Bitbucket

Forge scans Bitbucket Cloud repositories for AI application code, configuration, tools, and deployment evidence. Findings retain their workspace, repository, revision, and file provenance for review in Inventory.

Coverage

Capability	Implementation
Repository scope	Bitbucket workspace, with an optional repository allowlist
Authentication	Workspace token, repository token, or API token
Revision	Main branch and resolved repository revision
Output	Inventory items, source references, confidence, and posture findings
Runtime data	Not collected by repository scanning

Detection

Asset class	Examples
AI applications	Provider SDKs, agent frameworks, orchestration code, and AI endpoints
Tooling	MCP servers, function tools, code execution, and database capabilities
Infrastructure	Containers, Terraform, deployment manifests, and model artifacts
Configuration	Gateways, observability, provider references, and key names
Data dependencies	Vector stores, connectors, and cloud services

Forge suppresses weak uncorroborated matches and assigns evidence quality and confidence to each accepted observation. Secret references may be detected; secret values are not collected.

Scan contract

Limit	Behavior
Repositories per run	Up to 25
Candidate files	Up to 300 per repository
File size	Files larger than 256 KiB are skipped
Exclusions	Generated output, vendored dependencies, caches, lockfiles, and `.git`
Repository selection	When no allowlist is supplied, Forge lists repositories in the workspace

Connection

Field	Description
Owner	Bitbucket workspace slug
Authentication	`bitbucket_workspace_access_token`, `bitbucket_repository_access_token`, or `bitbucket_api_token`
Username	Required when using `bitbucket_api_token`
Repositories	Optional repository allowlist
Base URL	Bitbucket API endpoint

Setup

Open Settings → Integrations → Bitbucket and save the workspace, base URL, authentication mode, and token. Supply the username when using bitbucket_api_token.
Leave the repository list empty to enumerate repositories visible to the token, or provide an explicit allowlist.
Run a sync. Forge records success, observationCount, canonicalInventoryCount, and blockers for each repository.

Changing the base URL after a credential has been saved requires token rotation. Production endpoints must use HTTPS and cannot contain credentials, query strings, fragments, or path traversal.

Boundaries

Bitbucket scanning establishes code and configuration evidence, not live execution. Runtime user identity, prompt and response content, tool calls, and policy decisions require endpoint, gateway, or cloud telemetry.

Get started

Observe

Secure

Enable

Integrations

Resources

Coverage

Detection

Scan contract

Connection

Setup

Boundaries

​Coverage

​Detection

​Scan contract

​Connection

​Setup

​Boundaries

Coverage

Detection

Scan contract

Connection

Setup

Boundaries