← Back to directory
B

Bitbucket Server MCP

Community
MCP server for managing Bitbucket Server pull requests
Category
Dev Tools #176 of 438
Stars
★ 69 Popular
Transport
stdio (local process)
Runtime
Node.js 16+
Credentials
API key / credential required
License
Apache-2.0
Last commit
Tools
27
56FMRS · C

This server offers a fairly comprehensive toolset for the Bitbucket Server pull-request workflow — project/repository discovery, PR creation through merge, comments and batch reviews, code search, and file browsing — with a read-only mode and custom headers for enterprise network setups; credentials must be protected and the irreversibility of write actions outside read-only mode should be kept in mind.

Strongest · Documentation 16/20 Weakest · Reliability 7/20

Reliability
7/20
Security and permissions
9/20
Maintenance
11/20
Documentation
16/20
Setup experience
13/20
Why each score
Reliability 7/20
Only the README text was available; no manifest was cached and no CI workflow files or committed tests are visible to verify that the MCP init/tool-list handshake actually works or that the 20+ documented tools match real behavior. Per the static-review rule, without verifiable execution evidence (CI + tests) reliability cannot exceed 12; it is scored further down because there is zero execution or test evidence at all, only documentation-level claims.
Security and permissions 9/20
Authentication via token or username/password through environment variables is a standard, acceptable pattern, and no real secrets appear in the docs. However, the default mode is full read-write; read-only restriction requires the operator to explicitly set BITBUCKET_READ_ONLY=true. Irreversible/high-impact operations (merge_pull_request, decline_pull_request, delete_branch, delete_comment) have no documented confirmation step — enforcement of caution relies on the calling LLM/user rather than the server. BITBUCKET_CUSTOM_HEADERS allows arbitrary header injection into outbound requests, a moderate but bounded exposure. No red-line issue is present (no malware, no credential exfiltration, no fabricated identity), but least-privilege defaults and confirmation for destructive actions are incomplete.
Maintenance 11/20
Apache-2.0 license is present and the repo is not archived. The README's 'New Features' section shows a stream of recently added functionality (custom headers, PR discovery, branch management, etc.) and references a specific issue number (#14), indicating some responsiveness to community feedback. However, there is no visible versioning scheme, changelog, release cadence, contribution guide, or security-response channel to confirm ongoing commit activity or maintainer stability, so this can only be judged 'active but with governance gaps.'
Documentation 16/20
The README is well-layered: installation (Smithery and manual), build steps, per-tool purpose/parameters/use cases, abundant CLI examples, environment variable reference, an explicit allow/deny tool list for read-only mode, log-path priority, and custom header formatting are all documented. It lacks a dedicated troubleshooting section, rate-limit guidance, error-code semantics, or discussion of cross-platform caveats and failure-mode behavior.
Setup experience 13/20
The install path is clear: `npm install` → `npm run build` → manual entry of the node path and environment variables in the MCP client config, plus a one-command Smithery installer covering a mainstream client. This remains a semi-manual process requiring a manual build and absolute path configuration, and there is no CI/test evidence in the repo to confirm the build/run chain actually works end-to-end, so per the static-review cap this dimension cannot exceed 15.

Static review · not runListed 2026-08-26

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

  • Teams running self-hosted Bitbucket Server / Data Center who want a conversational interface for PR workflows
  • CI/CD or proxy environments that need safe, read-only access to Bitbucket data
  • Organizations behind Zero Trust networks that need custom headers to reach Bitbucket

Not for

  • Users on Bitbucket Cloud (bitbucket.org) rather than Bitbucket Server/Data Center, since this server targets the Server API
  • Users unwilling to run a local Node.js MCP server process

Required permissions

  • Requires a Bitbucket Server personal access token, or username/password basic-auth credentials
  • The scope of allowed operations is bounded by the configured credential's repository permissions; write actions (create/merge/comment/delete branch, etc.) need corresponding write access
  • Optional custom HTTP headers are sent with every request and may carry sensitive tokens that must be managed carefully

Risks and side effects

  • Authentication tokens or passwords are configured as plaintext environment variables and must be stored/transmitted securely
  • Outside read-only mode, the model can directly merge, decline, delete branches, and delete comments — irreversible or collaboration-impacting actions with real misuse potential
  • The log file is written to local disk by default (`~/.bitbucket-server-mcp/bitbucket.log`) and may capture sensitive operation details

Setup

Before you start

Runtime:Node.js 16+

BITBUCKET_URL required Required: base URL of your Bitbucket Server instance.
BITBUCKET_TOKEN optionalsecret Personal access token generated in Bitbucket Server; alternative to username/password auth.
BITBUCKET_PASSWORD optionalsecret Bitbucket password, used with BITBUCKET_USERNAME.
Other optional settings (6)
BITBUCKET_USERNAME optional Bitbucket username, used with BITBUCKET_PASSWORD for basic authentication.
BITBUCKET_DEFAULT_PROJECT optional Optional default project key used when a tool call does not specify a project.
BITBUCKET_DIFF_MAX_LINES_PER_FILE optional Optional default maximum lines shown per file in diffs to keep output manageable.
BITBUCKET_LOG_PATH optional Optional custom log file path; defaults to ~/.bitbucket-server-mcp/bitbucket.log.
BITBUCKET_READ_ONLY optional Set to true to enable read-only mode that disables all write operations.
BITBUCKET_CUSTOM_HEADERS optional Optional comma-separated custom HTTP headers, useful for Zero Trust tokens or proxy headers.
  1. Ensure Node.js >= 16 is installed.
  2. Optionally install via Smithery (npx -y @smithery/cli install @garc33/bitbucket-server-mcp-server --client claude), or install manually with npm install followed by npm run build.
  3. Add a server entry to your MCP client configuration, setting command to node and args to the path of the built build/index.js.
  4. Set required environment variables: BITBUCKET_URL, plus either BITBUCKET_TOKEN or BITBUCKET_USERNAME/BITBUCKET_PASSWORD for authentication; optionally set BITBUCKET_DEFAULT_PROJECT, BITBUCKET_READ_ONLY, BITBUCKET_CUSTOM_HEADERS, BITBUCKET_LOG_PATH, and BITBUCKET_DIFF_MAX_LINES_PER_FILE.
  5. Restart the client to load the new server.
claude_desktop_config.json
{"mcpServers":{"bitbucket":{"command":"node","args":["/path/to/bitbucket-server/build/index.js"],"env":{"BITBUCKET_URL":"https://your-bitbucket-server.com","BITBUCKET_TOKEN":"your-access-token","BITBUCKET_DEFAULT_PROJECT":"your-default-project"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "bitbucket": {
      "command": "node",
      "args": [
        "/path/to/bitbucket-server/build/index.js"
      ],
      "env": {
        "BITBUCKET_URL": "https://your-bitbucket-server.com",
        "BITBUCKET_TOKEN": "your-access-token",
        "BITBUCKET_DEFAULT_PROJECT": "your-default-project"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add bitbucket -e BITBUCKET_URL=https://your-bitbucket-server.com -e BITBUCKET_TOKEN=your-access-token -e BITBUCKET_DEFAULT_PROJECT=your-default-project -- node /path/to/bitbucket-server/build/index.js

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

After building the project, tools such as list_projects and get_pull_request should appear in your client's tool list; run list_projects — if it returns projects from your Bitbucket instance, the connection works.

Troubleshooting

  1. Verify `BITBUCKET_URL` and authentication (token or username/password) are correct and the account has the needed repository permissions
  2. If write operations are rejected, check whether `BITBUCKET_READ_ONLY=true` was set unintentionally
  3. If a tool call complains about a missing project, set `BITBUCKET_DEFAULT_PROJECT` or pass the `project` parameter explicitly
  4. Check the log file (default `~/.bitbucket-server-mcp/bitbucket.log`, or the `BITBUCKET_LOG_PATH` override) for detailed error messages
  5. Confirm `npm install` and `npm run build` were run, and that the client config path points to the correct `build/index.js`

Things to try

Once connected, you can ask your AI assistant things like:

  • List all accessible projects on my Bitbucket Server
  • Search code in my-repo under MYPROJECT for usage of the getUserData function
  • Show me the diff of pull request 123 in my-repo, then approve and merge it with squash strategy
  • List all open pull requests in my-repo authored by john.doe

Tools 27

list_projects read-only
Lists all accessible Bitbucket projects with their details, useful for project discovery and finding correct project keys.
list_repositories read-only
Browses repositories within a specific project or across all accessible projects, returning clone URLs and metadata.
create_pull_request writes
Creates a new pull request with source/target branches and reviewers, supporting cross-repository PRs from forks.
update_pull_request writes
Safely updates a pull request's title, description, or reviewers using a read-modify-write pattern that preserves unspecified fields.
get_pull_request read-only
Retrieves detailed pull request information including status, reviewers, commits, and metadata.
merge_pull_request writes
Merges an approved pull request using merge-commit, squash, or fast-forward strategy.
decline_pull_request writes
Declines a pull request that should not be merged, optionally with a reason message.
add_comment writes
Adds a comment to a pull request, supporting Markdown, threaded replies, and open or pending (draft) state.
Show 19 more tools
add_comment_inline writes
Adds an inline comment on a specific line of a pull request's diff.
get_diff read-only
Retrieves the code diff for a pull request, with configurable context lines and per-file line limits for large diffs.
get_reviews read-only
Fetches review history, approval status, and reviewer feedback for a pull request.
get_activities read-only
Gets the complete activity timeline for a pull request, including comments, reviews, and commits.
get_comments read-only
Filters pull request activities to return only comments, focusing on discussion content.
search read-only
Searches code and filenames across repositories with project/repository filtering; only works on default branches.
get_file_content read-only
Reads the content of a specific file from a repository, with pagination for large files.
browse_repository read-only
Browses files and directories in a repository to explore its structure.
list_pull_requests read-only
Lists pull requests in a repository, filterable by state, author, and direction.
list_branches read-only
Lists repository branches, identifying the default branch and latest commit info per branch.
list_commits read-only
Lists commit history for a repository, filterable by branch and author.
delete_branch destructive
Deletes a branch from a repository, with a safety check preventing deletion of the default branch.
approve_pull_request writes
Approves a pull request as the current authenticated user.
unapprove_pull_request writes
Removes the current user's approval from a pull request.
edit_comment writes
Edits an existing comment's text, requiring the comment version for optimistic locking.
delete_comment destructive
Deletes a comment from a pull request, requiring the comment version for optimistic locking.
publish_review writes
Publishes all pending draft comments at once, optionally setting an approval status and overview comment.
get_code_insights read-only
Fetches Code Insights reports (e.g. SonarQube, security scans) and their annotations for a pull request.
get_dashboard_pull_requests read-only
Lists pull requests across all repositories for the authenticated user, filterable by role and status.

Use cases

Create, review, approve, and merge Bitbucket Server pull requests directly from an AI assistant
Search code across projects, browse repository structure, and read file contents
Inspect pull request diffs, comments, review status, and CI/CD code insight results
Manage branches (list, filter, delete merged ones) and browse commit history

Supported clients

Claude Desktop
VS Code

Listed from the project's documentation, not tested by this site.

Overview

Bitbucket Server MCP is a Node.js MCP server that exposes the Bitbucket Server REST API for project and repository discovery, full pull-request lifecycle management (create, update, approve, merge, decline), code search, file reading, branch and commit history browsing, comment management, and CI/CD code insights (e.g. SonarQube). It supports configuring a default project, a read-only mode, and custom HTTP headers (useful for Zero Trust tokens or proxies) via environment variables.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →

Source revision 7c8a414cadfc Data synced 2026-10-19 Read the FMRS scoring method