Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ceweldy/bitwarden-agent-vault-mcp --skill bitwarden-agent-vaultgit clone --depth 1 https://github.com/ceweldy/bitwarden-agent-vault-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ceweldy/bitwarden-agent-vault-mcp/bitwarden-agent-vault)<a href="https://agentmods.dev/skills/ceweldy/bitwarden-agent-vault-mcp/bitwarden-agent-vault"><img src="https://agentmods.dev/badge/skills/ceweldy/bitwarden-agent-vault-mcp/bitwarden-agent-vault/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ceweldy/bitwarden-agent-vault-mcp/bitwarden-agent-vault"><img src="https://agentmods.dev/badge/skills/ceweldy/bitwarden-agent-vault-mcp/bitwarden-agent-vault.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00130 | $0.00893 |
| Opus 5 | $0.00065 | $0.00447 |
| Sonnet 5 | $0.00026 | $0.00179 |
| Haiku 4.5 | $0.00013 | $0.00089 |
Grade A, and why
bitwarden-agent-vault scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bitwarden Agent Vault MCP
Use the bitwarden-agent-vault MCP tools as the source of truth for stable agent credentials.
Required behavior
- Call
statusbefore the first vault operation in a task. If authorization is healthy, continue without involving the user. - Before asking the user for a credential they may have supplied previously, call
list_secretsorget_secretand search Bitwarden first. - When Codex successfully creates or generates a stable credential, call
store_secretimmediately, before using it elsewhere, handing it off, or finishing the task. Do this without asking the user to participate. - When the user supplies or Codex discovers a stable credential intended for future agent use, store it before continuing. If a credential authenticates beyond the current task, treat it as durable unless evidence shows that it expires shortly.
- Use the exact environment-variable name as the secret key when one exists, such as
SERVICE_API_KEY. Otherwise use a clear uppercase key such asSERVICE_PROD_ADMIN_PASSWORD. - Add a non-secret structured note with the available fields:
workspace,service,environment,account,source, andcreated. Never duplicate the value in the note. - Call
store_secretwithoverwrite: trueto rotate an existing value. Never create duplicates with the same key in one project. - Before finishing a task that created, received, discovered, or rotated a durable credential, verify its secret metadata with
list_secrets. Do not reveal the value during verification. - Do not automatically store one-time passwords, MFA codes, session cookies, short-lived access tokens, recovery codes, or temporary signed URLs unless the user explicitly asks.
- Prefer
run_with_secretswhen command execution is privately enabled, the executable is explicitly allowlisted, and a trusted command can consume selected secrets as environment variables. Never request more secret keys than the command needs. This keeps values out of normal model output and redacts exact known values from returned stdout and stderr. - Call
get_secretwhen private configuration enables plaintext reveal and the user explicitly asks to see a password or key, or when the task cannot use runtime injection. Return the requested value directly without an additional confirmation. - Call
open_bitwardenwhen the user asks to open the vault. Open the narrowest project page available.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 37 lines · 130 tokens per session scan A 819079c4688c
bitwarden-agent-vault is a skill published in the GitHub repository ceweldy/bitwarden-agent-vault-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 130 tokens to every session and 893 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other skills, from other repositories
create-pr
Creates a GitHub PR with a Linear-ticket-prefixed title and a decision-led, narrative description for prisma-next. Use when the user wants to create a pull request, open a PR, or submit changes for review.
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
no-bare-casts
Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.
write-architecture-docs
Write or rewrite architecture subsystem docs, ADRs, and reference material for the engineering team. Use when creating, updating, or reviewing docs under docs/architecture docs/, or when the user asks you to write documentation that describes the system's design.
Workspace Data Analyst
Analyze CSV files in the workspace and summarize insights.
featurevisor
Author, query, and integrate Featurevisor — Git-based feature flags, A/B experiments, and remote config. Use whenever the user mentions Featurevisor, works in a project containing featurevisor.config.js, edits files under attributes/, segments/, features/, variables/, groups/, schemas/, targets/, sets/, or tests/…