Security 🧪 Community ✓ Claude Code ✓ Claude Desktop Standalone • Bitwarden
Bitwarden
Bitwarden - read-only org audit: members, 2FA, groups, collection access metadata, policies, event log, and subscription (never vault items)
Installation
Install this plugin individually:
/plugin marketplace add wyre-technology/msp-claude-plugins --plugin bitwarden Or install all MSP plugins at once:
/plugin marketplace add wyre-technology/msp-claude-plugins Features
- Event Log Review
- License Reconciliation
- Offboarding Access Review
- Security Posture
Skills
This plugin provides 5 skills that teach Claude about Bitwarden:
| Skill | Description |
|---|---|
event-log-review | Reading a client's Bitwarden organization event log through the admin-gated bitwarden_events_list tool: date ranges and the 367-day limit, continuationToken paging, the one-filter rule, the event types that matter to an MSP (failed logins, 2FA changes, vault exports, item views and copies, member and policy changes), resolving IDs back to members, groups and collections, and handling the personal data events carry. |
license-reconciliation | Reconciling a client's Bitwarden subscription against its real membership: Password Manager and Secrets Manager seats and autoscale limits from the subscription, member counts by status, invites that never completed, revoked members still listed, and the figures to check against the MSP's billing agreement. |
offboarding-access-review | Mapping everything a departing user could reach in a client's Bitwarden organization: their membership, role and status, collections granted directly and through groups, their recent vault activity from the admin-gated event log, and the follow-up list (revoke in the Admin Console, rotate exposed shared credentials, rotate the organization API key if they were an owner). |
security-posture | Assessing a client's Bitwarden organization posture from the read-only Public API: which security policies are enabled and how they are set, two-step login coverage across confirmed members, owner and admin sprawl, members stuck in Invited or Accepted, and the SSO caveat on the 2FA flag. |
api-patterns | Bitwarden MCP fundamentals: the organization API key passed through Conduit as X-Bitwarden-Client-Id / X-Bitwarden-Client-Secret / X-Bitwarden-Region, the 12 read-only tools and which one is admin-gated, full-list responses versus the paged event log, response truncation, the member role and status enums, error and rate-limit handling, and what the Public API can never return. |
Agents
This plugin provides 1 agent for autonomous task execution:
| Agent | Description |
|---|---|
bitwarden-org-auditor | Use this agent when an MSP security lead, vCISO or account manager needs a full read-only audit of a client's Bitwarden organization - policy posture, two-step login coverage, owner and admin sprawl, seat reconciliation, and (with the admin grant) notable events - rolled into one prioritized report. |
Commands
Available slash commands:
| Command | Description |
|---|
API Reference
| Base URL | |
| Authentication | |
| Rate Limit | |
| Documentation |
Example Usage
Using Skills
/skill bitwarden:event-log-review
Reading a client's Bitwarden organization event log through the admin-gated bitwarden_events_list tool: date ranges and the 367-day limit, continuationToken paging, the one-filter rule, the event types that matter to an MSP (failed logins, 2FA changes, vault exports, item views and copies, member and policy changes), resolving IDs back to members, groups and collections, and handling the personal data events carry.