Skills/npm/freee-mcp

freee-mcp@0.37.11

CAUTION· not started

Publisher claims: "Model Context Protocol (MCP) server for freee API integration" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher freee · publishing for 263 daysInstalls 68,938Last detonated 8d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

Code inventory arrives with this version's next honeypot run.
It will ask for
unknown until the next run
Where it talks to
unknown until the next run
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try freee-mcp` runs it now and prints the full answer.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-06 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: README links to an external installer; Outbound HTTP to raw IP address; Outbound HTTP to raw IP address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
1.4sprocessdependency install exit 1
1.5sprocessexec /usr/bin/date
1.5sprocessexec /usr/bin/timeout
1.5sclaimedno tools/list reply (exit 0)
1.5sprocessscript backend runs setup only
1.5sprocessno install scripts to re-run

Static findings

HIGH
README links to an external installerREADME.md → https://github.com/freee/freee-mcp/releases/latest/download/freee-api-skill.ziphttps://github.com/freee/freee-mcp/releases/latest/download/freee-api-skill.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Outbound HTTP to raw IP addressbin/freee-sign-mcp.js:4 · Outbound HTTP to raw IP address — may bypass domain-based monitoring`+"`freee-sign-mcp configure` を実行してセットアップしてください。");return{clientId:t.clientId,clientSecret:t.clientSecret,callbackPort:t.callbackPort??te}}var te=54322,j,We,oe,z="all",Ze="freee サイン（電子契約）APIと連携するMCPサーFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressbin/freee-remote-mcp.js:57 · Outbound HTTP to raw IP address — may bypass domain-based monitoring`))}catch(i){return n?.recordToolCall({tool:"freee_file_upload",status:"error",duration_ms:Date.now()-o}),n?.recordError({source:"tool_handler",chain:S(i)}),y(`ファイルアップロードに失敗: ${V(i)}`)}})}var Dn=h(()=Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressbin/freee-mcp.js:6 · Outbound HTTP to raw IP address — may bypass domain-based monitoring`+"`freee-mcp configure` を実行してセットアップしてください。");t=e.clientId,r=e.clientSecret,n=Nt(e.callbackPort,me)}return se={freee:{clientId:t,clientSecret:r,companyId:"0",apiUrl:process.env.FREEE_API_BASE_URL?.repFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressbin/freee-remote-mcp.js:2 · Outbound HTTP to raw IP address — may bypass domain-based monitoringvar h=(e,t,r)=>()=>{if(e)try{t=e(e=0)}catch(n){r=[n]}if(r)throw r[0];return t};import Do from"node:os";import fr from"node:path";function ae(){return process.env.XDG_CONFIG_HOME?fr.join(process.env.XDFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressbin/freee-mcp.js:18 · Outbound HTTP to raw IP address — may bypass domain-based monitoring詳細: (JSON parse failed: ${r.error})`;return n}function Me(e,t){let r=e.refresh_token||t.refreshToken;if(!r)throw Error("No refresh_token available. The token response did not include a refresh_token aFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressbin/freee-sign-remote-mcp.js:6 · Outbound HTTP to raw IP address — may bypass domain-based monitoring`))}catch(o){return _(`ファイルアップロードに失敗: ${Y(o)}`)}})}var Cr=m(()=>{Rr()});async function Ar(e,t,r){let n=re(),o=await fetch(n.oauth.tokenEndpoint,{method:"POST",headers:{"Content-Type":"application/x-wwFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionbin/freee-mcp.js:18 · File type combined with upload action — agent may exfiltrate local data files詳細: (JSON parse failed: ${r.error})`;return n}function Me(e,t){let r=e.refresh_token||t.refreshToken;if(!r)throw Error("No refresh_token available. The token response did not include a refresh_token aFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL using raw IP addressbin/freee-sign-mcp.js:4 · URL using raw IP address — may bypass domain-based filtering`+"`freee-sign-mcp configure` を実行してセットアップしてください。");return{clientId:t.clientId,clientSecret:t.clientSecret,callbackPort:t.callbackPort??te}}var te=54322,j,We,oe,z="all",Ze="freee サイン（電子契約）APIと連携するMCPサーFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionbin/freee-remote-mcp.js:80 · File type combined with upload action — agent may exfiltrate local data files- transport: ${o}`)})}var Jn;var Wn=h(()=>{Bt();_t();Vn();ee();U();B();W();Ae();dt();Jn=ie.object({companies:ie.array(ie.object({id:ie.number(),name:ie.string().nullable().optional(),display_name:ie.sFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL using raw IP addressbin/freee-mcp.js:6 · URL using raw IP address — may bypass domain-based filtering`+"`freee-mcp configure` を実行してセットアップしてください。");t=e.clientId,r=e.clientSecret,n=Nt(e.callbackPort,me)}return se={freee:{clientId:t,clientSecret:r,companyId:"0",apiUrl:process.env.FREEE_API_BASE_URL?.repFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagebin/freee-sign-mcp.js:26 · npx invocation of non-well-known package — may execute untrusted code`),console.log(` npx skills add freee/freee-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/freee-mcp.js:45 · npx invocation of non-well-known package — may execute untrusted code`),console.log(` npx add-skill freee/freee-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using raw IP addressbin/freee-mcp.js:18 · URL using raw IP address — may bypass domain-based filtering詳細: (JSON parse failed: ${r.error})`;return n}function Me(e,t){let r=e.refresh_token||t.refreshToken;if(!r)throw Error("No refresh_token available. The token response did not include a refresh_token aFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionbin/freee-sign-mcp.js:2 · File type combined with upload action — agent may exfiltrate local data filesvar R=(e,r,t)=>()=>{if(e)try{r=e(e=0)}catch(n){t=[n]}if(t)throw t[0];return r};import fr from"node:os";import Ae from"node:path";function k(){return process.env.XDG_CONFIG_HOME?Ae.join(process.env.XDGFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL using raw IP addressbin/freee-sign-remote-mcp.js:6 · URL using raw IP address — may bypass domain-based filtering`))}catch(o){return _(`ファイルアップロードに失敗: ${Y(o)}`)}})}var Cr=m(()=>{Rr()});async function Ar(e,t,r){let n=re(),o=await fetch(n.oauth.tokenEndpoint,{method:"POST",headers:{"Content-Type":"application/x-wwFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressbin/freee-remote-mcp.js:57 · URL using raw IP address — may bypass domain-based filtering`))}catch(i){return n?.recordToolCall({tool:"freee_file_upload",status:"error",duration_ms:Date.now()-o}),n?.recordError({source:"tool_handler",chain:S(i)}),y(`ファイルアップロードに失敗: ${V(i)}`)}})}var Dn=h(()=Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionbin/freee-sign-remote-mcp.js:4 · File type combined with upload action — agent may exfiltrate local data files`+"`freee-sign-mcp configure` を実行してセットアップしてください。");return{clientId:r.clientId,clientSecret:r.clientSecret,callbackPort:r.callbackPort??sr}}function Ho(e){return e.issues.map((t)=>{let r=t.path.join(".Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL using raw IP addressbin/freee-remote-mcp.js:2 · URL using raw IP address — may bypass domain-based filteringvar h=(e,t,r)=>()=>{if(e)try{t=e(e=0)}catch(n){r=[n]}if(r)throw r[0];return t};import Do from"node:os";import fr from"node:path";function ae(){return process.env.XDG_CONFIG_HOME?fr.join(process.env.XDFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)bin/freee-remote-mcp.js:80 · MCP server using network transport (SSE/HTTP) — data sent over network- transport: ${o}`)})}var Jn;var Wn=h(()=>{Bt();_t();Vn();ee();U();B();W();Ae();dt();Jn=ie.object({companies:ie.array(ie.object({id:ie.number(),name:ie.string().nullable().optional(),display_name:ie.sFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagebin/freee-mcp.js:2 · npx invocation of non-well-known package — may execute untrusted codevar Je=(e,t,r)=>()=>{if(e)try{t=e(e=0)}catch(n){r=[n]}if(r)throw r[0];return t};import Wr from"node:os";import At from"node:path";function U(){return process.env.XDG_CONFIG_HOME?At.join(process.env.XDFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/freee-sign-remote-mcp.js:21 · File type combined with upload action — agent may exfiltrate local data files- transport: ${r}`))}var $r=m(()=>{br();I();nt();D();Mr();ve()});import{McpServer as es}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as Uc}from"@modelcontextprotocol/sdk/sFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/freee-remote-mcp.js:2 · npx invocation of non-well-known package — may execute untrusted codevar h=(e,t,r)=>()=>{if(e)try{t=e(e=0)}catch(n){r=[n]}if(r)throw r[0];return t};import Do from"node:os";import fr from"node:path";function ae(){return process.env.XDG_CONFIG_HOME?fr.join(process.env.XDFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/freee-remote-mcp.js:56 · File type combined with upload action — agent may exfiltrate local data files`+"レートリミットの可能性があります。数分待ってから再試行してください。"))}if(!v.ok){let R=await lt(v,v.status);k(v.status,"http_error",Error(R))}let We=await v.text();try{let R=JSON.parse(We);return o?.recordApiCall({method:"POST",paFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/freee-sign-mcp.js:4 · npx invocation of non-well-known package — may execute untrusted code`+"`freee-sign-mcp configure` を実行してセットアップしてください。");return{clientId:t.clientId,clientSecret:t.clientSecret,callbackPort:t.callbackPort??te}}var te=54322,j,We,oe,z="all",Ze="freee サイン（電子契約）APIと連携するMCPサーFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/freee-sign-remote-mcp.js:4 · npx invocation of non-well-known package — may execute untrusted code`+"`freee-sign-mcp configure` を実行してセットアップしてください。");return{clientId:r.clientId,clientSecret:r.clientSecret,callbackPort:r.callbackPort??sr}}function Ho(e){return e.issues.map((t)=>{let r=t.path.join(".Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/freee-mcp.js:76 · File type combined with upload action — agent may exfiltrate local data files`)}`)}var no=ro();function oo(e){let t=Ce.join(no,e),r=Mr.readFileSync(t,"utf-8"),n=JSON.parse(r),o=kr.safeParse(n);if(!o.success)throw Error(`Invalid schema file ${e}: ${o.error.message}`);return o.dFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/freee-sign-mcp.js:4 · File type combined with upload action — agent may exfiltrate local data files`+"`freee-sign-mcp configure` を実行してセットアップしてください。");return{clientId:t.clientId,clientSecret:t.clientSecret,callbackPort:t.callbackPort??te}}var te=54322,j,We,oe,z="all",Ze="freee サイン（電子契約）APIと連携するMCPサーFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/freee-remote-mcp.js:14 · File type combined with upload action — agent may exfiltrate local data files詳細: (JSON parse failed: ${r.error})`;return n}import ut from"node:fs/promises";import Dt from"node:path";async function Gr(){let e=ae();try{return(await ut.readdir(e)).filter((r)=>r.startsWith("tokensFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Dense URL-encoded contentdist/openapi/minimal/accounting.json:3920 · Dense URL-encoded content — may be obfuscating payloads"description": "\n<h2 id=\"_1\">概要</h2>\n\n<p>ファイルボックス（証憑ファイル）をアップロードする</p>\n<h2 id=\"_2\">注意点</h2>\n<ul>\n <li>リクエストヘッダーの Content-Type は、multipart/form-dataにのみ対応しています。</li>\n <li>インボイス制度適格請求書発行事業者登Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)bin/freee-sign-remote-mcp.js:21 · MCP server using network transport (SSE/HTTP) — data sent over network- transport: ${r}`))}var $r=m(()=>{br();I();nt();D();Mr();ve()});import{McpServer as es}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as Uc}from"@modelcontextprotocol/sdk/sFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Dense URL-encoded contentdist/openapi/minimal/hr.json:903 · Dense URL-encoded content — may be obfuscating payloads"description": "<h2 id=\"\">概要</h2>\n<p>指定した従業員の打刻情報を登録します。</p>\n\n<h2 id=\"_1\">注意点</h2>\n<ul>\n <li>休憩開始の連続や退勤のみなど、整合性の取れていない打刻は登録できません。\n打刻可能種別の取得APIを呼ぶことで、その従業員がその時点で登録可能な打刻種別が取得できます。</li>\n\n <Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈51 tok
1 file · 19 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for freee-mcp@0.37.11 as of 8d ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim freee: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim freeePropose a patch to the maintainer