
Bitbucket MCP Server by pdogra1299: Setup for Claude, Cursor and Other Apps
Lets Claude, Cursor and other assistants search Bitbucket code, review pull requests and manage branches and comments.
This server lets an assistant search code, read files, review pull requests and, if you allow it, comment, approve, merge and delete branches in Bitbucket. It is a community project by pdogra1299, not an Atlassian product. It runs on your computer with your Bitbucket username and a token, and works best with Bitbucket Server or Data Center. Turn on its read-only setting first: by default it can merge pull requests and delete branches.
Good for
- Developers on Bitbucket Server or Data Center who want fast code search from the assistant
- Reviewers who want pull requests summarized, diffed and commented on
- Teams that want a read-only setup so an agent can look at code and pull requests but not change them
- Bitbucket Cloud users who sign in with an app password
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install Bitbucket MCP
Claude Code
- 1
Copy this prompt.
Add the Bitbucket MCP server to Claude Code. Run this command: claude mcp add bitbucket -e BITBUCKET_USERNAME=<BITBUCKET_USERNAME> -e BITBUCKET_TOKEN=<BITBUCKET_TOKEN> -e BITBUCKET_BASE_URL=<BITBUCKET_BASE_URL> -- npx -y @nexus2520/bitbucket-mcp-server Ask me for BITBUCKET_USERNAME, BITBUCKET_TOKEN, BITBUCKET_BASE_URL and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Node.js 22+, Bitbucket token or app password.
Read-only mode: Add BITBUCKET_READ_ONLY set to true to the env block. Add BITBUCKET_PROTECTED_BRANCHES (for example main,release/*) to block merges and deletes on those branches.
Set your Bitbucket username and a token. On Bitbucket Server or Data Center, set BITBUCKET_BASE_URL to your Bitbucket address. On Bitbucket Cloud, leave BITBUCKET_BASE_URL out and use BITBUCKET_APP_PASSWORD in place of BITBUCKET_TOKEN. The config here follows the Server and Data Center example in the README. Node.js 22 or newer is required.
Built from the package data we hold. Not yet tested by us.
Tools
Searches file contents in a repo with regex
Searches a repo's files with a full regular expression on any branch, like ripgrep on a local clone. It downloads one archive per repo and commit, and works only on Bitbucket Server or Data Center. Leave out the query to list file names by glob.
Try: “Find every use of parseConfig in the payments repo on the release branch.”
Network ·
grepSearches a whole project for an exact term
Looks up an exact term across all repos in a project using Bitbucket's index. It covers the default branch only, has no regex, and works only on Server or Data Center.
Try: “Which repos in PROJ mention LEGACY_AUTH_FLAG?”
Network ·
search_codeFinds repositories by name or description
Searches the whole Bitbucket instance for repos by name or description. Server or Data Center only.
Try: “Find repositories about invoice export.”
Network ·
search_repositoriesLists projects or workspaces you can see
Lists the projects (Server) or workspaces (Cloud) your account can access.
Try: “Which Bitbucket projects can I see?”
Network ·
list_projectsLists repositories in a project
Lists repos in one project, or every repo you can access on Server.
Try: “List the repos in project PAY.”
Network ·
list_repositoriesShows a pull request in full
Returns details, reviewer status, merge info, comments and changed files for a pull request. You can switch comments and files off for a quick read, or add tasks.
Try: “Summarize PR 482 in the billing repo, including open tasks.”
Network ·
get_pull_requestLists pull requests
Lists pull requests in a repo. On Server, leave out the repo to see your own pull requests across all repos, filtered by your role.
Try: “Show the pull requests I need to review.”
Network ·
list_pull_requestsReads a pull request's changes
Returns the raw unified diff for a pull request. You can limit it to one file, include or exclude patterns, change context lines or ignore whitespace.
Try: “Show me the diff for src/auth in PR 482.”
Network ·
get_pull_request_diffLists commits in a pull request
Lists the commits that make up a pull request.
Try: “Which commits are in PR 482?”
Network ·
list_pr_commitsLists commits on a branch
Lists commits on a branch, with filters for merges, an earlier revision, author, date and text.
Try: “What did Priya commit to release/2.4 this week?”
Network ·
list_branch_commitsShows one commit
Returns a commit's diff, or only the list of changed files if you ask for detail "files".
Try: “Which files changed in commit a1b2c3d?”
Network ·
get_commit_detailLists branches
Lists branches, most recently changed first on Server.
Try: “Which branches changed most recently in checkout-service?”
Network ·
list_branchesShows a branch and its pull requests
Returns a branch with its latest commit and open pull requests, and merged ones if you ask.
Try: “Is there an open PR for feature/refund-flow?”
Network ·
get_branchLists files in a repo folder
Lists files and folders at a path in a repository.
Try: “What is in the src/services folder?”
Network ·
list_directory_contentReads a file or a window of it
Reads a file from the repo. By default it transfers only the lines you ask for (up to 5,000 per call), and it can return the whole file or the tail.
Try: “Show lines 120 to 200 of OrderService.java on main.”
Network ·
get_file_contentShows who last changed each line
Returns commit-span blame for a window of lines in one call. Server or Data Center only.
Try: “Who last changed lines 40 to 80 of PaymentRouter.kt?”
Network ·
get_file_blameOpens a pull request
Creates a pull request from a source branch to a destination branch.
Try: “Open a PR from feature/refund-flow to main titled "Add refund flow".”
Write ·
create_pull_requestEdits a pull request
Changes a pull request's details such as title, description or reviewers.
Try: “Add Sam as a reviewer on PR 482.”
Write ·
update_pull_requestComments on a pull request
Adds a general comment, a threaded reply, an inline comment on a line, a code suggestion, or a blocker task. On Server it can attach files, but only from a folder you allow.
Try: “Comment on line 42 of auth.ts in PR 482: this needs a null check.”
Write ·
add_commentEdits, resolves or deletes comments
Edits, deletes, resolves or reopens a comment or task, and on Server converts between a comment and a task. It is marked destructive.
Try: “Resolve the comment thread on line 42.”
Delete ·
manage_commentApproves or requests changes
Sets your review status on a pull request to approved, needs work or unapproved.
Try: “Approve PR 482.”
Write ·
set_review_statusMerges a pull request
Merges a pull request into its destination branch. You can list protected branches that it must refuse to merge into.
Try: “Merge PR 482.”
Write ·
merge_pull_requestDeclines a pull request
Declines a pull request, with an optional comment.
Try: “Decline PR 480 and say it is superseded by 482.”
Write ·
decline_pull_requestDeletes a branch
Deletes a branch from the repo. The protected-branches setting can block it for named branches.
Try: “Delete the merged branch feature/old-login.”
Delete ·
delete_branchDownloads or deletes an attachment
Downloads (size-capped) or deletes a repository attachment by its number. Server only. Deletion is refused in read-only mode.
Try: “Download attachment 17 from the docs repo.”
Delete ·
manage_attachments
Read from the source code
Permissions
high risk · 4 things to watch
High risk
With the default setup the assistant can merge and decline pull requests, approve, comment, delete comments and branches, and delete attachments. Set BITBUCKET_READ_ONLY to true for agents that only need to read, and list your main branches in BITBUCKET_PROTECTED_BRANCHES.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
It can merge pull requests and delete branches
By default the assistant can merge or decline pull requests and delete branches, comments and attachments with the permissions of your token. Set BITBUCKET_READ_ONLY=true, and use BITBUCKET_PROTECTED_BRANCHES to block merges and deletes on main and release branches. github.com
It acts as you, with your token
Approvals, comments and merges are made under your username. Use a token for a service account with only the repos it needs. github.com
Attachment uploads read local files, off by default
Uploads stay refused until you set BITBUCKET_ATTACHMENT_ROOT, and then can read only regular files inside that folder. github.com
Read-only mode still allows attachment downloads
Attachment downloads keep working under BITBUCKET_READ_ONLY, with a size cap. Deletion is refused. github.com
Security advisories
No published security advisories as of Nov 1, 2026.
Technical details
| Turning on read-only | Set BITBUCKET_READ_ONLY=true. It hides and refuses create, update, merge and decline pull request, comments, review status, delete branch and attachment delete. Downloads still work. |
|---|---|
| Talks to | Your Bitbucket server or bitbucket.org API |
| Sign-in and keys | Username plus a token (Server or Data Center) or app password (Cloud), passed in environment variables. The README says log lines are scrubbed for authorization values. |
Questions
Is this the official Bitbucket MCP server?
No. It is a community project by pdogra1299, published on npm as @nexus2520/bitbucket-mcp-server. Atlassian, who own Bitbucket, ship their own hosted Atlassian Rovo MCP server (see the Atlassian MCP page), and this one is not made by them. This server is aimed mainly at Bitbucket Server and Data Center, and also supports Cloud.
Does it work with Bitbucket Cloud?
Yes, with fewer tools. Server and Data Center are the main target. Cloud uses an app password in BITBUCKET_APP_PASSWORD, and tools such as grep, search_code and get_file_blame are Server only.
What credentials does it need?
Your Bitbucket username plus an HTTP access token for Server or Data Center, or an app password for Cloud. Server also needs BITBUCKET_BASE_URL set to your Bitbucket address.
Can I run it read-only?
Yes. Set BITBUCKET_READ_ONLY to true and every state-changing tool is hidden and refused. You can also hide single tools with BITBUCKET_DISABLED_TOOLS.
Can it merge or delete things?
Yes, by default. It can merge and decline pull requests, delete branches, comments and attachments. BITBUCKET_PROTECTED_BRANCHES makes it refuse merges and branch deletes on branches you name.
What Node.js version does it need?
Node.js 22 or newer. Node 18 and 20 are end-of-life and no longer get security fixes, which is why the package requires 22.
Why do older guides list 33 tools instead of 25?
Version 3 merged several task and search tools into fewer ones, so the count dropped from 33 to 25. Update saved tool allowlists if you used the old names.
Does it run locally or in the cloud?
Locally, as a process your app starts. It sends requests to your Bitbucket server or the Bitbucket Cloud API with your credentials.
Information
updated Nov 2, 2026
- Publisher
- Community
- Package
@nexus2520/bitbucket-mcp-server- Registry
- npm
- Transport
- stdio
- Auth
- token in env
- Version
- 4.0.0
- License
- MIT
- Last commit
- Oct 26, 2026
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 3Hide
- github.com · github.com
- github.com · github.com
- github.com · github.com