Bitbucket Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bitbucket Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A read-only Model Context Protocol (MCP) server that provides secure access to Bitbucket repositories, pull requests, issues, and more. Integrates seamlessly with VS Code GitHub Copilot, Cursor, and Claude Code.
🎯 38 tools available | ✅ 189 unit tests (92.9% overall, 95.5% core src coverage) | 🏗️ Modular architecture | 📦 TOON/JSON/text output formats
bb_search_code functionality💡 How to create an API Token: 1. Go to https://id.atlassian.com/manage-profile/security/api-tokens 2. Click "Create API token with scopes" 3. Enter a label (e.g., "Bitbucket MCP"), set expiry date, and click "Next" 4. Select "Bitbucket" in the app selection and click "Next" 5. In the scope actions, select "Read" and in the Results per page, select 20 or hgiher 6. Check all the checkboxes and click "Next" 7. Copy the generated token and use it asBITBUCKET_API_TOKEN8. Use your Atlassian account email asBITBUCKET_EMAIL
npm install -g @tugudush/bitbucket-mcpUpdating to the latest version:
npm update -g @tugudush/bitbucket-mcpgit clone https://github.com/tugudush/bitbucket-mcp.git
cd bitbucket-mcp
npm install
npm run buildConfigure your MCP client with authentication credentials.
#### Option A: Using NPM Global Installation (Recommended)
After installing with npm install -g @tugudush/bitbucket-mcp:
VS Code GitHub Copilot
// .vscode/mcp.json
{
"servers": {
"bitbucket-mcp": {
"type": "stdio",
"command": "bitbucket-mcp",
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "[email protected]"
}
}
}
}Cursor
// ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project)
{
"mcpServers": {
"bitbucket-mcp": {
"command": "bitbucket-mcp",
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "[email protected]"
}
}
}
}Claude Code
Using CLI:
claude mcp add --transport stdio \
--env BITBUCKET_API_TOKEN=your-token \
--env [email protected] \
bitbucket-mcp -- npx @tugudush/bitbucket-mcpOr add to .mcp.json (project scope):
{
"mcpServers": {
"bitbucket-mcp": {
"command": "npx",
"args": ["-y", "@tugudush/bitbucket-mcp"],
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "[email protected]"
}
}
}
}#### Option B: Using Local Build (For Development)
If you built from source:
VS Code GitHub Copilot
// .vscode/mcp.json
{
"servers": {
"bitbucket-mcp": {
"type": "stdio",
"command": "node",
"args": ["/path/to/build/index.js"],
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "[email protected]"
}
}
}
}Cursor
// ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project)
{
"mcpServers": {
"bitbucket-mcp": {
"command": "node",
"args": ["/path/to/build/index.js"],
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "[email protected]"
}
}
}
}Claude Code
Using CLI:
claude mcp add --transport stdio \
--env BITBUCKET_API_TOKEN=your-token \
--env [email protected] \
bitbucket-mcp -- node /path/to/build/index.jsOr add to .mcp.json (project scope):
{
"mcpServers": {
"bitbucket-mcp": {
"command": "node",
"args": ["/path/to/build/index.js"],
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "[email protected]"
}
}
}
}💡 Tips:
/path/to/build/index.js with the absolute path to your built serverbb_list_workspaces - Discover accessible workspacesbb_get_workspace - Get workspace detailsbb_list_repositories - List repositories across workspacesbb_get_repository - Get repository detailsbb_search_repositories - Find repositories by name/descriptionbb_browse_repository - Explore directory structure (supports branches with slashes like feature/SSP-1024)bb_get_file_content - Read files with pagination (1-10,000 lines)bb_get_file_history - Get commit history for specific filesbb_get_pull_requests - List all pull requestsbb_get_pull_request - Get detailed PR informationbb_get_pull_request_comments - List all comments on a PRbb_get_pull_request_comment - Get a single comment by IDbb_get_comment_thread - Get a comment thread with all nested repliesbb_get_pull_request_activity - Track reviews, approvals, state changesbb_get_pull_request_diff - Get unified diff for a PRbb_get_pull_request_diffstat - Get per-file change statisticsbb_get_pr_commits - List commits in a PRbb_get_pr_statuses - Get CI/CD build statuses for a PRbb_get_context - Get curated PR context bundle in a single call (metadata, diffstat, statuses, comments)bb_get_branches - List all branchesbb_get_branch - Get detailed branch informationbb_get_commits - List commit historybb_get_commit - Get detailed commit informationbb_get_commit_statuses - Get CI/CD build statuses for a commitbb_get_merge_base - Find common ancestor between branchesbb_get_tags - List repository tagsbb_get_tag - Get detailed tag informationbb_get_diff - Get unified diff between commitsbb_get_diffstat - Get per-file change statistics between commitsbb_list_pipelines - List pipeline runsbb_get_pipeline - Get detailed pipeline informationbb_get_pipeline_steps - List pipeline steps/stagesbb_get_pipeline_step_log - Get build logs for pipeline stepsbb_get_issues - List repository issuesbb_get_issue - Get detailed issue informationbb_search_code - Advanced code search with language filteringbb_get_user - Get user information by username or UUIDbb_get_current_user - Get authenticated user informationTotal: 38 tools across 8 categories
All 38 tools support flexible output formatting and data filtering via two optional parameters:
output_format)Control how responses are returned:
| Format | Description | Best For |
|---|---|---|
text | Human-readable formatted output (default) | Debugging, human review |
json | Pretty-printed JSON with 2-space indentation | Programmatic consumption, structured data |
toon | Token-Oriented Object Notation — compact tabular format | LLM consumption (30-60% token savings) |
TOON format significantly reduces token usage when AI assistants consume Bitbucket data, making it ideal for large responses like PR lists, commit histories, and file contents.
filter)Apply JMESPath expressions to transform structured response data before format conversion:
# Extract just PR titles and authors
filter: "values[].{title: title, author: author.display_name}"
# Get only open PRs
filter: "values[?state=='OPEN']"
# Extract repository names
filter: "values[].full_name"Filtering is applied before format conversion, so you can combine filter with any output_format.
Get repositories as compact TOON format:
bb_list_repositories workspace=myworkspace output_format=toonGet PR details as JSON:
bb_get_pull_request workspace=myworkspace repo_slug=myrepo pull_request_id=123 output_format=jsonFilter and format — get only PR titles in TOON:
bb_get_pull_requests workspace=myworkspace repo_slug=myrepo output_format=toon filter="values[].{id: id, title: title, state: state}"Tip: When using this server with AI assistants, consider using output_format=toon for large responses to reduce token consumption by 30-60%.To set a default output format for all tools without specifying it per-call, set the BITBUCKET_DEFAULT_FORMAT environment variable:
{
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "[email protected]",
"BITBUCKET_DEFAULT_FORMAT": "toon"
}
}text (backward compatible)output_format always takes priority over the env vartext, json, toonRepository Discovery:
File Operations:
Code Search:
Pull Requests & Comments:
Branches & Commits:
Tags & Releases:
npm run build # TypeScript compilation
npm run watch # Development mode with auto-rebuild
npm run ltf # Lint → Format → Typecheck (recommended before commits)
npm run ltfb # Lint → Typecheck → Format → Build (full pipeline)
node build/index.js # Test server startupThe MCP server includes comprehensive test coverage:
Unit Tests: 189 tests across 12 test suites (92.9% overall, 95.5% on core src statement coverage)
makeRequest/makeTextRequest with thorough edge case coveragenpm test or jest --coverage for full coverage reportIntegration Tests: 31 out of 38 tools verified (100% success rate on testable tools)
To create your own tests:
src/__tests__/handlers/jest.mock for unit tests.vscode/mcp.json.vscode/ configurationCtrl+Alt+Iusing bitbucket, list repositories in myworkspaceEnable debug logging to see internal state and API requests:
BITBUCKET_DEBUG=true node build/index.jsDebug output is printed to stderr and includes:
Modular design with handler registry pattern:
src/handlers/ - Domain-specific tool handlers (repository, pullrequest, commit, diff, workspace, search, issue, pipeline)src/tools.ts - Tool definitions and handler routingsrc/schemas.ts - Zod validation schemas with API constantssrc/types.ts - TypeScript interfaces for Bitbucket APIsrc/api.ts - Request handling with retry logicsrc/config.ts - Configuration managementsrc/errors.ts - Custom error classesSee .github/copilot-instructions.md for detailed development guidelines.
makeRequest() blocks non-GET requestsfeature/SSP-1024)✅ Production Ready - 189 unit tests (92.9% overall, 95.5% on core src coverage), 31/38 integration tests verified
Recent Updates (2026-04):
filter parameterjest --coverage fully operationalfetchAllPages()bb_get_user to use correct GET /users/{selected_user} endpointbb_list_user_pull_requests (non-existent Bitbucket API v2.0 endpoint)We welcome contributions and feedback!
The server implements 38 tools covering all major Bitbucket Cloud API v2.0 endpoints (read-only):
Contributions are welcome! Please follow these guidelines:
src/handlers/)makeRequest<T>() callsnpm run ltfb before committingSee .github/copilot-instructions.md for detailed development guidelines.
If you find this project helpful, please consider supporting its development:
Solana (SOL)
CWZccD3Ny3XotFZtnkcyzP3hapmu3ExknN1PF4rEvP3uYou can also run npm fund in your project to see all funding information.
Future enhancements (all read-only):
bb_get_context)~~ COMPLETE~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.