Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

Repository files navigation

bitrix-mcp

English · Русский

Universal, full-featured, portable MCP server for the Bitrix24 REST API. Read and write. Not tied to any one application — it's a generic Bitrix24 gateway that any MCP client or agent can mount (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or your own Python/Node agent).

  • Language: Python + the official MCP SDK (mcp.server.mcpserver, 2.x)
  • Transports:stdio (default, most portable/reliable) and Streamable HTTP (stateless JSON — no fragile long-lived SSE bridge)
  • Coverage: universal b24_call / b24_batch reach 100% of the REST API; a catalogue built from the official docs (1930 methods) tells the agent which method it needs and what parameters it takes; 99 typed tools cover the high-traffic domains with the tricky bits handled.
  • Portal events: three ways to receive them — pull channel (works behind NAT and VPN), outgoing-webhook receiver, poller — plus a history archive and Telegram forwarding: docs/EVENTS.md

Why this exists / what it fixes

Rebuilt from field notes on a previous wrapper. The bugs that motivated it are fixed by design, not patched around:

Old behaviorFix here
filter silently ignored (groups_list, users_list), full-portal dumps → timeoutsParams sent as JSON POST body, so nested filter/select/order are parsed correctly by Bitrix. Real pagination with a page cap.
Access errors swallowed into a fake "0 results" (read_pipelines etc.)Errors are never swallowed — a Bitrix error/error_description always surfaces with its code (e.g. ACCESS_DENIED).
calendar_list returned 0 without explicit ownerIdowner_idauto-resolves to the acting user.
Scrum kanban read from the wrong placeCorrect flow baked in: active-sprint filter + tasks.api.scrum.kanban.getStages (b24_scrum_board does it in one call).
Fragile mcp-remote SSE session drops / hangsPrefer stdio (no bridge) or stateless Streamable HTTP.
department.get has no server-side filter at all (a Bitrix API limitation, undocumented) — any filter was silently ignored and the whole department tree (95+ rows) came back regardlessb24_department_get filters client-side after a full fetch, so filter/ID genuinely narrow the result instead of quietly dumping everything.
Bitrix sometimes reports a failure as {"error": "", "error_description": "Access denied."} — an empty-string error code — which a naive truthiness check (if data.get("error")) misses, losing the code and message to a generic HTTP-status fallbackChecked by key presence, not truthiness — code/message always reflect what Bitrix actually said.
calendar.event.add / .update silently drop attendees unless is_meeting is also set — 200 OK, event created, nobody invited, no error anywhereis_meeting is auto-set to 'Y' whenever attendees is non-empty and not already specified.
Moving a task on a Scrum sprint board has no single API call, and every obvious candidate fails while reporting success: tasks.task.update's STAGE_ID changes the field and writes a history entry everyone can see, but the card stays put; kanban.addTask only places a card that is off the board and answers true without doing anything for one already in a column; task.stages.movetask answers false.b24_scrum_task_move takes the card off the board and puts it back at the target column (kanban.deleteTaskkanban.addTask) — verified by watching a real board, not by trusting the response. It also warns that STAGE_ID cannot verify the result: it read 0 while the card was visibly in the target column.

Install

If nothing is installed on the machine, take the portable archive (dist/bitrix-mcp-portable.zip, built by python scripts/build_portable.py). It carries its own Python and every library — no uv, no pip, no PyPI access. Unzip it and run the bundled launcher.

From source:

uv sync # create venv + install# or, as a tool on PATH:
uv tool install .# exposes the `bitrix-mcp` command

Configure

Set the default webhook (see .env.example):

export BITRIX_WEBHOOK_URL="https://your-portal.bitrix24.ru/rest/1/xxxxxxxx/"# optional:export BITRIX_READ_ONLY=1 # block all writes

The webhook comes from Bitrix: Profile → Webhooks → inbound webhook, format https://<portal>/rest/<user_id>/<token>/. The token is a credential — keep it out of source control (.env is gitignored).

Auth precedence per call:personal_webhookwebhook_urlX-B24-Webhook HTTP header → BITRIX_WEBHOOK_URL. Pass personal_webhook to act (and write) as a specific user.

Run

bitrix-mcp # stdio (default)
bitrix-mcp --http # Streamable HTTP on 127.0.0.1:8000/mcp
bitrix-mcp --http --host 0.0.0.0 --port 5015 # shared network service

Connect a client

Claude Code (stdio, recommended):

claude mcp add -s user bitrix24 -- uv run --directory C:/Scripts/BitrixMCP bitrix-mcp

Repo-shared .mcp.json (stdio):

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

Claude Code (HTTP):

bitrix-mcp --http --port 5015 # then, on the client:
claude mcp add -s user --transport http bitrix24 http://HOST:5015/mcp

Claude Desktop (stdio)%APPDATA%\Claude\claude_desktop_config.json:

{
"mcpServers": {
"bitrix24": {
"command": "uv",
"args": ["run", "--directory", "C:/Scripts/BitrixMCP", "bitrix-mcp"],
"env": { "BITRIX_WEBHOOK_URL": "https://your-portal.bitrix24.ru/rest/1/xxxx/" }
}
}
}

(For a remote HTTP instance, Desktop still needs the mcp-remote bridge; stdio above avoids it entirely.)

Tool catalog (99)

Universalb24_call, b24_batch, b24_test_connection, b24_list_methodsCRMb24_crm_list, b24_crm_get, b24_crm_fields, b24_crm_add, b24_crm_update, b24_crm_delete, b24_crm_timeline_comment_add, b24_crm_timeline_comment_list, b24_crm_category_list (pipelines), b24_crm_status_list (stages/dictionaries), b24_crm_activity_list, b24_crm_activity_add, b24_crm_activity_delete, b24_crm_productrows_get, b24_crm_productrows_set, b24_crm_currency_list, b24_crm_requisite_list, b24_crm_deal_contacts_get, b24_crm_deal_contacts_set (classic entities and SPA via entity_type_id) Tasksb24_tasks_list, b24_task_get, b24_task_add, b24_task_update, b24_task_complete, b24_task_delete, b24_task_comments_list, b24_task_comment_add, b24_task_stages_get, b24_task_checklist_list, b24_task_checklist_add, b24_task_elapsed_add, b24_task_result_listScrumb24_scrum_sprint_list, b24_scrum_kanban_stages, b24_scrum_board, b24_scrum_task_moveCalendarb24_calendar_event_list, b24_calendar_section_list, b24_calendar_event_add, b24_calendar_event_update, b24_calendar_event_deleteDiskb24_disk_storage_list, b24_disk_folder_items, b24_disk_file_get, b24_disk_file_content (server-side download → base64), b24_disk_folder_add, b24_disk_file_upload, b24_disk_file_deleteUsers/structureb24_user_get, b24_user_search, b24_user_current, b24_department_getGroups (workgroups)b24_group_list, b24_group_users, b24_group_create, b24_group_update, b24_group_deleteMessagingb24_im_recent, b24_im_dialog_messages, b24_im_message_add, b24_im_notify_personal, b24_im_user_get, b24_im_chat_create, b24_im_chat_user_add, b24_feed_post_addLists (universal lists)b24_lists_get, b24_lists_element_list, b24_lists_element_add, b24_lists_element_update, b24_lists_element_deleteCatalog / productsb24_catalog_list, b24_catalog_section_list, b24_catalog_product_list, b24_catalog_product_get, b24_catalog_product_add, b24_catalog_product_update, b24_crm_product_listSale (orders)b24_sale_order_list, b24_sale_order_getDocumentsb24_documentgenerator_templates, b24_documentgenerator_addBizprocb24_bizproc_template_list, b24_bizproc_startTelephonyb24_telephony_statistics

Anything still not typed here is reachable through b24_call (e.g. mail, open-lines, sale basket writes, admin/app-placement methods).

Retrospective-app integration

This server has no knowledge of any downstream app. An agent connects to both this server and your app's MCP, reads Bitrix here, and relays into the app's contract. Field names from b24_tasks_list / b24_calendar_event_list map directly onto PushSprintTask / PushCalendarEvent, so the mapping is trivial — but that translation lives in the agent, not here.

Documentation

Development

uv sync # install runtime + dev deps
uv run pytest -q # offline unit tests (no portal needed)
uv run python scripts/smoke.py "<webhook>"# live read-only access map (run from a network with portal access)

Verification scripts

Each one exits non-zero when a check fails, so they can be chained in CI. Those marked offline need no portal; the rest need a reachable webhook.

ScriptWhat it provesNeeds
scripts/startup_check.pyThe server boots on both transports and registers every tooloffline
scripts/leak_check.pyThe sanitizer strips webhooks/tokens from output and from httpx logsoffline
scripts/git_secret_scan.pyNo secret is present in tracked files or anywhere in git historyoffline
scripts/events_tools_check.pypoll → ack → history → stats against a seeded storeoffline
scripts/coverage_check.pyRequirement R-1: catalogue + scope diagnosis reach the whole APIportal
scripts/poller_check.pyb24_changes_since cursors advance and do not skip rowsportal
scripts/pull_channel_check.pyPush & Pull channel subscribes and receivesportal
scripts/receiver_e2e_check.pyOutgoing-webhook receiver end to end, including TLSportal
scripts/telegram_check.pyFilter DSL routes the right eventsoffline
scripts/telegram_live_check.pyThe bot and chat really accept a messageTelegram
scripts/smoke.pyLive read-only access map across every domainportal
scripts/build_catalog.pyRegenerates data/catalog.json from the official docsdocs checkout

Probes (diagnostics, no pass/fail verdict): pull_probe.py, probe_listener.py, tg_conn_probe.py.

Diagrams are regenerated with java -jar plantuml.jar -tpng docs/diagrams/*.puml.

Notes on limits

  • fetch_all=true is capped by BITRIX_MAX_PAGES (default 40 pages ≈ 2000 records) and reports truncated: true when it hits the cap — it never silently stops short.
  • The read-only guard classifies writes by method verb; typed write tools are always classified correctly. b24_call/b24_batch use the heuristic.

Licence

MIT — see LICENSE.

Security

Found a vulnerability? Please report it privately, not in a public issue — see SECURITY.md. The webhook URL this server uses is a bearer credential for the whole portal.

Support author

Donate QR

BTC: bc1q3frrup5neh7nhfg944etu2agd4j9u0vg3jyee6

ETH(Arbitrum): 0x43B349d8Cea83215D707EBa3bc35e9917f746b0a

TRX: THSzvy49KNeqRjXsGkurh2A5G4avV4RgN4

XRP: rLWZjS3DMupC4ZdXCX3BVYn4dEtC3iNhgy

SOL: 3xwfybxJ6Tz5t6pjBBkL5yYQCZo6wfbv932UNA4ThdP8

ADA: addr1q926ys75jp5wn2pv32a3t8r8pdhr7w02v0t9j4a8pmg0ruww5rlkctu4lnz2hfcwa5qfn3zhsd0s23r22uqwzx9gu6cq5c4e76

TON: UQC4qlAOD9Nly4K_66GJ_yCsSM3x2sB0vZ2GrBQbc--gZUui

DOGE: DTjNYmbtymzcjUiV4MsZY8MP4dM7MJ6qLC

XMR: 44qRqM6YtnxXUhkgCFqDDrKMPjWriu69FLBoop8Kwp7e1VQsBUJoVQ8JYQjfMV5C6uidTUgSSyoJ65mq8aYG2esZ1rrqfwt

About

Universal, full-featured, portable MCP server for the Bitrix24 REST API (CRM, tasks, scrum, calendar, disk, users, messaging) — read and write.

Topics

Resources

Security policy

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages