[[command]]
name = "bw"
description = "Bitwarden CLI — manages Bitwarden vault items. Every meaningful subcommand contacts the Bitwarden server over the network. `list`, `get`, `status`, `fingerprint`, `template`, `pending` are read-only. `sync` syncs local state with the server. `lock`, `unlock`, `login`, `logout` change session state. `create`, `edit`, `delete`, `restore`, `move`, `share`, `confirm`, `import`, `export` mutate vault data."
url = "https://bitwarden.com/help/cli/"
researched_version = "bw 2025.x"
bare_flags = ["--help", "--version", "-h", "-v"]
[[command.sub]]
name = "status"
level = "SafeRead"
bare = true
standalone = ["--help", "-h"]
[[command.sub]]
name = "version"
standalone = ["--help", "-h"]
[[command.sub]]
name = "fingerprint"
level = "SafeRead"
bare = false
tolerate_unknown_short = true
standalone = ["--help", "-h"]
[[command.sub]]
name = "list"
profile = "credential-read"
fact = "`bw list items` returns the full vault items — including each login's `password`, TOTP seed, and secure-note contents — as JSON to stdout."
source = "https://bitwarden.com/help/cli/#list"
judgment = "Bitwarden is a password manager; `list` dumps vault item contents (credentials). Conservative: gated for all object types (listing folder/collection names is a minor over-deny)."
bare = false
tolerate_unknown_short = true
standalone = ["--help", "--organizationid", "--pretty", "--quiet", "--raw", "--response", "--session", "--trash", "-h"]
valued = ["--collectionid", "--folderid", "--nointeraction", "--organizationid", "--search", "--session"]
[[command.sub]]
name = "get"
profile = "credential-read"
fact = "`bw get password`/`item`/`totp`/`notes` fetches a vault item's secret material (password, TOTP code, secure note) and prints it to stdout."
source = "https://bitwarden.com/help/cli/#get"
judgment = "Retrieving a vault item from a password manager is credential exposure. Conservative: gated for all object types (`get username`/`uri` are a minor over-deny)."
bare = false
tolerate_unknown_short = true
standalone = ["--help", "--pretty", "--raw", "--response", "-h"]
valued = ["--itemid", "--organizationid", "--output", "--session"]
write_flags = ["--output"]
[[command.sub]]
name = "template"
level = "SafeRead"
bare = false
tolerate_unknown_short = true
standalone = ["--help", "--pretty", "-h"]
[[command.sub]]
name = "encode"
level = "SafeRead"
bare = true
standalone = ["--help", "-h"]
[[command.sub]]
name = "pending"
level = "SafeRead"
bare = false
tolerate_unknown_short = true
standalone = ["--help", "-h"]
[[command.sub]]
name = "completion"
level = "Inert"
bare = true
standalone = ["--help", "-h"]
valued = ["--shell"]
[[command.sub]]
name = "help"
allow_all = true
[[command.sub]]
name = "config"
candidate = true
[[command.sub]]
name = "login"
candidate = true
[[command.sub]]
name = "logout"
candidate = true
[[command.sub]]
name = "lock"
candidate = true
[[command.sub]]
name = "unlock"
candidate = true
[[command.sub]]
name = "sync"
candidate = true
[[command.sub]]
name = "generate"
candidate = true
[[command.sub]]
name = "send"
candidate = true
[[command.sub]]
name = "receive"
candidate = true
[[command.sub]]
name = "create"
candidate = true
[[command.sub]]
name = "edit"
candidate = true
[[command.sub]]
name = "delete"
candidate = true
[[command.sub]]
name = "restore"
candidate = true
[[command.sub]]
name = "move"
candidate = true
[[command.sub]]
name = "share"
candidate = true
[[command.sub]]
name = "confirm"
candidate = true
[[command.sub]]
name = "import"
candidate = true
[[command.sub]]
name = "export"
candidate = true
[[command.sub]]
name = "device-approval"
candidate = true
[[command.sub]]
name = "serve"
candidate = true
[[command.sub]]
name = "update"
candidate = true