ModelsAtlas
Explore
Atlas / MCP servers / freee / freee-mcp

freee-mcpBLOCK

mcp/freee/freee-mcp
MCP server by freee · Audited 2026-10-12
⚑ Report / re-scanSource ↗

Model Context Protocol (MCP) server for freee API integration

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
5 4r · 0w · 1d
Transport
stdio · streamable-http
License
Apache-2.0
Stars
506
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

freee会計、人事労務、請求書、工数管理、販売、IT管理、固定資産、業務委託管理、サーベイ、開業、人事評価、申告、サイン(電子契約)を AI Agent から操作できるようにする freee 公式の MCP サーバーと Agent Skills です。

  • MCP サーバー: freee API の呼び出し・認証・リクエスト検証を担当
  • Agent Skills: API リファレンスと操作レシピを AI Agent のコンテキストに注入し、正確な API 利用をガイド

[](https://www.npmjs.com/package/freee-mcp)

特徴

  • 複数 API 対応: 会計・人事労務・請求書・工数管理・販売・IT管理・固定資産・業務委託管理・サーベイ・開業・人事評価・申告の12個の freee API をサポート
  • 対応操作数: 547 操作(サイン(電子契約)含む、scripts/generate-references.ts が自動更新)
  • 利用条件: サーベイ・開業・人事評価・申告は、対応する接続環境、OAuth クライアント、契約プラン、利用者権限が必要
  • サイン(電子契約)対応: freee サインの文書管理 API を専用コマンド(freee-sign-mcp)でサポート
  • OAuth 2.0 + PKCE: セキュアな認証フロー、トークン自動更新
  • 複数事業所対応: 事業所の動的切り替えが可能

Agent Skills と MCP の通信の流れ

Agent Skills(API リファレンス・操作レシピ)と MCP サーバー(API 呼び出し)を組み合わせて利用します。

sequenceDiagram
participant User as ユーザー
participant Agent as AI Agent
participant Skill as Agent Skills(API リファレンス・操作レシピ)
participant MCP as MCP サーバー
participant API as freee API

User->>Agent: リクエスト「取引一覧を取得して」

Note over Agent,Skill: 1. Agent Skills からリファレンスを取得
Agent->>Skill: freee-api-skill 呼び出し
Skill-->>Agent: API リファレンス注入(エンドポイント、パラメータ仕様)

Note over Agent,MCP: 2. MCP Tool で API を実行
Agent->>MCP: freee_api_get 呼び出しpath: /api/1/deals
MCP->>MCP: OpenAPI スキーマで検証
MCP->>MCP: 認証トークン付与

Note over MCP,API: 3. freee API への通信
MCP->>API: GET /api/1/dealsAuthorization: Bearer xxx
API-->>MCP: JSON レスポンス

MCP-->>Agent: 取引データ
Agent-->>User: 結果を整形して表示

この仕組みにより:

  • Agent Skills: 必要な API リファレンスや操作レシピを段階的にコンテキストに注入(コンテキスト効率化)
  • MCP: 認証・リクエスト検証・API 呼び出しを担当

クイックスタート

方法 1: Remote MCP で接続する(推奨)

freee が提供する Remote MCP サーバーに接続する方法です。ローカルでのセットアップが不要で、すぐに利用を開始できます。

Claude 及び Claude Desktop では「カスタマイズ」より「カスタムコネクタを追加」を開き、以下を設定してください。

  • 名前: freee
  • URL: https://mcp.freee.co.jp/mcp
⚠️ freee 公式以外の URL を入力しないようにご注意ください。

<

Read from source at commit 3bb5d136c598OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add freee-mcp --env FREEE_AUTHORIZATION_ENDPOINT=${FREEE_AUTHORIZATION_ENDPOINT} --env FREEE_CLIENT_SECRET=${FREEE_CLIENT_SECRET} --env FREEE_SIGN_CLIENT_SECRET=${FREEE_SIGN_CLIENT_SECRET} --env FREEE_TOKEN_ENDPOINT=${FREEE_TOKEN_ENDPOINT} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "freee-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "FREEE_AUTHORIZATION_ENDPOINT": "${FREEE_AUTHORIZATION_ENDPOINT}",
        "FREEE_CLIENT_SECRET": "${FREEE_CLIENT_SECRET}",
        "FREEE_SIGN_CLIENT_SECRET": "${FREEE_SIGN_CLIENT_SECRET}",
        "FREEE_TOKEN_ENDPOINT": "${FREEE_TOKEN_ENDPOINT}"
      }
    }
  }
}
03

Exposed tools (5)

4 read · 0 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
sign_auth_statusread
sign_authenticateread
sign_clear_authdestructive
sign_server_inforead
with_bodyread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (7 observation(s))
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/server/cimd-fetcher.ts:52
if (hostname === '169.254.169.254' || hostname === 'metadata.google.internal') {
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills
.claude/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.codex/skills
.codex/skills
Why it matters. link not followed
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/generate-references.ts:871
console.log(`  Added mapping: ${apiKey} "${tag}" -> "${englishName}"`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/generate-references.ts:892
console.log(`Processing ${apiKey}...`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/generate-references.ts:902
console.log(`No mappings found for ${apiKey}`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/generate-references.ts:922
console.log(`Generated ${entries.length} files for ${apiKey}`);
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
scripts/generate-references.ts:949
{ apiKey: "fixed-asset-management-api", schemaFile: join(OPENAPI_DIR, "fixed-asset-management-api-schema.json"), prefix: "fixed-asset-management", outputDir: OUTPUT_DIR },
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
scripts/generate-references.ts:950
{ apiKey: "partner-management-api", schemaFile: join(OPENAPI_DIR, "partner-management-api-schema.json"), prefix: "partner-management", outputDir: OUTPUT_DIR },
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
sign_clear_auth
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.coderabbit.yaml
.coderabbit.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.worktreeinclude
.worktreeinclude
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/publish.yml:97
zip -r ../../freee-api-skill.zip .
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/openapi/schema-loader.test.ts:396
readFileSync(new URL('../../openapi/minimal/mcponly.json', import.meta.url), 'utf-8'),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/openapi/schema-loader.ts:22
path.resolve(__dirname, '../../openapi/minimal'), // development (bun)
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/sign/cli/index.ts:8
} from '../../auth/server.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/sign/cli/index.ts:14
} from '../../config/mcp-config.js';
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:79
- コールバックURL: `http://127.0.0.1:54321/callback`
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/auth/oauth.test.ts:23
redirectUri: 'http://127.0.0.1:54321/callback',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/auth/oauth.test.ts:81
const redirectUri = 'http://127.0.0.1:54321/callback';
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/auth/oauth.test.ts:114
'http://127.0.0.1:54321/callback',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/auth/oauth.test.ts:130
redirect_uri: 'http://127.0.0.1:54321/callback',
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, @opentelemetry/api, @opentelemetry/context-async-hooks, @opentelemetry/core, @opentelemetry/exporter-metrics-otlp-http, @opentelemetry/exporter-trace-otlp-http, @opentelemet
Why it matters. 36 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOInventory / provenance · inv.oversize · CWE-1104
openapi/accounting-api-schema.json
openapi/accounting-api-schema.json
Why it matters. 2300330 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 3bb5d136c598full audit observations/trust-audit/mcp-server/freee__freee-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-123bb5d136c598BLOCKD69first audit
06

Questions

What is the freee-mcp MCP server?

Model Context Protocol (MCP) server for freee API integration

What tools does freee-mcp expose?

5 in total: 4 read-only, 0 that write, and 1 that can delete or overwrite (sign_clear_auth). Every one is listed on this page with its risk.

Is freee-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does freee-mcp need?

It reads FREEE_AUTHORIZATION_ENDPOINT, FREEE_CLIENT_SECRET, FREEE_SIGN_CLIENT_SECRET, FREEE_TOKEN_ENDPOINT, JWT_SECRET, OPENAI_APPS_CHALLENGE_TOKEN, SIGN_AUTHORIZATION_ENDPOINT, SIGN_JWT_SECRET and SIGN_TOKEN_ENDPOINT from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does freee-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as freee-mcp at 0.36.5.

How current is this page?

The grade is for one exact copy of the source (3bb5d136c598), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement