> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Bitbucket

> Discover AI workloads, tools, models, and configuration in Bitbucket repositories.

Forge scans Bitbucket Cloud repositories for AI application code,
configuration, tools, and deployment evidence. Findings retain their workspace,
repository, revision, and file provenance for review in Inventory.

## Coverage

| Capability       | Implementation                                                       |
| ---------------- | -------------------------------------------------------------------- |
| Repository scope | Bitbucket workspace, with an optional repository allowlist           |
| Authentication   | Workspace token, repository token, or API token                      |
| Revision         | Main branch and resolved repository revision                         |
| Output           | Inventory items, source references, confidence, and posture findings |
| Runtime data     | Not collected by repository scanning                                 |

## Detection

| Asset class       | Examples                                                               |
| ----------------- | ---------------------------------------------------------------------- |
| AI applications   | Provider SDKs, agent frameworks, orchestration code, and AI endpoints  |
| Tooling           | MCP servers, function tools, code execution, and database capabilities |
| Infrastructure    | Containers, Terraform, deployment manifests, and model artifacts       |
| Configuration     | Gateways, observability, provider references, and key names            |
| Data dependencies | Vector stores, connectors, and cloud services                          |

Forge suppresses weak uncorroborated matches and assigns evidence quality and
confidence to each accepted observation. Secret references may be detected;
secret values are not collected.

## Scan contract

| Limit                | Behavior                                                                 |
| -------------------- | ------------------------------------------------------------------------ |
| Repositories per run | Up to 25                                                                 |
| Candidate files      | Up to 300 per repository                                                 |
| File size            | Files larger than 256 KiB are skipped                                    |
| Exclusions           | Generated output, vendored dependencies, caches, lockfiles, and `.git`   |
| Repository selection | When no allowlist is supplied, Forge lists repositories in the workspace |

## Connection

| Field          | Description                                                                                       |
| -------------- | ------------------------------------------------------------------------------------------------- |
| Owner          | Bitbucket workspace slug                                                                          |
| Authentication | `bitbucket_workspace_access_token`, `bitbucket_repository_access_token`, or `bitbucket_api_token` |
| Username       | Required when using `bitbucket_api_token`                                                         |
| Repositories   | Optional repository allowlist                                                                     |
| Base URL       | Bitbucket API endpoint                                                                            |

## Setup

1. Open **Settings → Integrations → Bitbucket** and save the workspace, base
   URL, authentication mode, and token. Supply the username when using
   `bitbucket_api_token`.
2. Leave the repository list empty to enumerate repositories visible to the
   token, or provide an explicit allowlist.
3. Run a sync. Forge records success, `observationCount`,
   `canonicalInventoryCount`, and blockers for each repository.

Changing the base URL after a credential has been saved requires token
rotation. Production endpoints must use HTTPS and cannot contain credentials,
query strings, fragments, or path traversal.

## Boundaries

Bitbucket scanning establishes code and configuration evidence, not live
execution. Runtime user identity, prompt and response content, tool calls, and
policy decisions require endpoint, gateway, or cloud telemetry.