Repository navigation
feat(mcp): fix bitwarden MCP server vault session resolution - #448
Merged
Merged
Conversation
The bitwarden MCP server needs BW_SESSION but its session comes from
the resolver (bw_session.py), not from a vault item. This is the only
server class where this matters — the vault client itself.
Add needs_vault_session to mcp/external-servers.json and a matching
flag in mcp-run.sh that:
- Forces NEEDS_SECRETS=1 so load_session_file() is called
- Skips the vault-map entry check (no entry needed)
- Reports session source in --check output
Declare bitwarden in external-servers.json with the npx command and
needs_vault_session: true.
Enhance check-mcp-wiring.py to:
- Verify external-servers.json entries are routed through mcp-run.sh
- Suggest adding undeclared package-runner entries
- Catch the bitwarden drift pattern where opencode.json bypasses
the launcher (#386)
Fixes: bitwarden MCP server aborts in OpenCode ("Tool execution
interrupted") because BW_SESSION is never resolved.
The external-servers.json catalog is advisory, not policy — users may run the MCP server with a different vault solution (or none at all). Change the 'declared but not routed through mcp-run.sh' check to an INFO print instead of a WARNING, and update the check() return type to (errors, warnings, infos) to keep the function pure. Add test_declared_external_server_produces_info to explicitly verify the INFO behavior. Remove bitwarden from test_foreign_servers_are_ignored since it is now a declared server. Fixes: PR #448 test failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Bitwarden MCP server aborts in OpenCode with
Tool execution interrupted.Root cause
OpenCode's config launched it as a bare
npx -y @bitwarden/mcp-serverwithBW_SESSION: {env:BW_SESSION}, but no OpenCode process hasBW_SESSIONin its environment — it's a desktop app, not a shell. The server starts fine
(lists 59 tools), but any real vault read (like
list items) causes thebwCLI to block on a hidden password prompt on stdin, which hangs forever.
OpenCode eventually aborts it as "interrupted".
Fix (3 parts)
1.
mcp-run.sh— newneeds_vault_sessionflag for external serversExternal servers that ARE the vault client (bitwarden) get their session from
the resolver (
bw_session.py), not from a vault item. This flag tellsthe launcher to resolve and export
BW_SESSIONbefore launching, and skipsthe vault-map entry check (no entry needed).
2.
mcp/external-servers.json— declare bitwardenRegisters bitwarden so the launcher knows how to start it:
3.
check-mcp-wiring.py— detect this driftTwo new checks:
Verification
$ bin/mcp-run.sh bitwarden --check ✓ external: npx -y @bitwarden/mcp-server ✓ command /usr/.../npx ✓ bw CLI /usr/.../bw ✓ BW_SESSION unlocked (from /home/netyeti/.cache/opskit/bw-session) ✓ session external server (resolved from /home/netyeti/.cache/opskit/bw-session) Launch path OK.Also fix in opencode.json
This PR handles OpsKit-side changes. The opencode.json config will be updated
separately to route bitwarden through mcp-run.sh.