About Bugwarden
Bugwarden is an MCP server published by plusky in the Security category: security-guarded MCP server for Bugzilla, written in Rust.
The repository has 7 stars and 3 forks, with the last commit 3 days ago. Recent commit activity is the strongest signal that reported issues will get attention.
Install
From source
git clone https://github.com/plusky/bugwardenThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (22)
add_attachmentUpload a base64-encoded attachment to a bug, optionally private or flagged as a patch, capped by `max_attachment_bytes` (decoded size)
Parameters not published.
add_cc_to_bugAdd an email to the CC list (the tool only adds; removal is not exposed)
Parameters not published.
add_commentAdd a comment to a bug, optionally private
Parameters not published.
assign_bugSet the assignee
Parameters not published.
bug_commentsComments on a bug; private comments only per the private-comment gate. Optional windowing for large threads: `head` (first N — comment 0 is the report), `tail` (last N), `max_comment_chars` (per-comment character cap); when any is set the response is an object with `comments` and a `truncation` block instead of a bare array
Parameters not published.
bug_fields*(needs `global.allow_discovery = true`)* Lists bug fields (without legal values), or fetches up to 5 named fields with their legal values — each carrying `is_open` and `can_change_to` when Bugzilla reports them (only `bug_status` does), so a client can learn the workflow instead of guessing it — as Bugzilla reports it to this server's key, never filtered by this policy
Parameters not published.
bug_historyChange history of a bug, optionally only entries newer than a timestamp; `head`/`tail` keep only the first/last N entries — with either set the response is an envelope with a truncation summary instead of the bare array
Parameters not published.
bug_infoDetails for up to 25 bug ids. Per id: full details with `read`, redacted summary with `summary`, otherwise a uniform "not accessible" entry. Optional size control: `include_fields` (comma-separated projection; `id` always included) or `detail=false` (drops the duplicated `*_detail` fields); mutually exclusive
Parameters not published.
bug_urlCompute `{server}/show_bug.cgi?id={id}` locally
Parameters not published.
bugs_quicksearchBugzilla [quicksearch](https://bugzilla.readthedocs.io/en/latest/using/finding.html#quicksearch) — the `status` filter (default `ALL`) is prefixed to the query, and under any non-empty status a number in the query is content-matched, so it also matches bugs that merely mention it; with an empty `status` the query goes to Bugzilla bare, where a query of nothing but numbers is an exact id lookup (use `bug_info` for an exact set of known ids; an all-ids query gets an advisory note saying so). Paginated by `limit` (default 50) and `offset` (default 0) over the bugs the client may see. Optional `group_by` (comma-separated: `product`, `component`, `status`, `resolution`, `severity`, `priority`) buckets the results — the response becomes an object with `groups` instead of `bugs`, and each grouped field is reported once per group rather than once per bug. Results are silently policy-filtered (denied dropped, summary-only redacted)
Parameters not published.
Show all 22 tools
bugzilla_products*(needs `global.allow_discovery = true`)* Lists enterable product names, or fetches components/versions/milestones for up to 5 named products — as Bugzilla reports it to this server's key, never filtered by this policy
Parameters not published.
bugzilla_server_infoBugzilla version, extensions, timezone, time, parameters
Parameters not published.
create_bugFile a new bug, including `cf_*` custom fields; the request is policy-checked *as described* before anything is created. A policy refusal and a Bugzilla-side failure return the same refusal text at the same cost, so a failed create never says which of the two refused, or why
Parameters not published.
download_attachmentContent of one attachment, alongside a JSON summary of its metadata: raster images (PNG, JPEG, GIF, WebP, BMP) as image content, everything else as a base64 blob resource under `bugzilla://attachment/{id}`. Text-ish attachments (`text/*` plus a small `application/*` allowlist) can be windowed with optional `head_lines`/`tail_lines`/`max_chars` — first/last lines of the decoded text, the result capped in characters, returned as a plain text block with truncation counts in the summary; the params are ignored (with a summary note) on non-text payloads and on one whose base64 will not decode. Windowed text is capped at 200 000 characters even without `max_chars`, because JSON escaping can inflate a payload well past its byte size. Capped by `max_attachment_bytes` on the FULL payload regardless of windowing; private attachments need the private-content double opt-in and, on download, a *missing* privacy flag counts as private
Parameters not published.
list_attachmentsAttachment metadata (never attachment content)
Parameters not published.
mark_as_duplicateMark a bug as DUPLICATE of another, with an auto-generated comment when none is given; Bugzilla applies its configured duplicate status
Parameters not published.
mcp_server_infoThis server's name and version, the Bugzilla URL, the transport, and a coarse policy summary: rule count, default action, `min_bug_age_days`, read-only flag, disabled tool names. Never a rule name or a match criterion
Parameters not published.
quicksearch_syntaxBugzilla's quicksearch syntax documentation (HTML)
Parameters not published.
summarize_bugReturns a summarization prompt built from the bug's public comments. Private comments are excluded unconditionally — this tool has no opt-in
Parameters not published.
update_bug_dependenciesAdd/remove blocks and depends_on entries
Parameters not published.
update_bug_fieldsUpdate priority/severity/resolution, summary, URL, whiteboard, version, target milestone, keywords and see-also links (both add/remove, never replace-all), and `cf_*` custom fields
Parameters not published.
update_bug_statusChange status and, optionally, resolution — both instance-defined; use `bug_fields` to discover them. Bugzilla requires a resolution when the target status is closing and the bug has none, and clears any resolution itself when the target status is open
Parameters not published.
Ask AI
✦
Ask AI about Bugwarden
Powered by Claude · Grounded in docs
I know everything about Bugwarden. Ask me about installation, configuration, usage, or troubleshooting.
Security checks
6 checks have not been run yet.