bw-mcp

# BW-MCP 🔐🤖 **Sovereign, Exhaustive, & Ultra-Secure Model Context Protocol (MCP) for Bitwarden** **BW-MCP** is a specialized, air-gapped intermediary designed to physically isolate Large Language Models (LLMs) from your Bitwarden cryptographic secrets, while still granting them 100% organizational superpowers over your vault. It strongly enforces the **"AI-Blind Management"** philosophy. You can ask an AI (Claude, Cursor, Gemini) to completely reorganize your vault, rename poorly formatted accounts, manage your Enterprise Collections, update credit card expiration dates, or tag hundreds of items as favorites. *The AI will do all of this flawlessly, without ever being able to read or modify your Master Password, your TOTP seeds, your Credit Card CVVs, or your Social Security Number.* --- ## 🧭 The Philosophy > **Zero Trust · Total Transparency · Total Blind** This project does not ask for your trust. It is architected so that trust becomes irrelevant. ### I. Blind by Design The AI model is **physically incapable** of seeing your secrets. A `Pydantic` model layer (`extra="forbid"` + `force_redact()`) intercepts every byte returned by the Bitwarden CLI before the AI ever sees it. Passwords, TOTPs, CVVs, and SSNs are overwritten with sentinel tags (`[REDACTED_BY_PROXY_POPULATED]`) at the data layer — not by policy or politeness. This is the **Principle of Least Privilege** taken to its logical extreme: *you cannot leak what you cannot read.* ### II. Zero Trust The proxy extends zero trust **to everyone**: the AI, the user, and itself. Every proposed batch of operations is: 1. **Validated by Pydantic** against strict enum schemas before touching any CLI. 2. **Reviewed by the Human** via a Zenity system popup requiring the Master Password. 3. **Traced to disk** in a Write-Ahead Log before execution, allowing crash recovery. 4. **Rolled back automatically** (LIFO) if any step fails, with a full audit trail. There are no "admin bypass" modes, no `--force` flags…