and required identifiers (itemId and attachmentId). Differentiates from sibling tools like keychain_get_attachment and keychain_create_attachment by specifying destructive nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear context provided: delete an attachment with specific IDs. Implicitly indicates use when deletion is needed, but does not explicitly exclude alternative actions or mention when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_delete_folderDelete FolderADestructive
Delete a personal Bitwarden folder. Destructive: there is no restore helper in this server.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already indicate destructiveHint=true. The description adds valuable context by explicitly stating 'there is no restore helper in this server,' which goes beyond the annotation by explaining the lack of recovery mechanism. This is a helpful behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with a critical warning, achieving maximum conciseness. Every word adds value, and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple delete operation with one parameter and no output schema, the description covers the core purpose and the irreversible nature. It does not explain return values (unnecessary) or provide additional context about the folder hierarchy, but what is provided is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter 'id' with a clear description. Schema coverage is 100%, so the description does not need to add more. The description adds no additional parameter information, baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Delete a personal Bitwarden folder,' which is a specific verb+resource. The tool name and title align perfectly, and it is distinct from sibling delete tools like keychain_delete_item or keychain_delete_attachment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions that the operation is destructive and irreversible ('no restore helper'), which provides some usage context. However, it does not explicitly state when to use this tool versus alternatives (e.g., editing or moving items), nor does it specify prerequisites or conditions for use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_delete_itemDelete ItemADestructive
Delete a vault item by id. By default this is a soft delete to trash and can be restored with restore_item; set permanent=true to hard delete through bw. Returns only the requested id, not the deleted item contents.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| permanent | No | Hard delete immediately when true; omit or false to soft-delete to trash. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that default is soft delete to trash, recoverable via restore_item, and that permanent=true performs hard delete. Also states that only the id is returned, not the item contents. Aligns with annotations (destructiveHint=true) and adds useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no extraneous information. Key details are front-loaded ('Delete a vault item by id'). Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, description explains return value (only id, not contents). Also mentions recovery option (restore_item) and distinguishes soft/hard delete. Context is complete for a delete tool with two modes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers both parameters (id, permanent) and description adds meaning: explains id's source (from list/search/get/create) and permanent's effect (hard delete vs soft). Schema coverage is 100%, but description provides additional context beyond field names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Delete a vault item by id' and distinguishes soft vs hard delete. It specifies resource (vault item) and action (delete), differentiating from sibling tools like keychain_delete_attachment, keychain_delete_folder, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly explains when to use soft delete (default) vs hard delete (permanent=true) and mentions restore_item for recovery. Provides clear context but does not explicitly contrast with bulk deletion alternatives like keychain_delete_items.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_delete_itemsDelete ItemsADestructive
Delete multiple vault items by id in one session. Soft-deletes to trash by default; set permanent=true to hard delete every id. Returns per-id ok/error results so partial failures are visible.
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes | Vault item ids to delete; returns one result per id. | |
| permanent | No | Hard delete each id immediately when true; omit or false to soft-delete to trash. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (destructiveHint=true) indicate mutation, but description adds beyond: default soft-delete, permanent hard-delete option, and per-id result reporting. This provides useful behavioral context not captured in annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, then details on optional behavior and return format. No unnecessary words; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, description sufficiently explains return structure (per-id results). Covers default behavior, optional permanent delete, and batch scope. No missing critical information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. Description reinforces and slightly extends schema: adds context about session and partial failures, but schema already describes parameters well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb (delete) and resource (vault items) with batch scope. Distinguishes from siblings like keychain_delete_item (single) and keychain_delete_attachment (different resource). Mention of soft-delete vs hard delete further clarifies behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes when to use: for multiple items in one session. Notes permanent option for hard delete. Does not explicitly exclude alternatives, but context from sibling tools implies single-item deletes use a different tool. Clear context provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_delete_org_collectionDelete Org CollectionADestructive
Delete an organization collection. Destructive: there is no restore helper in this server.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| organizationId | Yes | Bitwarden organization id; required for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds important context beyond annotations: explicitly warns that deletion is irreversible with 'no restore helper', which is not captured by the destructiveHint annotation alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. First sentence states purpose, second adds critical warning. Efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main purpose and destructive behavior. Could mention permission requirements, but the description is adequate given tool simplicity and no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. Description does not add any additional parameter meaning beyond what schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Delete an organization collection' with specific verb and resource. Distinguishes from sibling tools like keychain_create_org_collection and keychain_edit_org_collection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, or when not to use it. Only mentions destructive nature but no comparisons with other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_edit_folderEdit FolderA
Rename an existing personal Bitwarden folder by id. This mutates only folder metadata, not the items inside it, and returns the updated folder id/name summary.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| name | Yes | New display name for the personal folder. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false and destructiveHint=false. The description adds that it mutates only folder metadata and returns a summary, providing valuable behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words, front-loaded with purpose. Highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with 2 parameters and no output schema, the description provides all necessary information: what it does, what it affects, and what it returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with adequate parameter descriptions. The tool description adds 'by id' and 'new display name' context, slightly enhancing schema information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (rename), resource (folder by id), and scope (personal), distinguishing it from create/delete sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for renaming existing folders and notes it only affects metadata, not items. While no explicit alternatives are given, the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_edit_org_collectionEdit Org CollectionA
Rename an existing organization-scoped collection inside the required organizationId. This mutates collection metadata only and returns the updated collection summary.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| name | Yes | New display name for the organization collection. | |
| organizationId | Yes | Bitwarden organization id; required for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate non-read-only and non-destructive; description adds that it mutates metadata only and returns updated summary, offering useful behavioral detail beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, concise and front-loaded with the core action. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequately covers functionality, parameters, and outcome for a simple rename operation. Could mention error conditions or permissions but not necessary given simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and description adds minor context about parameters (e.g., name is new display name), but does not significantly enhance understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it renames an organization-scoped collection, clearly distinguishing it from sibling tools like create_org_collection or delete_org_collection. The verb and resource are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clarifies the operation is for renaming within a required orgId, providing necessary context. However, it does not explicitly state when not to use or compare to alternatives like editing folders.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_encodeEncodeARead-only
Base64-encode a string with bw encode. This never mutates the vault; it only returns encoded text.
| Name | Required | Description | Default |
|---|---|---|---|
| value | Yes | Plain text value to base64-encode. |
Output Schema
| Name | Required | Description |
|---|---|---|
| encoded | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reinforces the readOnlyHint annotation by stating it never mutates the vault, adding clarity that it only returns encoded text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, no superfluous words, and immediately conveys the core function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, the description, schema, and annotations together provide complete information for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds no additional meaning beyond what the schema already provides for the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool base64-encodes a string and differentiates it from sibling tools by noting it never mutates the vault.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (when encoding is needed) but does not explicitly state when not to use it or list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_generateGenerateARead-only
Generate a password or passphrase with bw generate. This never mutates the vault; pass reveal=true to return the value, and NOREVEAL or KEYCHAIN_NOREVEAL force redaction.
| Name | Required | Description | Default |
|---|---|---|---|
| words | No | Passphrase word count, between 3 and 50. | |
| length | No | Password length in characters, between 5 and 256. | |
| number | No | Include numeric digits when generating a password. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. | |
| special | No | Include special characters when generating a password. | |
| ambiguous | No | Allow ambiguous characters in generated passwords. | |
| lowercase | No | Include lowercase letters when generating a password. | |
| minNumber | No | Minimum number of digits to include. | |
| separator | No | Separator to use between words in passphrase mode. | |
| uppercase | No | Include uppercase letters when generating a password. | |
| capitalize | No | Capitalize passphrase words when supported by bw. | |
| minSpecial | No | Minimum number of special characters to include. | |
| passphrase | No | Generate a word-based passphrase instead of a password. | |
| includeNumber | No | Include a number in passphrase mode when supported by bw. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reinforces the readOnlyHint annotation by stating 'This never mutates the vault' and adds important behavior about reveal=true returning values and NOREVEAL/KEYCHAIN_NOREVEAL forcing redaction. This goes beyond the structured annotations and gives the agent critical secret-handling context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. It front-loads what the tool does, then adds the safety and reveal behavior, every sentence earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema and 100% parameter coverage, the description covers the critical behavioral aspects: read-only operation and secret redaction. It is mostly complete, though it could be improved by explicitly routing username generation to keychain_generate_username.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all 14 parameters. The description adds minor extra context around reveal and the KEYCHAIN_NOREVEAL environment variable, but it does not meaningfully explain the broader parameter set beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Generate a password or passphrase with bw generate.' This clearly distinguishes the tool from sibling keychain_generate_username by naming password/passphrase generation as its scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies this tool is for password or passphrase generation, and the sibling keychain_generate_username covers usernames, but it does not explicitly say 'use X for usernames' or provide when-not-to-use guidance. The context is clear, but there are no explicit exclusions or alternatives stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_generate_usernameGenerate UsernameARead-only
Generate a username like the Bitwarden generator (random word, plus-addressed email, catch-all, forwarded alias). This never mutates the vault; pass reveal=true to return the value, and NOREVEAL or KEYCHAIN_NOREVEAL force redaction.
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | Username generation strategy: random word, plus-addressed email, catch-all email, or forwarded alias. | |
| No | Base email address for plus-addressed username generation. | ||
| domain | No | Domain for catch-all email username generation. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. | |
| capitalize | No | Capitalize the generated random word when supported. | |
| includeNumber | No | Append a number to generated usernames when supported. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states that the tool never mutates the vault, which is valuable behavioral context consistent with the readOnlyHint annotation. It also discloses reveal behavior and redaction enforcement via NOREVEAL/KEYCHAIN_NOREVEAL, adding detail beyond the annotation alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. It front-loads the core action and strategy list, then adds the critical safety and redaction behavior without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description, combined with the full input schema, readOnlyHint annotation, and output schema, provides sufficient context for an agent to call this tool correctly. It covers the generation strategies, safety guarantees, and reveal/redaction mechanics; no critical behavior is left unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since schema description coverage is 100%, the schema already documents each parameter. The description adds meaningful context around the reveal parameter by explaining that NOREVEAL or KEYCHAIN_NOREVEAL forces redaction, and frames the type parameter through the Bitwarden generator analogy, which helps an agent select appropriate strategies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a username generator with specific strategies (random word, plus-addressed email, catch-all, forwarded alias). It does not explicitly differentiate itself from siblings like keychain_generate or keychain_get_username, though the specific 'username' focus makes the purpose reasonably distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The verb 'generate' and the strategy list imply when this tool should be used, but the description provides no explicit guidance on when to choose this tool over alternatives such as keychain_get_username or keychain_generate. It also does not state when specific parameter combinations are needed, leaving usage largely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_attachmentGet AttachmentARead-only
Download an attachment from a parent item and return raw bytes as contentBase64. Pass itemId plus an attachment id, or an unambiguous filename selector resolved from the item metadata before calling bw get attachment. The response includes filename, byte count, and base64 content for local decoding. If the expected attachment filename is missing from keychain_get_item metadata, run keychain_sync and keychain_get_item again before retrying.
| Name | Required | Description | Default |
|---|---|---|---|
| itemId | Yes | Parent Bitwarden item id for attachment or item-specific operations. | |
| attachmentId | Yes | Attachment id returned by item metadata, or an unambiguous filename selector for downloads. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that the tool returns base64 content, includes filename and byte count, and does not modify data. Aligns with readOnlyHint annotation and adds troubleshooting context for missing filenames.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, no redundant sentences. Main action is front-loaded, followed by parameter usage and a recovery hint. Every sentence adds information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, parameters, output format, and error recovery. Despite no output schema, the description provides sufficient detail for an agent to use and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Adds value beyond the schema by explaining that attachmentId can be an unambiguous filename selector and that it must be resolved from item metadata. Schema already describes both parameters clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool downloads an attachment from a parent item and returns raw bytes as base64. It specifies the action, resource, and output format, distinguishing it from create/delete attachment siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides guidance on parameter usage (itemId + attachmentId or filename selector) and a recovery step if filename missing. Does not explicitly contrast with alternatives, but covers when to use and prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_collectionGet CollectionARead-only
Get a collection by id (bw get collection). Use organizationId when you need to disambiguate an organization-scoped lookup.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| organizationId | No | Optional organization id used to disambiguate the lookup. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, so the description adds little behavioral context beyond the CLI equivalent. It does not detail error behavior, id existence handling, or performance aspects, leaving the agent with minimal extra insight.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences: the first conveys the core action, the second adds a usage hint. No redundancy, perfectly front-loaded, and every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with strong annotations and a fully described schema, the description is complete. It covers the action, optional disambiguation, and CLI reference, leaving no critical gaps for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with adequate parameter descriptions. The description reinforces the optional parameter's disambiguation purpose but adds only marginal value over the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get a collection by id' with a CLI equivalent, specifying the verb and resource. It implicitly differentiates from sibling 'get' tools by focusing on collections, but does not explicitly contrast with similar tools like keychain_list_collections.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides guidance on using organizationId for disambiguation, but does not explain when to choose this tool over alternatives (e.g., listing tools) or when not to use it. The guidance is minimal and context-limited.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_exposedGet ExposedARead-only
Check the exposed-password count returned by bw get exposed for a search term. Terms follow bw lookup behavior and may be ambiguous; use an exact item id or precise selector when possible. Not-found results return a null scalar value instead of a thrown not-found error.
| Name | Required | Description | Default |
|---|---|---|---|
| term | Yes | Search term or exact item id; exact ids avoid ambiguous bw lookups. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already signals this is a safe read operation. The description adds valuable behavioral detail beyond this: not-found results return a null scalar rather than throwing an error, and lookups may be ambiguous. This is useful context for agent error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no fluff. The primary action is stated first, followed by practical usage guidance and error behavior, each sentence earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only tool with an output schema, the description covers the purpose, lookup semantics, ambiguity caveat, and not-found behavior. Nothing critical is missing for an agent to invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the 'term' parameter. The description adds meaning by explaining that terms follow bw lookup behavior and may be ambiguous, and by recommending exact ids to avoid ambiguity, which goes beyond the schema's bare definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks the exposed-password count returned by 'bw get exposed' for a search term. This names a specific verb, resource, and result type, and the operation is distinct from sibling keychain getters.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: it checks exposed-password counts and warns that terms follow bw lookup behavior and may be ambiguous, recommending exact item ids or precise selectors. It does not explicitly name alternatives or exclusion criteria, but the tool's purpose is specific enough that the guidance is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_folderGet FolderARead-only
Get one personal Bitwarden folder by stable folder id via bw get folder. Use this to verify a folder id before item updates; returns safe folder metadata only.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, indicating a safe read operation. The description adds context by stating 'returns safe folder metadata only,' which clarifies the non-sensitive nature of the output and goes beyond the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loads the core action, and includes a usage hint without unnecessary words. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given low complexity (one param, no output schema, annotations present), the description covers purpose, usage hint, and return nature. It lacks mention of error handling (e.g., invalid id), but that is minor for this simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with a description for the 'id' parameter. The description adds the nuance that the id is 'stable', which is not in the schema, helping the agent understand the identifier's persistence.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get one personal Bitwarden folder') and the resource ('by stable folder id'), distinguishing it from sibling tools like list_folders or create_folder. The verb 'get' and resource 'folder' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a concrete usage scenario: 'Use this to verify a folder id before item updates.' This tells the agent when to invoke the tool, though it does not explicitly exclude scenarios where other tools (e.g., list_folders) would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_itemGet ItemARead-only
Get the full vault item by stable item id. Secret fields and signed attachment URLs are redacted by default; pass reveal=true only when the caller is allowed to receive secrets. When attachments are present, use keychain_get_attachment with this item id plus the listed attachment id or filename to download file bytes. If an expected recently-added attachment is missing, run keychain_sync and call keychain_get_item again before retrying.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that secrets and signed attachment URLs are redacted by default, and that reveal=true can return secrets when permitted. Also explains attachment retrieval workflow. Annotations already declare readOnlyHint=true, and description does not contradict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three focused sentences: first states purpose, second explains reveal, third details attachment handling. No wasted words, front-loaded with main action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequately covers key behaviors (redaction, attachments, sync), but without an output schema, it lacks description of the returned item structure or fields. Could be more complete for a retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, providing baseline of 3. The description adds value by explaining the reveal parameter's permission context ('pass reveal=true only when the caller is allowed to receive secrets'), going beyond the schema's description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('get') and resource ('full vault item by stable item id'), and distinguishes from sibling tools like keychain_get_attachment by explaining when to use that tool instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use keychain_get_attachment and keychain_sync as alternatives, and mentions the reveal parameter's use. Lacks a direct 'when not to use' statement but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_notesGet NotesARead-only
Get item notes matched by bw get notes for a search term. Notes are treated as secret output here: value is null unless reveal=true and NOREVEAL is not active. Terms can be ambiguous, so prefer an exact item id when possible.
| Name | Required | Description | Default |
|---|---|---|---|
| term | Yes | Search term or exact item id; exact ids avoid ambiguous bw lookups. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
ReadOnlyHint is already present, and the description adds meaningful behavior beyond it: notes are treated as secret output, value is null unless reveal=true, and NOREVEAL can force redaction. This is valuable disclosure for an agent deciding whether secrets will be exposed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three focused sentences, front-loaded with purpose, followed by important secret-handling nuance and a clear usage tip. Every sentence earns its place and nothing feels redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with full schema coverage, an output schema, and readOnly annotation, the description is nearly complete. It covers purpose, secret behavior, and ambiguity guidance; only a named sibling alternative or explicit non-use condition is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds practical parameter meaning: exact ids avoid ambiguous bw lookups, and reveal=true can still be overridden by NOREVEAL. This goes beyond the schema's descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb+resource: 'Get item notes' with search-term matching. It is clear and distinct from the clustered get_* siblings because it targets notes, but it does not explicitly differentiate itself from those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides practical context: terms can be ambiguous and exact item ids are preferred. However, it does not explicitly state when to use this tool versus alternatives such as keychain_get_item, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_organizationGet OrganizationARead-only
Get one Bitwarden organization by stable organization id via bw get organization. Use list_organizations first when the id is unknown; returns organization metadata only.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation indicates readOnlyHint true, and the description adds that the tool 'returns organization metadata only', clarifying the scope of output. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no fluff. The purpose is stated first, followed by usage guidance. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input (one parameter), no output schema, and the need to differentiate from list_organizations, the description is complete. It covers what, how, and return type.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the parameter description already explains the ID's origin. The description repeats 'by stable organization id' but adds no new semantic detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets a single Bitwarden organization by its stable ID, using the 'bw get organization' command. It distinguishes itself from sibling tools like 'list_organizations' and creation/deletion tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises to use 'list_organizations' first when the ID is unknown, providing clear guidance on when to use this tool versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_org_collectionGet Org CollectionARead-only
Get an organization collection by id (bw get org-collection). organizationId is optional and narrows the org-scoped lookup when provided.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| organizationId | No | Optional organization id used to disambiguate the org collection lookup. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, indicating safe read. The description adds that the lookup is org-scoped and organizationId is optional, but does not disclose error behavior or other traits beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that are front-loaded with purpose and include a clarifying note. No wasted words; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 params, no output schema, read-only), the description covers the essential purpose and parameter role. It omits error handling or return value details, but for a get-by-id tool, this is generally acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds little beyond the schema: 'organizationId is optional and narrows the org-scoped lookup' essentially repeats the schema description. No new parameter semantics are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get an organization collection by id', specifying the verb and resource. It distinguishes from sibling tools like keychain_get_collection (non-org) and keychain_list_org_collections (list vs single get).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (when you have an id), but does not explicitly state when to use this tool vs alternatives like keychain_get_collection or when-not scenarios. No exclusions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_passwordGet PasswordARead-only
Get a login password by search term (bw get password). The value is null unless reveal=true, and NOREVEAL or KEYCHAIN_NOREVEAL can still force redaction.
| Name | Required | Description | Default |
|---|---|---|---|
| term | Yes | Search term or exact item id used for bw get password. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses important runtime behavior beyond the readOnlyHint annotation: the value is null unless reveal=true, and NOREVEAL/KEYCHAIN_NOREVEAL can force redaction. This is essential, non-obvious behavioral context for a secret-retrieval tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler. The core action is front-loaded, and the critical caveat about reveal/redaction is included without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter getter with an output schema and readOnlyHint annotation, the description is nearly complete. The only gap is explicit guidance on when to choose this over closely related sibling getters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents both parameters well. The description adds value by clarifying the null-result behavior when reveal is false, which goes slightly beyond the schema's phrasing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Get a login password by search term', and references the underlying 'bw get password' command. This clearly distinguishes it from sibling getters like keychain_get_password_history or keychain_get_item.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for retrieving a login password via a search term or ID, but it does not explicitly state when to prefer this over alternatives such as keychain_get_item or keychain_get_password_history. Usage context is present but left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_password_historyGet Password HistoryARead-only
Get an item password history (if any). Returning passwords requires reveal=true.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds value beyond the readOnlyHint annotation by noting that returning passwords requires reveal=true. This is important behavioral context that helps the agent understand the parameter's effect and potential security implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of two short sentences that directly convey the purpose and a key behavioral note. There is no superfluous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists, the description does not need to detail return values. The tool's purpose is simple, and the description covers the essential behavioral note about reveal. It could be improved by hinting at what happens when no history exists, but it is still adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides detailed descriptions for both parameters, with 100% coverage. The description's mention of reveal=true adds no new information beyond what the schema states, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and the resource ('item password history'), which is specific and well-defined. However, it does not explicitly differentiate this tool from sibling tools that also retrieve password-related data, such as keychain_get_password or keychain_get_item.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives. The description does not mention any prerequisites, exclusion criteria, or recommended usage scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_totpGet TOTPARead-only
Get the current TOTP code by search term (bw get totp). The value is null unless reveal=true, and NOREVEAL or KEYCHAIN_NOREVEAL can still force redaction.
| Name | Required | Description | Default |
|---|---|---|---|
| term | Yes | Search term or exact item id used for bw get totp. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description discloses a key behavioral nuance: the value is null unless reveal=true, and NOREVEAL/KEYCHAIN_NOREVEAL can still force redaction. This is valuable context that the annotation alone does not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two focused sentences, front-loaded with the core purpose and followed by the most important behavioral caveat. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple two-parameter schema, readOnly annotation, and available output schema, this description covers the essential invocation behavior and redaction caveat. Nothing critical is missing for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters. The description adds meaning by explaining the conditional null behavior tied to reveal and the environment variable redaction, going beyond the schema's default description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Get), the resource (current TOTP code), and the lookup method (by search term). It also references the underlying 'bw get totp' command, distinguishing it from sibling getter tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when this tool is used: to retrieve a TOTP code by search term. It does not explicitly name alternatives or exclusions, but the purpose is unambiguous and the sibling getter tools are already differentiated by resource type.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_uriGet URIARead-only
Get the first login URI matched by bw get uri for a search term. Terms can be names, ids, or other bw-supported selectors and may be ambiguous, so use an exact item id when possible. URI values are returned as non-secret scalar results.
| Name | Required | Description | Default |
|---|---|---|---|
| term | Yes | Search term or exact item id; exact ids avoid ambiguous bw lookups. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes beyond the readOnlyHint annotation by disclosing that only the first login URI is returned, that the match may be ambiguous, and that URI values are non-secret scalar results. This gives useful behavioral expectations without contradicting the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with no filler. The core behavior is front-loaded, the ambiguity warning is directly actionable, and the output-type note is the last sentence. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only tool with an output schema, the description covers what the tool does, how to select the term, the ambiguity risk, and the nature of the result. Nothing important is missing for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to re-document the parameter. It adds value by clarifying that the term may be a name, id, or bw-supported selector and that ambiguity is possible, reinforcing the exact-id guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: it retrieves the first login URI matched by 'bw get uri' for a search term. This clearly distinguishes it from sibling tools like keychain_get_item, keychain_get_notes, or keychain_get_username.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on how to invoke the tool: terms can be names, ids, or other bw selectors, and exact item ids should be preferred to avoid ambiguity. It does not explicitly name alternatives or exclusion conditions, but the purpose is specific enough that an agent can tell when this tool applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_get_usernameGet UsernameARead-only
Get a login username matched by bw get username for a search term. Usernames are treated as non-secret scalar output, but exact item ids are safest for ambiguous names.
| Name | Required | Description | Default |
|---|---|---|---|
| term | Yes | Search term or exact item id used for bw get username. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint already true, the description adds meaningful behavioral context: usernames are treated as non-secret scalar output, and exact item IDs are safer for ambiguous names. This gives expectations beyond annotations. No contradiction with the read-only annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences: the first states the action and matching behavior, the second warns about ambiguity and exact IDs. No filler or repetition beyond minor overlap with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, read-only getter with an output schema, the description is sufficient: it explains what is returned, how the term is matched, and the safest usage caveat. Explicit sibling routing would improve completeness but is not strictly required for such a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the parameter description already defines 'term'. The tool description reinforces that term is a search term or exact item ID and links it to the bw get username behavior, adding retrieval semantics. It doesn't provide examples or formats, but the schema already carries the needed detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Get a login username' matched by 'bw get username' for a search term. This clearly distinguishes it from sibling getters like keychain_get_password, keychain_get_uri, or keychain_get_notes by naming the exact field returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to fetch a username by search term and recommends exact item IDs for ambiguous names, but it never explicitly states when to prefer this over get_item or search_items, nor does it name any alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_list_collectionsList CollectionsARead-only
List collections in the current vault, optionally filtered by organizationId. Use list_org_collections when you already know the organization and only want organization-scoped collections.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum returned rows (1-500). | |
| search | No | Optional text filter; empty means no text filter. | |
| organizationId | No | Optional organization id filter for collections. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true. Description adds the filtering behavior based on organizationId and clarifies vault scope, which provides useful context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences: first states purpose and optional filter, second gives sibling alternative. No waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple list tool with optional filters. No output schema, but return format is typical for a list. Missing pagination mention, but limit parameter covers that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. Description only reiterates 'optionally filtered by organizationId' without adding extra detail beyond schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'List collections in the current vault'. Differentiates from sibling 'list_org_collections' via scope mention.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use alternative (list_org_collections) and optional filtering by organizationId, giving clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_list_foldersList FoldersARead-only
List personal Bitwarden folders visible to the current user. Use this to discover folder ids for item organization; returns safe folder id/name summaries only.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum returned rows (1-500). | |
| search | No | Optional text filter; empty means no text filter. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true. Description adds that it returns 'safe folder id/name summaries only', implying no sensitive data, consistent with read-only behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words, front-loaded with purpose and outcome.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple read tool with 2 optional params. Description explains what is returned (folder id/name summaries). No output schema needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage for both parameters. Description does not add extra meaning beyond schema descriptions, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'list', resource 'folders', scope 'visible to current user', and purpose 'discover folder ids'. Distinguishes from siblings like keychain_list_collections.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use: to discover folder ids for item organization. No explicit exclusions, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_list_organizationsList OrganizationsARead-only
List organizations available to the current Bitwarden user so you can discover the organizationId required for org-scoped tools.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum returned rows (1-500). | |
| search | No | Optional text filter; empty means no text filter. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so no safety contradiction. The description adds context (available to current user) but does not disclose pagination behavior or ordering despite schema having a limit parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb and resource, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the purpose well but does not mention return structure or fields (e.g., that it returns id, name). However, as a simple list tool, the description is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so description carries minimal burden. The description adds no parameter-specific meaning beyond the schema's own descriptions for search and limit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the action (list), resource (organizations), and specific purpose (discover organizationId for org-scoped tools). This distinguishes it from sibling tools like keychain_get_organization which retrieves a single org by ID.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (when you need an organization ID for org-scoped tools) but does not provide when-not-to-use or explicitly name alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_list_org_collectionsList Org CollectionsARead-only
List organization-scoped collections for the required organizationId. Use this after discovering an organization to find collection ids; returns safe id/name summaries.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum returned rows (1-500). | |
| search | No | Optional text filter; empty means no text filter. | |
| organizationId | Yes | Bitwarden organization id; required for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=true, and the description adds 'returns safe id/name summaries', which informs the agent about output nature and safety. This complements the annotation well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, no wasted words. It immediately conveys purpose, usage context, and output nature, front-loading key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema, the description partially compensates by stating return type. It could elaborate on limit and search behavior, but those are in the schema parameters. Overall adequate for a list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with all parameters described. The description does not add new semantic meaning beyond the schema, meeting the baseline for a well-documented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List organization-scoped collections for the required organizationId', specifying verb, resource, and scope. This distinguishes it from siblings like keychain_list_collections (general) and keychain_get_org_collection (single).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises 'Use this after discovering an organization to find collection ids', providing clear context for when to use. However, it does not explicitly exclude other alternatives or state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_move_item_to_organizationMove Item To OrganizationA
Move an existing vault item into the required organizationId. Optionally pass collectionIds to assign organization collections during the move; collection ids are organization collections, not personal folders. Returns the moved item summary with normal redaction rules.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| collectionIds | No | Bitwarden collection ids, not folder ids. | |
| organizationId | Yes | Bitwarden organization id; required for org-scoped collection operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only and non-destructive behavior. The description adds that the tool returns a summary with normal redaction rules, but it does not clarify whether the original item is removed or copied (though 'move' implies removal). No mention of required permissions or side effects beyond the return value. The description adds some context but could be more explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences: purpose, optional parameter clarification, and return summary. No redundant or extraneous information. Front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 params, no output schema, no nested objects), the description fully covers what the tool does, how parameters are used, and what to expect from the return value. No additional context is necessary for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the description adds value beyond schema definitions by clarifying that collectionIds are 'organization collections, not personal folders' and explaining the return behavior. This helps an agent correctly interpret the optional parameter and the tool's output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the action: 'Move an existing vault item into the required organizationId.' It clearly identifies the resource (vault item) and the required parameter (organizationId). This distinguishes it from siblings like keychain_update_item or keychain_delete_item, which perform different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use the tool (to move an item to an organization) and mentions optional collectionIds. It does not explicitly state when not to use it or suggest alternatives, but the purpose is clear enough that an agent can infer appropriate usage from the sibling tool names (e.g., using keychain_update_item for edits instead).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_receiveReceiveARead-only
Receive a Bitwarden Send from an HTTPS url. Provide password when the Send is protected; obj=true returns the parsed JSON object, downloadFile=true downloads file bytes as base64, and the default returns received text. This reads a shared Send and does not create or modify vault items.
| Name | Required | Description | Default |
|---|---|---|---|
| obj | No | Return the full parsed Send JSON object instead of raw text. | |
| url | Yes | HTTPS Bitwarden Send URL to receive. | |
| password | No | Password required by the Send, when one was configured. | |
| downloadFile | No | Download a file Send and return filename, bytes, and contentBase64. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint and openWorldHint. Description reinforces that it reads a shared Send without modifying vault items, and details behavior for different modes. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with main purpose, no unnecessary words. Efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers return value types for all modes (text, JSON, file bytes). No output schema exists, so description compensates. Missing error handling details, but adequate given annotations and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for each parameter. Description adds natural language context but does not significantly expand beyond schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool receives a Bitwarden Send from an HTTPS URL, using specific verbs and resource. It distinguishes from siblings like keychain_send_get which retrieves own Sends, and vault item tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on when to use each flag (obj, downloadFile) and when to provide password. Implicitly contrasts with keychain_send_get for retrieving self-created Sends, but does not explicitly state alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_restore_itemRestore ItemA
Restore a soft-deleted vault item from trash by id. Use this after delete_item or delete_items when permanent was omitted or false; hard-deleted items cannot be restored. Returns the restored item summary with normal redaction rules.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate non-read-only and non-destructive behavior. The description adds that the tool returns 'the restored item summary with normal redaction rules', providing return behavior beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences effectively cover purpose, usage context, and return value with no redundant information. Front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description thoroughly explains preconditions (soft-deleted), limitations (hard-deleted cannot be restored), and output summary, making it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage for the single parameter 'id', the description does not add extra semantic value beyond the schema, meeting the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'restore', the resource 'soft-deleted vault item from trash', and specifies it works 'by id'. It differentiates from sibling deletion tools by indicating the context after delete operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: after delete_item or delete_items when permanent was omitted or false. Also clarifies that hard-deleted items cannot be restored, providing clear exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_sdk_versionCLI VersionARead-only
Return the Bitwarden CLI version reported by bw --version. Use this read-only check when diagnosing CLI/runtime compatibility without touching vault data.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds context beyond the readOnlyHint annotation by specifying it runs 'bw --version' and does not touch vault data, enhancing transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main action and purpose, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple version check with no parameters and an output schema present, the description fully covers what the tool does and when to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so the description does not need to add parameter info; baseline 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool returns the Bitwarden CLI version using a specific command, uniquely distinguishing it from sibling tools that interact with vault data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises using this read-only check for diagnosing CLI/runtime compatibility, implying no vault data is touched, which differentiates it from other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_search_itemsSearch ItemsARead-only
Search vault items by text and filters (org/folder/collection/url). This wraps bw list items --search, which does not reliably search custom field values.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Optional URL filter for item lookup. | |
| text | No | Optional text filter for item names, usernames, URIs, and other indexed fields. Custom field values are not reliably searched. | |
| type | No | Optional item type filter: login, note, ssh_key, card, or identity. | |
| limit | No | Maximum returned rows (1-500). | |
| trash | No | Search items in trash when true. | |
| folderId | No | Personal folder id, not an organization collection id. | |
| collectionId | No | Bitwarden collection id, not a folder id. | |
| organizationId | No | Bitwarden organization id filter for org-scoped item search. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description provides valuable behavioral context beyond the readOnlyHint annotation, including the underlying CLI command and the unreliability of custom field searches.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the core functionality, and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 8 optional parameters, the description covers the main purpose and a key limitation. It could mention pagination or result format, but schema covers parameters well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to add parameter details. The schema already describes all parameters adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it searches vault items by text and filters, and distinguishes itself from siblings by mentioning the underlying CLI command and a specific limitation about custom field values.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mentions the limitation regarding custom field search, guiding when not to rely on it. However, it does not directly contrast with alternatives like keychain_get_item.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_createSend CreateA
Quick-create a Bitwarden Send through bw send. Use type=text with text, or type=file with filename plus contentBase64; deleteInDays controls expiration deletion, maxAccessCount limits accesses, password protects the Send, and emails grant email-gated access. For advanced JSON templates or edits, use send_create_encoded and send_edit instead.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional Send display name. | |
| text | No | Text content for type=text Sends. | |
| type | Yes | Send payload type: text uses text; file uses filename plus contentBase64. | |
| notes | No | Optional private notes on the Send. | |
| emails | No | Recipient email addresses for Bitwarden Send email-gated access. Mutually exclusive with password; callers still need to share the Send URL. | |
| hidden | No | Hide text Send content by default when recipients open it. | |
| filename | No | Visible filename required with contentBase64 for file sends. | |
| password | No | Optional Send access password required by recipients. | |
| fullObject | No | Ask bw send to return the full Send object when supported. | |
| deleteInDays | No | Days until Bitwarden automatically deletes the Send (1-3650). | |
| contentBase64 | No | Base64-encoded file bytes for file sends, not a filesystem path. | |
| maxAccessCount | No | Maximum number of Send accesses before it becomes unavailable. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint=false and destructiveHint=false, confirming mutation but not destruction. The description adds behavioral context: deleteInDays controls deletion, maxAccessCount limits accesses, password protects, emails grant email-gated access. This adds value beyond annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first sentence covers core behavior and key parameters, the second sentence directs to alternatives. It is front-loaded, concise, and includes no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 12 parameters and no output schema, the description covers the type dichotomy, key constraints (deleteInDays, maxAccessCount, password, emails), and references alternatives. It addresses the complexity well and leaves no major gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds relational context (type=text with text; type=file with filename+contentBase64; emails mutually exclusive with password) that clarifies parameter interactions beyond the schema. This justifies a higher score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a Bitwarden Send ('Quick-create a Bitwarden Send') and distinguishes it from siblings by mentioning send_create_encoded and send_edit for advanced JSON/edits. The verb and resource are specific, and sibling differentiation is explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mentions alternatives for advanced cases (send_create_encoded, send_edit), providing clear guidance on when to use this tool vs others. It lacks explicit when-not-to use but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_create_encodedSend Create (Encoded JSON)A
Create a Send with the advanced bw send create flow. Provide an encodedJson template or raw json to encode, or create directly from text/file fields; file uses filename plus contentBase64 and hidden only affects text Sends. Use this when you need template-level fields beyond the quick send_create options.
| Name | Required | Description | Default |
|---|---|---|---|
| file | No | Direct file payload alternative using filename and contentBase64. | |
| json | No | Raw Send JSON template; the server encodes it before bw send create. | |
| text | No | Direct text payload alternative to encodedJson/json. | |
| hidden | No | Hide direct text Send content by default when true. | |
| encodedJson | No | Base64-encoded Send JSON template passed to bw send create. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-readOnly and non-destructive. Description adds that file uses contentBase64 (not filesystem), but does not detail side effects, permissions needed, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no unnecessary words, front-loaded with action and then usage condition. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main input methods and sibling differentiation, but lacks mention of return value (e.g., created Send ID) and any validation constraints, given no output schema. Almost complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and description adds value by clarifying the three input methods (encodedJson, json, text/file), the relationship between hidden and text, and that file's contentBase64 is not a path.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it creates a Send using advanced flow, distinguishes from quick send_create sibling by noting it supports template-level fields.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use (for template-level fields beyond quick options). Provides brief usage hints for file and hidden fields, but doesn't specify when to avoid or list alternatives beyond quick send_create.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_deleteSend DeleteADestructive
Delete a Bitwarden Send by id through bw send delete. This is destructive for the Send and its shared content; it does not delete any vault item that may have been used to create it. The visible text includes the requested Send id, and structured output includes both that id and the bw result payload when available.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveness, but description adds nuance: it destroys the Send and its shared content, but not vault items. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with action. Efficient but slightly verbose in qualification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple delete tool with one param. Mentions destructiveness and what it doesn't affect, but lacks edge cases like invalid id.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers id param 100%. Description adds no additional param info beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'Delete a Bitwarden Send by id'. Distinguishes from sibling delete tools by specifying it's for Sends, not vault items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when/when-not or alternatives. Implicitly for deleting Sends, but no guidance vs. sibling delete tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_editSend Edit (Encoded JSON)B
Edit an existing Send with the advanced bw send edit flow. Provide encodedJson or raw json containing the Send edit payload; raw json is encoded before invoking bw. Optional itemId maps to --itemid for item-linked Send edits.
| Name | Required | Description | Default |
|---|---|---|---|
| json | No | Raw Send edit JSON payload; the server encodes it before bw send edit. | |
| itemId | No | Optional parent item id passed to bw send edit as --itemid. | |
| encodedJson | No | Base64-encoded Send edit JSON payload passed to bw send edit. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations providing readOnlyHint=false and destructiveHint=false, the description does not add behavioral details such as side effects, authentication requirements, or rate limits. It mentions encoding but lacks deeper context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundant information, but could be more structured for quick scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and annotations indicate an open world, the description covers input options but omits expected output, error states, or usage constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description clarifies the relationship between 'encodedJson' and 'json' (encoding process) and the 'itemId' mapping. This adds some value beyond the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool edits an existing Send using the advanced 'bw send edit' flow. This distinguishes it from sibling tools like 'keychain_send_create' and 'keychain_send_delete'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use 'encodedJson' vs 'json' and mentions the optional 'itemId', but does not explicitly state when not to use the tool or compare it to alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_getSend GetARead-only
Get Sends owned by you. Use text=true to return text content; file Sends return metadata including accessUrl. To download file Send bytes, call receive with that accessUrl and downloadFile=true.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| text | No | Return the Send text content instead of JSON metadata. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only and open-world behavior. The description adds useful behavioral details: returns text content or file metadata with accessUrl, and directs to receive for downloads. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, no extraneous words. Every sentence adds value: purpose, behavior with text, and next step for files.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description adequately covers return types (text or file metadata) and provides a workflow hint (use receive). Could mention error cases, but for a read-only tool with good annotations, it's fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions. The description reinforces the meaning of the text parameter and adds that file Sends return metadata including accessUrl, providing extra context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves Sends owned by you, with a specific verb 'Get' and resource 'Sends'. It differentiates from sibling tools like keychain_send_list (list vs single get) and keychain_receive (for downloading file bytes).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on using text=true for text content and default for file metadata, and directs to keychain_receive for downloading file bytes. Missing explicit contrast with keychain_send_list, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_listSend ListARead-only
List all the Sends owned by you (bw send list). This is read-only and does not mutate the vault.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states 'This is read-only and does not mutate the vault', which aligns with the readOnlyHint annotation but adds no new behavioral context beyond what the annotation already provides. For a tool with annotations, the description adds minimal value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences. The first sentence states the main purpose, and the second clarifies the read-only nature. No unnecessary words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema), the description is adequate but lacks details about the output format, expected fields, or any limitations like pagination. It meets minimum viability but has gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so schema coverage is effectively 100%. The description correctly omits parameter details. Per guidelines, baseline for zero parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all Sends owned by the user, using the verb 'List' and specifying the resource 'Sends owned by you'. It distinguishes itself from sibling tools like keychain_send_get and keychain_send_create by focusing on listing all sends.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a user wants to list all sends, but provides no explicit guidance on when to use it versus other tools like keychain_send_get or keychain_list_collections. No alternatives or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_remove_passwordSend Remove PasswordADestructive
Remove a Send's saved password so recipients no longer need that password. This is destructive for the Send password only; it does not delete the Send content. Use send_delete when the entire Send should be removed.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true, and the description adds nuance by specifying the destruction is limited to the password, not the Send content. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with action and distinction, no fluff. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, single-parameter tool with no output schema, the description fully covers its effect, boundary, and relation to sibling tool, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the description does not add extra meaning to the single 'id' parameter beyond what the schema provides. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool removes a Send's saved password and distinguishes itself from send_delete, which deletes the entire Send. It specifies verb and resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use this tool (remove password only) and directly names the alternative (send_delete for full removal), guiding the agent correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_send_templateSend TemplateARead-only
Get a Bitwarden Send JSON template from bw send template. Choose a text or file template with object values send.text/text or send.file/file before using encoded create/edit flows. This is read-only and does not create a Send.
| Name | Required | Description | Default |
|---|---|---|---|
| object | Yes | Template object to fetch: text/send.text for text Sends or file/send.file for file Sends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states it is read-only and does not create a Send, matching the annotations. It adds value by clarifying the no-creation behavior, though annotations already indicate read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences with no wasted words. It front-loads the purpose, then provides usage context and behavioral transparency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter, clear annotations, and no output schema, the description covers purpose, usage, and behavior sufficiently. The agent can understand when and how to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully describes the parameter with 100% coverage, including enum values and descriptions. The tool description reiterates the parameter's role but does not add new semantic meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves a Bitwarden Send JSON template, specifying verb 'get' and resource 'template'. It distinguishes from sibling send tools by noting it is a preparatory step before using encoded create/edit flows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using this tool before encoded create/edit flows, providing context on when to use it. However, it lacks explicit exclusions or alternatives, so it's clear but not fully comprehensive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_set_login_urisSet Login URIsA
Set or update the URI list on a login item. mode=replace overwrites the full list; mode=merge updates existing URIs and adds new ones by URI. Match values can be domain, host, startsWith, exact, regex, or never.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| mode | No | URI merge behavior: replace overwrites the full list; merge updates existing URIs and adds new ones by URI. | |
| uris | Yes | URI entries to store or update on the login item. | |
| reveal | No | Whether secret values are returned; default false and can be forced false by NOREVEAL. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnlyHint=false, destructiveHint=false) indicate a non-read, non-destructive write operation. The description adds value by explaining the behavior of 'replace' and 'merge' modes and the allowed match values, which goes beyond the annotations. However, it doesn't mention side effects like confirmation or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences. The first sentence clearly states the function and the two modes, and the second lists the valid match values. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should mention what the tool returns (e.g., success, updated item). It also lacks context about prerequisites (e.g., id must refer to an existing item) or error handling. The description is adequate for simple usage but incomplete for a mutation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description provides a brief translation: 'mode=replace overwrites the full list; mode=merge updates existing URIs and adds new ones by URI' and lists match values, but these add minimal meaning beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Set or update the URI list on a login item', which is a specific verb and resource. It clearly differentiates from siblings like keychain_update_item by focusing solely on URIs, and the additional details on modes and match values reinforce its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (for setting or updating URIs with two modes) but does not explicitly state when to prefer it over alternatives like keychain_create_login or keychain_update_item. No exclusions or 'when not to use' guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_statusVault StatusARead-only
Returns Bitwarden CLI status (locked/unlocked, server, user). This is a lazy check: not-ready status does not mean later keychain tool calls cannot unlock or recover on demand.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation readOnlyHint=true already indicates no mutations. The description adds the valuable behavioral detail that the check is lazy and non-blocking, which is beyond what annotations provide. It also specifies the return information (locked/unlocked, server, user). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The first sentence states the core functionality, and the second adds an important caveat. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and an output schema exists, the description is complete. It mentions the key output fields and adds behavioral context. There are no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100%. The description does not need to add parameter details. Following the baseline recommendation for 0 parameters, a score of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns Bitwarden CLI status (locked/unlocked, server, user). It uses a specific verb ('Returns') and resource ('status'), which distinguishes it from the many sibling tools that perform mutations or retrievals of specific items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context that this is a 'lazy check' and warns that a 'not-ready status does not mean later keychain tool calls cannot unlock or recover on demand.' This helps the agent avoid premature conclusions. While it doesn't explicitly list alternatives or when not to use, the sibling context makes its role clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_syncSync VaultARead-only
Pull the latest vault data from the server (bw sync). Returns the last sync timestamp.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, and description confirms read operation ('pull') and specifies return value. No contradictions; adds useful context about behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no waste. First sentence states action, second clarifies return. Ideal length for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers action and return value. With no output schema, includes essential info. Could mention effect on local cache, but adequate for sync tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so description cannot add value beyond schema. Baseline score of 4 for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses verb 'pull' and resource 'vault data', specifies operation 'sync', and distinguishes from siblings by being the only sync tool. Clear and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives like keychain_status or when not to sync. Implied that it updates data, but lacks context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_update_itemUpdate ItemA
Update selected fields of an item by id. The patch is applied to the current item, so omitted fields stay unchanged while explicit nulls and empty arrays overwrite the stored folder, collection, login URI, or custom-field values. Use this for partial edits instead of reconstructing the full item.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Stable Bitwarden object id returned by list/search/get/create tools. | |
| patch | Yes | Partial item fields to update on the current item. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses nuanced patch semantics beyond the annotations: omitted fields stay unchanged, while explicit nulls and empty arrays overwrite folder, collection, login URI, or custom-field values. This is critical for avoiding accidental data loss and is not fully captured by readOnlyHint/destructiveHint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler. The first sentence states the action, the second explains key semantics, and the third gives usage direction. Information is front-loaded and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is largely complete for a patch tool: it explains scope, semantics, and usage, and the input schema documents all fields. It does not describe the return value or success/error behavior, but no output schema exists and the core invocation details are well covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful behavior on top of the schema by explaining how omitted vs. explicit null/empty values are treated, which directly affects correct use of the patch object.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the operation: 'Update selected fields of an item by id' with a specific verb and resource. It also conveys partial-update scope, but does not explicitly differentiate from siblings like keychain_set_login_uris that can also modify login URIs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides actionable guidance: 'Use this for partial edits instead of reconstructing the full item.' This establishes when the tool is appropriate, though it does not mention specific alternatives or exclusion cases beyond the general partial-edit scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
9 tool updates
v0.2.35- Changed
keychain_generate2 fields changed- removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_generate_username2 fields changed- removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_get_exposed2 fields changed- removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_get_notes2 fields changed- removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_get_password2 fields changed- removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_get_totp6 fields changed- removed
Output schema / properties / result / properties / period / anyOfRemoved value: -[ - { - "type": "number" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / period / typeAdded value: +[ + "number", + "null" +] - removed
Output schema / properties / result / properties / timeLeft / anyOfRemoved value: -[ - { - "type": "number" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / timeLeft / typeAdded value: +[ + "number", + "null" +] - removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_get_uri2 fields changed- removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_get_username2 fields changed- removed
Output schema / properties / result / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Output schema / properties / result / properties / value / typeAdded value: +[ + "string", + "null" +]
- Changed
keychain_update_item2 fields changed- removed
Input schema / properties / patch / properties / folderId / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "null" - } -] - added
Input schema / properties / patch / properties / folderId / typeAdded value: +[ + "string", + "null" +]
2 tool updates
v0.2.26- Changed
keychain_send_create1 field changed- added
Input schema / properties / emailsAdded value: +{ + "description": "Recipient email addresses for Bitwarden Send email-gated access. Mutually exclusive with password; callers still need to share the Send URL.", + "items": { + "format": "email", + "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$", + "type": "string" + }, + "maxItems": 50, + "minItems": 1, + "type": "array" +}
- Changed
keychain_send_get1 field changed- removed
Input schema / properties / downloadFileRemoved value: -{ - "description": "Download a file Send and return its file bytes.", - "type": "boolean" -}
51 tool updates
v0.2.19- Changed
keychain_create_attachment4 fields changed- added
Input schema / properties / contentBase64 / descriptionAdded value: +"Base64-encoded file bytes, not a filesystem path." - added
Input schema / properties / filename / descriptionAdded value: +"Visible attachment or send filename stored in Bitwarden metadata." - added
Input schema / properties / itemId / descriptionAdded value: +"Parent Bitwarden item id for attachment or item-specific operations." - added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL."
- Changed
keychain_create_card17 fields changed- added
Input schema / properties / brand / descriptionAdded value: +"Card brand, such as visa or mastercard." - added
Input schema / properties / cardholderName / descriptionAdded value: +"Cardholder name to store on the card." - added
Input schema / properties / code / descriptionAdded value: +"Card security code or CVV." - added
Input schema / properties / collectionIds / descriptionAdded value: +"Bitwarden collection ids, not folder ids." - added
Input schema / properties / expMonth / descriptionAdded value: +"Card expiration month." - added
Input schema / properties / expYear / descriptionAdded value: +"Card expiration year." - added
Input schema / properties / favorite / descriptionAdded value: +"Mark the item as a favorite when true." - added
Input schema / properties / fields / descriptionAdded value: +"Custom fields to store on the item. Hidden fields are redacted in summaries." - added
Input schema / properties / fields / items / descriptionAdded value: +"Custom field stored on the item." - added
Input schema / properties / fields / items / properties / hidden / descriptionAdded value: +"Hide the field value in summaries when true." - added
Input schema / properties / fields / items / properties / name / descriptionAdded value: +"Custom field name stored on the item." - added
Input schema / properties / fields / items / properties / value / descriptionAdded value: +"Custom field value stored on the item." - added
Input schema / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / name / descriptionAdded value: +"Display name for the payment card item." - added
Input schema / properties / notes / descriptionAdded value: +"Optional note text stored on the item." - added
Input schema / properties / number / descriptionAdded value: +"Primary card number to store on the card." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; used for org-scoped collection operations."
- Changed
keychain_create_folder1 field changed- added
Input schema / properties / name / descriptionAdded value: +"Display name for the personal folder."
- Changed
keychain_create_identity30 fields changed- added
Input schema / properties / collectionIds / descriptionAdded value: +"Bitwarden collection ids, not folder ids." - added
Input schema / properties / favorite / descriptionAdded value: +"Mark the item as a favorite when true." - added
Input schema / properties / fields / descriptionAdded value: +"Custom fields to store on the item. Hidden fields are redacted in summaries." - added
Input schema / properties / fields / items / descriptionAdded value: +"Custom field stored on the item." - added
Input schema / properties / fields / items / properties / hidden / descriptionAdded value: +"Hide the field value in summaries when true." - added
Input schema / properties / fields / items / properties / name / descriptionAdded value: +"Custom field name stored on the item." - added
Input schema / properties / fields / items / properties / value / descriptionAdded value: +"Custom field value stored on the item." - added
Input schema / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / identity / descriptionAdded value: +"Structured identity profile data to store on the item." - added
Input schema / properties / identity / properties / address1 / descriptionAdded value: +"Primary street address line." - added
Input schema / properties / identity / properties / address2 / descriptionAdded value: +"Secondary street address line." - added
Input schema / properties / identity / properties / address3 / descriptionAdded value: +"Tertiary street address line." - added
Input schema / properties / identity / properties / city / descriptionAdded value: +"City for the identity." - added
Input schema / properties / identity / properties / company / descriptionAdded value: +"Company or organization name." - added
Input schema / properties / identity / properties / country / descriptionAdded value: +"Country for the identity." - added
Input schema / properties / identity / properties / email / descriptionAdded value: +"Email address for the identity." - added
Input schema / properties / identity / properties / firstName / descriptionAdded value: +"Given name for the identity." - added
Input schema / properties / identity / properties / lastName / descriptionAdded value: +"Family name for the identity." - added
Input schema / properties / identity / properties / licenseNumber / descriptionAdded value: +"Driver license or similar id number for the identity." - added
Input schema / properties / identity / properties / middleName / descriptionAdded value: +"Middle name for the identity." - added
Input schema / properties / identity / properties / passportNumber / descriptionAdded value: +"Passport number associated with the identity." - added
Input schema / properties / identity / properties / phone / descriptionAdded value: +"Phone number for the identity." - added
Input schema / properties / identity / properties / postalCode / descriptionAdded value: +"Postal or ZIP code for the identity." - added
Input schema / properties / identity / properties / ssn / descriptionAdded value: +"Social security number or equivalent national id." - added
Input schema / properties / identity / properties / state / descriptionAdded value: +"State, province, or region for the identity." - added
Input schema / properties / identity / properties / title / descriptionAdded value: +"Honorific or title for the identity." - added
Input schema / properties / identity / properties / username / descriptionAdded value: +"Username associated with the identity." - added
Input schema / properties / name / descriptionAdded value: +"Display name for the identity item." - added
Input schema / properties / notes / descriptionAdded value: +"Optional note text stored on the item." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; used for org-scoped collection operations."
- Changed
keychain_create_login22 fields changed- added
Input schema / properties / attachments / descriptionAdded value: +"Attachments to add to the item." - added
Input schema / properties / attachments / items / descriptionAdded value: +"Attachment file payload to add to the item." - added
Input schema / properties / attachments / items / properties / contentBase64 / descriptionAdded value: +"Base64-encoded file bytes, not a filesystem path." - added
Input schema / properties / attachments / items / properties / filename / descriptionAdded value: +"Visible attachment or send filename stored in Bitwarden metadata." - added
Input schema / properties / collectionIds / descriptionAdded value: +"Bitwarden collection ids, not folder ids." - added
Input schema / properties / favorite / descriptionAdded value: +"Mark the item as a favorite when true." - added
Input schema / properties / fields / descriptionAdded value: +"Custom fields to store on the item. Hidden fields are redacted in summaries." - added
Input schema / properties / fields / items / descriptionAdded value: +"Custom field stored on the item." - added
Input schema / properties / fields / items / properties / hidden / descriptionAdded value: +"Hide the field value in summaries when true." - added
Input schema / properties / fields / items / properties / name / descriptionAdded value: +"Custom field name stored on the item." - added
Input schema / properties / fields / items / properties / value / descriptionAdded value: +"Custom field value stored on the item." - added
Input schema / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / name / descriptionAdded value: +"Display name for the login item." - added
Input schema / properties / notes / descriptionAdded value: +"Optional free-form notes for the login item." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; used for org-scoped collection operations." - added
Input schema / properties / password / descriptionAdded value: +"Password to store on the login item." - added
Input schema / properties / totp / descriptionAdded value: +"TOTP secret or otpauth value for the login item." - added
Input schema / properties / uris / descriptionAdded value: +"URI entries to store or update on the login item." - added
Input schema / properties / uris / items / descriptionAdded value: +"URI entry with match semantics for a login item." - added
Input schema / properties / uris / items / properties / match / descriptionAdded value: +"URI match semantics: domain, host, startsWith, exact, regex, or never; aliases and numeric values are normalized." - added
Input schema / properties / uris / items / properties / uri / descriptionAdded value: +"URI value to store on the login item." - added
Input schema / properties / username / descriptionAdded value: +"Login username or email address."
- Changed
keychain_create_logins24 fields changed- added
Input schema / properties / continueOnError / descriptionAdded value: +"Continue after failures and return per-item ok/error results when true." - added
Input schema / properties / items / descriptionAdded value: +"Login item payloads to create; each item follows create_login fields and returns its own ok/error result." - added
Input schema / properties / items / items / properties / attachments / descriptionAdded value: +"Attachments to add to the item." - added
Input schema / properties / items / items / properties / attachments / items / descriptionAdded value: +"Attachment file payload to add to the item." - added
Input schema / properties / items / items / properties / attachments / items / properties / contentBase64 / descriptionAdded value: +"Base64-encoded file bytes, not a filesystem path." - added
Input schema / properties / items / items / properties / attachments / items / properties / filename / descriptionAdded value: +"Visible attachment or send filename stored in Bitwarden metadata." - added
Input schema / properties / items / items / properties / collectionIds / descriptionAdded value: +"Bitwarden collection ids, not folder ids." - added
Input schema / properties / items / items / properties / favorite / descriptionAdded value: +"Mark the item as a favorite when true." - added
Input schema / properties / items / items / properties / fields / descriptionAdded value: +"Custom fields to store on the item. Hidden fields are redacted in summaries." - added
Input schema / properties / items / items / properties / fields / items / descriptionAdded value: +"Custom field stored on the item." - added
Input schema / properties / items / items / properties / fields / items / properties / hidden / descriptionAdded value: +"Hide the field value in summaries when true." - added
Input schema / properties / items / items / properties / fields / items / properties / name / descriptionAdded value: +"Custom field name stored on the item." - added
Input schema / properties / items / items / properties / fields / items / properties / value / descriptionAdded value: +"Custom field value stored on the item." - added
Input schema / properties / items / items / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / items / items / properties / name / descriptionAdded value: +"Display name for the login item." - added
Input schema / properties / items / items / properties / notes / descriptionAdded value: +"Optional free-form notes for the login item." - added
Input schema / properties / items / items / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; used for org-scoped collection operations." - added
Input schema / properties / items / items / properties / password / descriptionAdded value: +"Password to store on the login item." - added
Input schema / properties / items / items / properties / totp / descriptionAdded value: +"TOTP secret or otpauth value for the login item." - added
Input schema / properties / items / items / properties / uris / descriptionAdded value: +"URI entries to store or update on the login item." - added
Input schema / properties / items / items / properties / uris / items / descriptionAdded value: +"URI entry with match semantics for a login item." - added
Input schema / properties / items / items / properties / uris / items / properties / match / descriptionAdded value: +"URI match semantics: domain, host, startsWith, exact, regex, or never; aliases and numeric values are normalized." - added
Input schema / properties / items / items / properties / uris / items / properties / uri / descriptionAdded value: +"URI value to store on the login item." - added
Input schema / properties / items / items / properties / username / descriptionAdded value: +"Login username or email address."
- Changed
keychain_create_note11 fields changed- added
Input schema / properties / collectionIds / descriptionAdded value: +"Bitwarden collection ids, not folder ids." - added
Input schema / properties / favorite / descriptionAdded value: +"Mark the item as a favorite when true." - added
Input schema / properties / fields / descriptionAdded value: +"Custom fields to store on the item. Hidden fields are redacted in summaries." - added
Input schema / properties / fields / items / descriptionAdded value: +"Custom field stored on the item." - added
Input schema / properties / fields / items / properties / hidden / descriptionAdded value: +"Hide the field value in summaries when true." - added
Input schema / properties / fields / items / properties / name / descriptionAdded value: +"Custom field name stored on the item." - added
Input schema / properties / fields / items / properties / value / descriptionAdded value: +"Custom field value stored on the item." - added
Input schema / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / name / descriptionAdded value: +"Display name for the secure note item." - added
Input schema / properties / notes / descriptionAdded value: +"Optional note text stored on the item." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; used for org-scoped collection operations."
- Changed
keychain_create_org_collection2 fields changed- added
Input schema / properties / name / descriptionAdded value: +"Display name for the organization collection." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; required for org-scoped collection operations."
- Changed
keychain_create_ssh_key10 fields changed- added
Input schema / properties / collectionIds / descriptionAdded value: +"Bitwarden collection ids, not folder ids." - added
Input schema / properties / comment / descriptionAdded value: +"Optional SSH key comment or label." - added
Input schema / properties / favorite / descriptionAdded value: +"Mark the item as a favorite when true." - added
Input schema / properties / fingerprint / descriptionAdded value: +"Optional SSH key fingerprint." - added
Input schema / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / name / descriptionAdded value: +"Display name for the SSH key item." - added
Input schema / properties / notes / descriptionAdded value: +"Optional note text stored on the item." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; used for org-scoped collection operations." - added
Input schema / properties / privateKey / descriptionAdded value: +"SSH private key material to store on the item." - added
Input schema / properties / publicKey / descriptionAdded value: +"SSH public key material to store on the item."
- Changed
keychain_delete_attachment3 fields changed- added
Input schema / properties / attachmentId / descriptionAdded value: +"Attachment id returned by item metadata, or an unambiguous filename selector for downloads." - added
Input schema / properties / itemId / descriptionAdded value: +"Parent Bitwarden item id for attachment or item-specific operations." - added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL."
- Changed
keychain_delete_folder1 field changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools."
- Changed
keychain_delete_item2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / permanent / descriptionAdded value: +"Hard delete immediately when true; omit or false to soft-delete to trash."
- Changed
keychain_delete_items2 fields changed- added
Input schema / properties / ids / descriptionAdded value: +"Vault item ids to delete; returns one result per id." - added
Input schema / properties / permanent / descriptionAdded value: +"Hard delete each id immediately when true; omit or false to soft-delete to trash."
- Changed
keychain_delete_org_collection2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; required for org-scoped collection operations."
- Changed
keychain_edit_folder2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / name / descriptionAdded value: +"New display name for the personal folder."
- Changed
keychain_edit_org_collection3 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / name / descriptionAdded value: +"New display name for the organization collection." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; required for org-scoped collection operations."
- Changed
keychain_encode2 fields changed- added
Input schema / properties / value / descriptionAdded value: +"Plain text value to base64-encode." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "encoded": { + "type": "string" + } + }, + "required": [ + "encoded" + ], + "type": "object" +}
- Changed
keychain_generate15 fields changed- added
Input schema / properties / ambiguous / descriptionAdded value: +"Allow ambiguous characters in generated passwords." - added
Input schema / properties / capitalize / descriptionAdded value: +"Capitalize passphrase words when supported by bw." - added
Input schema / properties / includeNumber / descriptionAdded value: +"Include a number in passphrase mode when supported by bw." - added
Input schema / properties / length / descriptionAdded value: +"Password length in characters, between 5 and 256." - added
Input schema / properties / lowercase / descriptionAdded value: +"Include lowercase letters when generating a password." - added
Input schema / properties / minNumber / descriptionAdded value: +"Minimum number of digits to include." - added
Input schema / properties / minSpecial / descriptionAdded value: +"Minimum number of special characters to include." - added
Input schema / properties / number / descriptionAdded value: +"Include numeric digits when generating a password." - added
Input schema / properties / passphrase / descriptionAdded value: +"Generate a word-based passphrase instead of a password." - added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL." - added
Input schema / properties / separator / descriptionAdded value: +"Separator to use between words in passphrase mode." - added
Input schema / properties / special / descriptionAdded value: +"Include special characters when generating a password." - added
Input schema / properties / uppercase / descriptionAdded value: +"Include uppercase letters when generating a password." - added
Input schema / properties / words / descriptionAdded value: +"Passphrase word count, between 3 and 50." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "generated", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_generate_username7 fields changed- added
Input schema / properties / capitalize / descriptionAdded value: +"Capitalize the generated random word when supported." - added
Input schema / properties / domain / descriptionAdded value: +"Domain for catch-all email username generation." - added
Input schema / properties / email / descriptionAdded value: +"Base email address for plus-addressed username generation." - added
Input schema / properties / includeNumber / descriptionAdded value: +"Append a number to generated usernames when supported." - added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL." - added
Input schema / properties / type / descriptionAdded value: +"Username generation strategy: random word, plus-addressed email, catch-all email, or forwarded alias." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "generated", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_get_attachment2 fields changed- added
Input schema / properties / attachmentId / descriptionAdded value: +"Attachment id returned by item metadata, or an unambiguous filename selector for downloads." - added
Input schema / properties / itemId / descriptionAdded value: +"Parent Bitwarden item id for attachment or item-specific operations."
- Changed
keychain_get_collection2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / organizationId / descriptionAdded value: +"Optional organization id used to disambiguate the lookup."
- Changed
keychain_get_exposed2 fields changed- added
Input schema / properties / term / descriptionAdded value: +"Search term or exact item id; exact ids avoid ambiguous bw lookups." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "exposed", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_get_folder1 field changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools."
- Changed
keychain_get_item2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL."
- Changed
keychain_get_notes3 fields changed- added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL." - added
Input schema / properties / term / descriptionAdded value: +"Search term or exact item id; exact ids avoid ambiguous bw lookups." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "notes", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_get_org_collection2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / organizationId / descriptionAdded value: +"Optional organization id used to disambiguate the org collection lookup."
- Changed
keychain_get_organization1 field changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools."
- Changed
keychain_get_password3 fields changed- added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL." - added
Input schema / properties / term / descriptionAdded value: +"Search term or exact item id used for bw get password." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "password", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_get_password_history3 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "password_history", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "items": {}, + "type": "array" + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_get_totp3 fields changed- added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL." - added
Input schema / properties / term / descriptionAdded value: +"Search term or exact item id used for bw get totp." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "totp", + "type": "string" + }, + "period": { + "anyOf": [ + { + "type": "number" + }, + { + "type": "null" + } + ] + }, + "revealed": { + "type": "boolean" + }, + "timeLeft": { + "anyOf": [ + { + "type": "number" + }, + { + "type": "null" + } + ] + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed", + "period", + "timeLeft" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_get_uri2 fields changed- added
Input schema / properties / term / descriptionAdded value: +"Search term or exact item id; exact ids avoid ambiguous bw lookups." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "uri", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_get_username2 fields changed- added
Input schema / properties / term / descriptionAdded value: +"Search term or exact item id used for bw get username." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "result": { + "additionalProperties": false, + "properties": { + "kind": { + "const": "username", + "type": "string" + }, + "revealed": { + "type": "boolean" + }, + "value": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "kind", + "value", + "revealed" + ], + "type": "object" + } + }, + "required": [ + "result" + ], + "type": "object" +}
- Changed
keychain_list_collections3 fields changed- added
Input schema / properties / limit / descriptionAdded value: +"Maximum returned rows (1-500)." - added
Input schema / properties / organizationId / descriptionAdded value: +"Optional organization id filter for collections." - added
Input schema / properties / search / descriptionAdded value: +"Optional text filter; empty means no text filter."
- Changed
keychain_list_folders2 fields changed- added
Input schema / properties / limit / descriptionAdded value: +"Maximum returned rows (1-500)." - added
Input schema / properties / search / descriptionAdded value: +"Optional text filter; empty means no text filter."
- Changed
keychain_list_org_collections3 fields changed- added
Input schema / properties / limit / descriptionAdded value: +"Maximum returned rows (1-500)." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; required for org-scoped collection operations." - added
Input schema / properties / search / descriptionAdded value: +"Optional text filter; empty means no text filter."
- Changed
keychain_list_organizations2 fields changed- added
Input schema / properties / limit / descriptionAdded value: +"Maximum returned rows (1-500)." - added
Input schema / properties / search / descriptionAdded value: +"Optional text filter; empty means no text filter."
- Changed
keychain_move_item_to_organization3 fields changed- added
Input schema / properties / collectionIds / descriptionAdded value: +"Bitwarden collection ids, not folder ids." - added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id; required for org-scoped collection operations."
- Changed
keychain_receive4 fields changed- added
Input schema / properties / downloadFile / descriptionAdded value: +"Download a file Send and return filename, bytes, and contentBase64." - added
Input schema / properties / obj / descriptionAdded value: +"Return the full parsed Send JSON object instead of raw text." - added
Input schema / properties / password / descriptionAdded value: +"Password required by the Send, when one was configured." - added
Input schema / properties / url / descriptionAdded value: +"HTTPS Bitwarden Send URL to receive."
- Changed
keychain_restore_item1 field changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools."
- Changed
keychain_sdk_version1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "version": { + "type": "string" + } + }, + "required": [ + "version" + ], + "type": "object" +}
- Changed
keychain_search_items8 fields changed- added
Input schema / properties / collectionId / descriptionAdded value: +"Bitwarden collection id, not a folder id." - added
Input schema / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / limit / descriptionAdded value: +"Maximum returned rows (1-500)." - added
Input schema / properties / organizationId / descriptionAdded value: +"Bitwarden organization id filter for org-scoped item search." - added
Input schema / properties / text / descriptionAdded value: +"Optional text filter for item names, usernames, URIs, and other indexed fields. Custom field values are not reliably searched." - added
Input schema / properties / trash / descriptionAdded value: +"Search items in trash when true." - added
Input schema / properties / type / descriptionAdded value: +"Optional item type filter: login, note, ssh_key, card, or identity." - added
Input schema / properties / url / descriptionAdded value: +"Optional URL filter for item lookup."
- Changed
keychain_send_create11 fields changed- added
Input schema / properties / contentBase64 / descriptionAdded value: +"Base64-encoded file bytes for file sends, not a filesystem path." - added
Input schema / properties / deleteInDays / descriptionAdded value: +"Days until Bitwarden automatically deletes the Send (1-3650)." - added
Input schema / properties / filename / descriptionAdded value: +"Visible filename required with contentBase64 for file sends." - added
Input schema / properties / fullObject / descriptionAdded value: +"Ask bw send to return the full Send object when supported." - added
Input schema / properties / hidden / descriptionAdded value: +"Hide text Send content by default when recipients open it." - added
Input schema / properties / maxAccessCount / descriptionAdded value: +"Maximum number of Send accesses before it becomes unavailable." - added
Input schema / properties / name / descriptionAdded value: +"Optional Send display name." - added
Input schema / properties / notes / descriptionAdded value: +"Optional private notes on the Send." - added
Input schema / properties / password / descriptionAdded value: +"Optional Send access password required by recipients." - added
Input schema / properties / text / descriptionAdded value: +"Text content for type=text Sends." - added
Input schema / properties / type / descriptionAdded value: +"Send payload type: text uses text; file uses filename plus contentBase64."
- Changed
keychain_send_create_encoded7 fields changed- added
Input schema / properties / encodedJson / descriptionAdded value: +"Base64-encoded Send JSON template passed to bw send create." - added
Input schema / properties / file / descriptionAdded value: +"Direct file payload alternative using filename and contentBase64." - added
Input schema / properties / file / properties / contentBase64 / descriptionAdded value: +"Base64-encoded file bytes, not a filesystem path." - added
Input schema / properties / file / properties / filename / descriptionAdded value: +"Visible attachment or send filename stored in Bitwarden metadata." - added
Input schema / properties / hidden / descriptionAdded value: +"Hide direct text Send content by default when true." - added
Input schema / properties / json / descriptionAdded value: +"Raw Send JSON template; the server encodes it before bw send create." - added
Input schema / properties / text / descriptionAdded value: +"Direct text payload alternative to encodedJson/json."
- Changed
keychain_send_delete1 field changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools."
- Changed
keychain_send_edit3 fields changed- added
Input schema / properties / encodedJson / descriptionAdded value: +"Base64-encoded Send edit JSON payload passed to bw send edit." - added
Input schema / properties / itemId / descriptionAdded value: +"Optional parent item id passed to bw send edit as --itemid." - added
Input schema / properties / json / descriptionAdded value: +"Raw Send edit JSON payload; the server encodes it before bw send edit."
- Changed
keychain_send_get3 fields changed- added
Input schema / properties / downloadFile / descriptionAdded value: +"Download a file Send and return its file bytes." - added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / text / descriptionAdded value: +"Return the Send text content instead of JSON metadata."
- Changed
keychain_send_remove_password1 field changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools."
- Changed
keychain_send_template1 field changed- added
Input schema / properties / object / descriptionAdded value: +"Template object to fetch: text/send.text for text Sends or file/send.file for file Sends."
- Changed
keychain_set_login_uris7 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / mode / descriptionAdded value: +"URI merge behavior: replace overwrites the full list; merge updates existing URIs and adds new ones by URI." - added
Input schema / properties / reveal / descriptionAdded value: +"Whether secret values are returned; default false and can be forced false by NOREVEAL." - added
Input schema / properties / uris / descriptionAdded value: +"URI entries to store or update on the login item." - added
Input schema / properties / uris / items / descriptionAdded value: +"URI entry with match semantics for a login item." - added
Input schema / properties / uris / items / properties / match / descriptionAdded value: +"URI match semantics: domain, host, startsWith, exact, regex, or never; aliases and numeric values are normalized." - added
Input schema / properties / uris / items / properties / uri / descriptionAdded value: +"URI value to store on the login item."
- Changed
keychain_status1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "status": {} + }, + "required": [ + "status" + ], + "type": "object" +}
- Changed
keychain_update_item20 fields changed- added
Input schema / properties / id / descriptionAdded value: +"Stable Bitwarden object id returned by list/search/get/create tools." - added
Input schema / properties / patch / descriptionAdded value: +"Partial item fields to update on the current item." - added
Input schema / properties / patch / properties / collectionIds / descriptionAdded value: +"Collection ids to replace on the item." - added
Input schema / properties / patch / properties / favorite / descriptionAdded value: +"Mark the item as a favorite when true." - added
Input schema / properties / patch / properties / fields / descriptionAdded value: +"Custom fields to replace on the item." - added
Input schema / properties / patch / properties / fields / items / descriptionAdded value: +"Custom field stored on the item." - added
Input schema / properties / patch / properties / fields / items / properties / hidden / descriptionAdded value: +"Hide the field value in summaries when true." - added
Input schema / properties / patch / properties / fields / items / properties / name / descriptionAdded value: +"Custom field name stored on the item." - added
Input schema / properties / patch / properties / fields / items / properties / value / descriptionAdded value: +"Custom field value stored on the item." - added
Input schema / properties / patch / properties / folderId / descriptionAdded value: +"Personal folder id, not an organization collection id." - added
Input schema / properties / patch / properties / login / descriptionAdded value: +"Login-specific fields to patch on the item." - added
Input schema / properties / patch / properties / login / properties / password / descriptionAdded value: +"Login password to update." - added
Input schema / properties / patch / properties / login / properties / totp / descriptionAdded value: +"TOTP secret or otpauth value to update." - added
Input schema / properties / patch / properties / login / properties / uris / descriptionAdded value: +"Login URIs to replace on the existing item." - added
Input schema / properties / patch / properties / login / properties / uris / items / descriptionAdded value: +"URI entry with match semantics for a login item." - added
Input schema / properties / patch / properties / login / properties / uris / items / properties / match / descriptionAdded value: +"URI match semantics: domain, host, startsWith, exact, regex, or never; aliases and numeric values are normalized." - added
Input schema / properties / patch / properties / login / properties / uris / items / properties / uri / descriptionAdded value: +"URI value to store on the login item." - added
Input schema / properties / patch / properties / login / properties / username / descriptionAdded value: +"Login username to update." - added
Input schema / properties / patch / properties / name / descriptionAdded value: +"New item name." - added
Input schema / properties / patch / properties / notes / descriptionAdded value: +"New notes text for the item."
2 tool updates
v0.2.18- Added
keychain_sdk_version - Added
keychain_sync
102 tool updates
v0.1.20- Added
keychain_create_attachment - Added
keychain_create_card - Added
keychain_create_folder - Added
keychain_create_identity - Added
keychain_create_login - Added
keychain_create_logins - Added
keychain_create_note - Added
keychain_create_org_collection - Added
keychain_create_ssh_key - Added
keychain_delete_attachment - Added
keychain_delete_folder - Added
keychain_delete_item - Added
keychain_delete_items - Added
keychain_delete_org_collection - Added
keychain_edit_folder - Added
keychain_edit_org_collection - Added
keychain_encode - Added
keychain_generate - Added
keychain_generate_username - Added
keychain_get_attachment - Added
keychain_get_collection - Added
keychain_get_exposed - Added
keychain_get_folder - Added
keychain_get_item - Added
keychain_get_notes - Added
keychain_get_org_collection - Added
keychain_get_organization - Added
keychain_get_password - Added
keychain_get_password_history - Added
keychain_get_totp - Added
keychain_get_uri - Added
keychain_get_username - Added
keychain_list_collections - Added
keychain_list_folders - Added
keychain_list_org_collections - Added
keychain_list_organizations - Added
keychain_move_item_to_organization - Added
keychain_receive - Added
keychain_restore_item - Added
keychain_search_items - Added
keychain_send_create - Added
keychain_send_create_encoded - Added
keychain_send_delete - Added
keychain_send_edit - Added
keychain_send_get - Added
keychain_send_list - Added
keychain_send_remove_password - Added
keychain_send_template - Added
keychain_set_login_uris - Added
keychain_status - Added
keychain_update_item - Removed
keychain.create_attachment - Removed
keychain.create_card - Removed
keychain.create_folder - Removed
keychain.create_identity - Removed
keychain.create_login - Removed
keychain.create_logins - Removed
keychain.create_note - Removed
keychain.create_org_collection - Removed
keychain.create_ssh_key - Removed
keychain.delete_attachment - Removed
keychain.delete_folder - Removed
keychain.delete_item - Removed
keychain.delete_items - Removed
keychain.delete_org_collection - Removed
keychain.edit_folder - Removed
keychain.edit_org_collection - Removed
keychain.encode - Removed
keychain.generate - Removed
keychain.generate_username - Removed
keychain.get_attachment - Removed
keychain.get_collection - Removed
keychain.get_exposed - Removed
keychain.get_folder - Removed
keychain.get_item - Removed
keychain.get_notes - Removed
keychain.get_org_collection - Removed
keychain.get_organization - Removed
keychain.get_password - Removed
keychain.get_password_history - Removed
keychain.get_totp - Removed
keychain.get_uri - Removed
keychain.get_username - Removed
keychain.list_collections - Removed
keychain.list_folders - Removed
keychain.list_org_collections - Removed
keychain.list_organizations - Removed
keychain.move_item_to_organization - Removed
keychain.receive - Removed
keychain.restore_item - Removed
keychain.search_items - Removed
keychain.send_create - Removed
keychain.send_create_encoded - Removed
keychain.send_delete - Removed
keychain.send_edit - Removed
keychain.send_get - Removed
keychain.send_list - Removed
keychain.send_remove_password - Removed
keychain.send_template - Removed
keychain.set_login_uris - Removed
keychain.status - Removed
keychain.update_item
51 tool updates
v0.1.19- First observed
keychain.create_attachment - First observed
keychain.create_card - First observed
keychain.create_folder - First observed
keychain.create_identity - First observed
keychain.create_login - First observed
keychain.create_logins - First observed
keychain.create_note - First observed
keychain.create_org_collection - First observed
keychain.create_ssh_key - First observed
keychain.delete_attachment - First observed
keychain.delete_folder - First observed
keychain.delete_item - First observed
keychain.delete_items - First observed
keychain.delete_org_collection - First observed
keychain.edit_folder - First observed
keychain.edit_org_collection - First observed
keychain.encode - First observed
keychain.generate - First observed
keychain.generate_username - First observed
keychain.get_attachment - First observed
keychain.get_collection - First observed
keychain.get_exposed - First observed
keychain.get_folder - First observed
keychain.get_item - First observed
keychain.get_notes - First observed
keychain.get_org_collection - First observed
keychain.get_organization - First observed
keychain.get_password - First observed
keychain.get_password_history - First observed
keychain.get_totp - First observed
keychain.get_uri - First observed
keychain.get_username - First observed
keychain.list_collections - First observed
keychain.list_folders - First observed
keychain.list_org_collections - First observed
keychain.list_organizations - First observed
keychain.move_item_to_organization - First observed
keychain.receive - First observed
keychain.restore_item - First observed
keychain.search_items - First observed
keychain.send_create - First observed
keychain.send_create_encoded - First observed
keychain.send_delete - First observed
keychain.send_edit - First observed
keychain.send_get - First observed
keychain.send_list - First observed
keychain.send_remove_password - First observed
keychain.send_template - First observed
keychain.set_login_uris - First observed
keychain.status - First observed
keychain.update_item
TDQS
Most tools have clearly distinct purposes with descriptive names and detailed explanations. A few pairs, like keychain_send_create and keychain_send_create_encoded, or multiple 'get' tools, could be confused, but descriptions effectively differentiate them.
All tools follow a consistent 'keychain_verb_noun' pattern in snake_case. The naming is predictable and clearly indicates the action and target resource.
53 tools is high, but the Bitwarden vault domain is broad, covering items, folders, collections, organizations, sends, and utilities. The count is borderline excessive, but each tool serves a specific purpose and is justified by the scope.
The tool surface covers CRUD operations for all major vault entities, plus search, sync, generation, and encoding. There are no obvious gaps; the set provides a complete lifecycle for vault management.
Maintenance
Related MCP Connectors
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
MCP server for Argo RPG Platform — connects AI assistants to campaign data via OAuth2
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Related MCP Servers
AlicenseBqualityAmaintenanceA Model Context Protocol server that enables LLMs to interact with web pages through structured accessibility snapshots without requiring vision models or screenshots.2245,881,52736,824Apache 2.0- AlicenseNot gradedqualityDmaintenanceSecret management MCP server for AI coding agents that prevents secrets from entering the LLM context window by returning metadata only and using side-channel injection. Integrates with Bitwarden and offers hooks for auto-capture and leak prevention.1MIT

wundervaultofficial
AlicenseAqualityAmaintenanceMCP server for Wundervault zero-knowledge secret management. Exposes vault secrets to AI agents via the Model Context Protocol — secrets are decrypted server-side and never returned to the agent in plaintext.6922AGPL 3.0- FlicenseBqualityDmaintenanceMCP server that enables AI models to securely interact with a Bitwarden password manager vault via the rbw CLI.111-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/icoretech/warden-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server