PlugWiki
Bitbucket MCP Server logo

Bitbucket MCP Server by pdogra1299: Setup for Claude, Cursor and Other Apps

CommunityLocal
Getnpm@nexus2520/bitbucket-mcp-serverpdogra1299/bitbucket-mcp-server

Lets Claude, Cursor and other assistants search Bitbucket code, review pull requests and manage branches and comments.

This server lets an assistant search code, read files, review pull requests and, if you allow it, comment, approve, merge and delete branches in Bitbucket. It is a community project by pdogra1299, not an Atlassian product. It runs on your computer with your Bitbucket username and a token, and works best with Bitbucket Server or Data Center. Turn on its read-only setting first: by default it can merge pull requests and delete branches.

Good for

  • Developers on Bitbucket Server or Data Center who want fast code search from the assistant
  • Reviewers who want pull requests summarized, diffed and commented on
  • Teams that want a read-only setup so an agent can look at code and pull requests but not change them
  • Bitbucket Cloud users who sign in with an app password

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install Bitbucket MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the Bitbucket MCP server to Claude Code. Run this command:
    
    claude mcp add bitbucket -e BITBUCKET_USERNAME=<BITBUCKET_USERNAME> -e BITBUCKET_TOKEN=<BITBUCKET_TOKEN> -e BITBUCKET_BASE_URL=<BITBUCKET_BASE_URL> -- npx -y @nexus2520/bitbucket-mcp-server
    
    Ask me for BITBUCKET_USERNAME, BITBUCKET_TOKEN, BITBUCKET_BASE_URL and only put the values in that config, nowhere else.
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js 22+, Bitbucket token or app password.

Read-only mode: Add BITBUCKET_READ_ONLY set to true to the env block. Add BITBUCKET_PROTECTED_BRANCHES (for example main,release/*) to block merges and deletes on those branches.

Set your Bitbucket username and a token. On Bitbucket Server or Data Center, set BITBUCKET_BASE_URL to your Bitbucket address. On Bitbucket Cloud, leave BITBUCKET_BASE_URL out and use BITBUCKET_APP_PASSWORD in place of BITBUCKET_TOKEN. The config here follows the Server and Data Center example in the README. Node.js 22 or newer is required.

Built from the package data we hold. Not yet tested by us.

Tools

  • Searches file contents in a repo with regex

    Searches a repo's files with a full regular expression on any branch, like ripgrep on a local clone. It downloads one archive per repo and commit, and works only on Bitbucket Server or Data Center. Leave out the query to list file names by glob.

    Try: “Find every use of parseConfig in the payments repo on the release branch.”

    Network · grep

  • Searches a whole project for an exact term

    Looks up an exact term across all repos in a project using Bitbucket's index. It covers the default branch only, has no regex, and works only on Server or Data Center.

    Try: “Which repos in PROJ mention LEGACY_AUTH_FLAG?”

    Network · search_code

  • Finds repositories by name or description

    Searches the whole Bitbucket instance for repos by name or description. Server or Data Center only.

    Try: “Find repositories about invoice export.”

    Network · search_repositories

  • Lists projects or workspaces you can see

    Lists the projects (Server) or workspaces (Cloud) your account can access.

    Try: “Which Bitbucket projects can I see?”

    Network · list_projects

  • Lists repositories in a project

    Lists repos in one project, or every repo you can access on Server.

    Try: “List the repos in project PAY.”

    Network · list_repositories

  • Shows a pull request in full

    Returns details, reviewer status, merge info, comments and changed files for a pull request. You can switch comments and files off for a quick read, or add tasks.

    Try: “Summarize PR 482 in the billing repo, including open tasks.”

    Network · get_pull_request

  • Lists pull requests

    Lists pull requests in a repo. On Server, leave out the repo to see your own pull requests across all repos, filtered by your role.

    Try: “Show the pull requests I need to review.”

    Network · list_pull_requests

  • Reads a pull request's changes

    Returns the raw unified diff for a pull request. You can limit it to one file, include or exclude patterns, change context lines or ignore whitespace.

    Try: “Show me the diff for src/auth in PR 482.”

    Network · get_pull_request_diff

  • Lists commits in a pull request

    Lists the commits that make up a pull request.

    Try: “Which commits are in PR 482?”

    Network · list_pr_commits

  • Lists commits on a branch

    Lists commits on a branch, with filters for merges, an earlier revision, author, date and text.

    Try: “What did Priya commit to release/2.4 this week?”

    Network · list_branch_commits

  • Shows one commit

    Returns a commit's diff, or only the list of changed files if you ask for detail "files".

    Try: “Which files changed in commit a1b2c3d?”

    Network · get_commit_detail

  • Lists branches

    Lists branches, most recently changed first on Server.

    Try: “Which branches changed most recently in checkout-service?”

    Network · list_branches

Read from the source code

Permissions

high risk · 4 things to watch

High risk

With the default setup the assistant can merge and decline pull requests, approve, comment, delete comments and branches, and delete attachments. Set BITBUCKET_READ_ONLY to true for agents that only need to read, and list your main branches in BITBUCKET_PROTECTED_BRANCHES.

What it can do

Watch out for

  • It can merge pull requests and delete branches

    By default the assistant can merge or decline pull requests and delete branches, comments and attachments with the permissions of your token. Set BITBUCKET_READ_ONLY=true, and use BITBUCKET_PROTECTED_BRANCHES to block merges and deletes on main and release branches. github.com

  • It acts as you, with your token

    Approvals, comments and merges are made under your username. Use a token for a service account with only the repos it needs. github.com

  • Attachment uploads read local files, off by default

    Uploads stay refused until you set BITBUCKET_ATTACHMENT_ROOT, and then can read only regular files inside that folder. github.com

  • Read-only mode still allows attachment downloads

    Attachment downloads keep working under BITBUCKET_READ_ONLY, with a size cap. Deletion is refused. github.com

Security advisories

No published security advisories as of Nov 1, 2026.

Technical details
Turning on read-onlySet BITBUCKET_READ_ONLY=true. It hides and refuses create, update, merge and decline pull request, comments, review status, delete branch and attachment delete. Downloads still work.
Talks toYour Bitbucket server or bitbucket.org API
Sign-in and keysUsername plus a token (Server or Data Center) or app password (Cloud), passed in environment variables. The README says log lines are scrubbed for authorization values.

Questions

Is this the official Bitbucket MCP server?

No. It is a community project by pdogra1299, published on npm as @nexus2520/bitbucket-mcp-server. Atlassian, who own Bitbucket, ship their own hosted Atlassian Rovo MCP server (see the Atlassian MCP page), and this one is not made by them. This server is aimed mainly at Bitbucket Server and Data Center, and also supports Cloud.

Does it work with Bitbucket Cloud?

Yes, with fewer tools. Server and Data Center are the main target. Cloud uses an app password in BITBUCKET_APP_PASSWORD, and tools such as grep, search_code and get_file_blame are Server only.

What credentials does it need?

Your Bitbucket username plus an HTTP access token for Server or Data Center, or an app password for Cloud. Server also needs BITBUCKET_BASE_URL set to your Bitbucket address.

Can I run it read-only?

Yes. Set BITBUCKET_READ_ONLY to true and every state-changing tool is hidden and refused. You can also hide single tools with BITBUCKET_DISABLED_TOOLS.

Can it merge or delete things?

Yes, by default. It can merge and decline pull requests, delete branches, comments and attachments. BITBUCKET_PROTECTED_BRANCHES makes it refuse merges and branch deletes on branches you name.

What Node.js version does it need?

Node.js 22 or newer. Node 18 and 20 are end-of-life and no longer get security fixes, which is why the package requires 22.

Why do older guides list 33 tools instead of 25?

Version 3 merged several task and search tools into fewer ones, so the count dropped from 33 to 25. Update saved tool allowlists if you used the old names.

Does it run locally or in the cloud?

Locally, as a process your app starts. It sends requests to your Bitbucket server or the Bitbucket Cloud API with your credentials.

Information

updated Nov 2, 2026

Publisher
Community
Package
@nexus2520/bitbucket-mcp-server
Registry
npm
Transport
stdio
Auth
token in env
Version
4.0.0
License
MIT
Last commit
Oct 26, 2026

GitHubnpm

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 3
  1. github.com · github.com
  2. github.com · github.com
  3. github.com · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.