
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@tugudush/bitbucket-mcp
Advanced tools
A Model Context Protocol server for Bitbucket with read-only operations
A read-only Model Context Protocol (MCP) server that provides secure access to Bitbucket repositories, pull requests, issues, and more. Integrates seamlessly with VS Code GitHub Copilot and Claude Desktop.
bb_search_code
functionality💡 How to create an API Token:
- Go to https://id.atlassian.com/manage-profile/security/api-tokens
- Click "Create API token"
- Enter a label (e.g., "Bitbucket MCP Server")
- Copy the generated token and use it as
BITBUCKET_API_TOKEN
- Use your Atlassian account email as
BITBUCKET_EMAIL
npm install -g @tugudush/bitbucket-mcp
git clone https://github.com/tugudush/bitbucket-mcp.git
cd bitbucket-mcp
npm install
npm run build
⚠️ Note: This step is only needed for manual testing. If you're going directly to step 3 (Integration), you can skip this step as authentication is configured in the integration files.
For manual server testing, choose one authentication method:
API Tokens (Recommended)
export BITBUCKET_API_TOKEN="your-api-token"
export BITBUCKET_EMAIL="your-atlassian-email"
App Passwords (Legacy - deprecated Sept 9, 2025)
export BITBUCKET_USERNAME="your-username"
export BITBUCKET_APP_PASSWORD="your-app-password"
Without Authentication: The server will work with public repositories only.
For most users, this is where you actually configure authentication credentials.
After installing with npm install -g @tugudush/bitbucket-mcp
:
VS Code GitHub Copilot
// .vscode/mcp.json
{
"servers": {
"bitbucket-mcp": {
"type": "stdio",
"command": "bitbucket-mcp",
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "your@email.com"
}
}
}
}
Claude Desktop
// claude_desktop_config.json
{
"mcpServers": {
"bitbucket": {
"command": "npx",
"args": ["@tugudush/bitbucket-mcp"],
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "your@email.com"
}
}
}
}
If you built from source:
VS Code GitHub Copilot
// .vscode/mcp.json
{
"servers": {
"bitbucket-mcp": {
"type": "stdio",
"command": "node",
"args": ["/path/to/build/index.js"],
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "your@email.com"
}
}
}
}
Claude Desktop
// claude_desktop_config.json
{
"mcpServers": {
"bitbucket": {
"command": "node",
"args": ["/path/to/build/index.js"],
"env": {
"BITBUCKET_API_TOKEN": "your-token",
"BITBUCKET_EMAIL": "your@email.com"
}
}
}
}
💡 Tips:
/path/to/build/index.js
with the absolute path to your built serverRepository Management
bb_list_workspaces
- Discover accessible workspacesbb_list_repositories
- List repositories across workspacesbb_get_repository
- Get repository detailsbb_browse_repository
- Explore directory structure (supports branches with slashes like feature/SSP-1024
)bb_get_file_content
- Read files with pagination (1-10,000 lines)Pull Requests & Issues
bb_get_pull_requests
, bb_get_pull_request
- Browse pull requestsbb_get_pull_request_comments
, bb_get_pull_request_activity
- Track reviewsbb_get_issues
, bb_get_issue
- Monitor issuesVersion Control
bb_get_branches
, bb_get_commits
- Explore repository historySearch & Discovery
bb_search_code
- Advanced code search with language filteringbb_search_repositories
- Find repositoriesUser & Workspace Info
bb_get_user
, bb_get_current_user
- User informationbb_get_workspace
- Workspace detailsRepository Discovery:
Advanced File Operations:
Code Search:
Pull Requests & Issues:
npm run ltf # Lint + Typecheck + Format
npm run build # Compile TypeScript
npm run watch # Development mode
node build/index.js # Test server
VS Code Integration:
.vscode/
configurationCtrl+Alt+I
using bitbucket, list repositories in myworkspace
feature/SSP-1024
)🚧 This project is under active development and may contain incomplete features or breaking changes. We welcome contributions and feedback!
The server implements tools for the most commonly used Bitbucket API endpoints:
If you find this project helpful, please consider supporting its development:
Support this project with cryptocurrency:
Bitcoin (BTC)
17v2iVCXoxrKMdnUTEqETGfjxUXNnhyE2k
Ethereum (ETH)
0xc924d430473bfec6d51e3aac5f4dd9adbe77e84e
Ripple (XRP)
Address:
rpWJmMcPM4ynNfvhaZFYmPhBq5FYfDJBZu
Destination Tag:
1135041300
Solana (SOL)
89pm44ME76HxrCXtWxotjvkoXHNYFAfkzP8GS88pg7Fg
You can also run npm fund
in your project to see all funding information.
Future enhancements (all read-only):
[1.4.13] - 2025-08-23
FAQs
A Model Context Protocol server for Bitbucket with read-only operations
The npm package @tugudush/bitbucket-mcp receives a total of 31 weekly downloads. As such, @tugudush/bitbucket-mcp popularity was classified as not popular.
We found that @tugudush/bitbucket-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.