Integrations · Bitbucket
Guild agents read, create, approve, and merge Bitbucket pull requests, manage issues, and act on repository events without storing credentials in agent code. Guild’s credential proxy injects the OAuth token server-side and enforces credential policies before any request reaches Bitbucket. Every action is captured in Guild’s audit trail.
Book a demo
See how teams govern agents that use Bitbucket.
Start free
Connect Bitbucket and scope your first agent.
What the Bitbucket integration exposes
The tools cover repositories, branches, commits, pull requests, issues, webhooks, and workspaces on Bitbucket Cloud. Agents can list and inspect resources, create and update them, approve or merge pull requests, manage branch restrictions and default reviewers, and read file contents and diffs. Three webhook events let triggers fire agents when a pull request, issue, or repository push occurs.How it works
1
Open Credentials in Guild
Go to Credentials in Guild. The page lists connected services and a gallery of available integrations.
2
Authorize Bitbucket via OAuth
Click Bitbucket and complete the OAuth 2.0 flow. Select the workspaces and repositories to authorize. Tokens expire after one hour and are refreshed automatically.
3
Add tools to your agent
Import
bitbucketTools from @guildai-services/guildai~bitbucket and spread it into your agent’s tools object. Use pick() to include only the tools your agent needs, since agents perform better with fewer tools.Why Bitbucket access needs governing
Bitbucket tools can create repositories, delete branches, merge pull requests, and modify branch restriction rules. A credential without policies grants an agent everything the connected Bitbucket account can reach. Guild’s credential policies let you write ALLOW and DENY rules that the credential proxy enforces before any request leaves Guild, limiting agents by operation, resource, workspace, or agent identity. Guild stores OAuth tokens server-side and injects them into requests through the credential proxy; agent code never sees the token. You can scope a credential to one workspace, one member, or one agent, and restrict a workspace so it ignores account-level credentials entirely. See credentials for scoping options and credential policies for rule syntax. Without policies, every agent that resolves the credential can use it without restriction.About the Bitbucket integration
The@guildai-services/guildai~bitbucket package provides agents with access to the Bitbucket Cloud REST API through Guild’s OAuth 2.0 integration.
Authentication
- Type: OAuth 2.0
- Token expiration: 1 hour (auto-refreshed)
- Note: Only Bitbucket Cloud is supported — not Bitbucket Server or Data Center
Setup
1
Open Credentials
Go to Credentials in Guild.
2
Connect Bitbucket
Click Bitbucket and authorize Guild to access your account.
3
Grant access
Select the workspaces and repositories to authorize.
guildai~bitbucket-token integration. Create the token in Bitbucket under Workspace settings > Security > Access tokens, and paste it into API Key. Give the token the webhook read and write scope so triggers can register their webhooks. It supports the same trigger events; the package and tools on this page are for the OAuth integration.
Usage
Selecting specific tools
Agents perform better with fewer tools. Usepick() to include only what your agent needs. Tools are named with the bitbucket_ prefix.
Tools
Tools in the latest published version ofguildai~bitbucket:
All 93 tools
All 93 tools
Webhook events
Bitbucket uses a trigger-scoped webhook model — each trigger gets its own webhook with a unique secret, subscribed to the trigger’s event and action, or to every event when the trigger names none. Guild checks each delivery’sX-Hub-Signature.
A trigger can narrow an event to one action, such as --event pullrequest --action created. Without an action it fires on every action of that event.
Every trigger needs a
workspace_slug in its service config. Add a repo_slug to install the webhook on one repository; without it, the webhook is installed on the workspace, where Bitbucket supports the event.
pullrequest comment_created trigger fires that trigger again. Have the agent skip comments by the connected account.
Package version
The@guildai-services/guildai~bitbucket package is on the 2.x release line. The 2.x package is a code-generated client built directly from Bitbucket’s OpenAPI specification, replacing the hand-maintained 1.x package.
If you are migrating an agent that was written against the 1.x package, review your tool names — some operation identifiers changed between versions. All operations follow the same bitbucket_<method>_<path> naming convention as before, but paths may have been normalized.
Limitations
- Only Bitbucket Cloud is supported (not Bitbucket Server or Data Center)
- Each trigger creates a separate webhook on the repository or workspace
Frequently asked questions
Does this integration work with Bitbucket Server or Data Center?
Does this integration work with Bitbucket Server or Data Center?
No. Only Bitbucket Cloud is supported. Bitbucket Server and Data Center are not supported by this integration.
Can I trigger an agent only when a pull request is created, not on every pull request event?
Can I trigger an agent only when a pull request is created, not on every pull request event?
Yes. A trigger can narrow the
pullrequest event to one action, such as --event pullrequest --action created. Without an action specified, the trigger fires on every action of that event, including approved, merged, declined, and commented.How do I limit which repositories an agent can touch?
How do I limit which repositories an agent can touch?
Write a credential policy with ALLOW or DENY rules scoped to specific operations and agents. Guild’s credential proxy enforces the policy before any request reaches Bitbucket, so an agent cannot reach repositories the policy does not permit. See credential policies for rule syntax.
Can I connect with a workspace access token instead of OAuth?
Can I connect with a workspace access token instead of OAuth?
Yes. Use the
guildai~bitbucket-token integration instead. Create a token in Bitbucket under Workspace settings > Security > Access tokens, give it webhook read and write scope, and paste it into the API Key field. It supports the same trigger events as the OAuth integration.Put a governed agent on Bitbucket this week
Book a demo
See how teams govern agents that use Bitbucket.
Start free
Connect Bitbucket and scope your first agent.