@nexus2520/bitbucket-mcp-server

What it does

This server bridges Claude to Bitbucket's API, exposing 29 tools for PR management, code review, file navigation, and repository search. It supports both Bitbucket Cloud and Server, automatically filtering server-only tools when pointed at Cloud. Tools span PR operations (create, merge, approve), comment threads, inline suggestions, commit history, branch control, file listing with content retrieval, structural code search (with language/path/extension filters), and file blame tracking. v2.0.0 optimizes token usage by letting you expose only the tool groups relevant to your workflow (e.g., pr_core + files), cutting estimated prompt overhead from 5,100 tokens down to 2,100.

Who it's for

Backend engineers and code reviewers navigating large Bitbucket repositories; DevOps teams automating PR merges and reviews; platform engineers needing to script Bitbucket Server instances; any developer who wants Claude to search code, propose changes, or surface file history without leaving their editor.

Common use cases

• Fetch and review a PR's full diff, existing comments, and merge state without switching windows
• Search repositories by language, file extension, or path pattern (e.g., lang:go path:config)
• Navigate file trees, read file content, and retrieve per-line blame history
• Create, update, and bulk-manage PR tasks and review comments, including inline suggestions
• List and filter PRs by author, state, or destination branch, then merge or decline in batch

Setup pitfalls

• Cloud vs. Server use different auth: Cloud requires an app password created at bitbucket.org/account/settings/app-passwords/ with Account/Repositories/Pull requests permissions; Server requires an HTTP access token and the BITBUCKET_BASE_URL env var pointing to your instance.
• Server-only tools are auto-filtered in Cloud — no configuration needed, but misconfiguring the base URL will silently hide 10 tools.
• App password scope matters: Create the password with only the minimum permissions you need. Overly broad tokens increase blast radius if credentials leak.