Skills/npm/freee-mcp

freee-mcp@0.38.0

CAUTION· startup only

Publisher claims: "Model Context Protocol (MCP) server for freee API integration" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher freee · publishing for 263 daysInstalls 68,938Last detonated 39 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
FREEE_AUTHORIZATION_ENDPOINTFREEE_CLIENT_SECRETFREEE_SIGN_CLIENT_SECRETFREEE_TOKEN_ENDPOINTJWT_SECRETOPENAI_APPS_CHALLENGE_TOKENSIGN_AUTHORIZATION_ENDPOINTSIGN_JWT_SECRETSIGN_TOKEN_ENDPOINTConfiguration, not credentials: CORS_ALLOWED_ORIGINS, FREEE_API_BASE_URL, FREEE_CALLBACK_PORT, FREEE_CLIENT_ID, FREEE_SCOPE, FREEE_SIGN_API_URL, FREEE_SIGN_CLIENT_ID, HTTP_HEADERS_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_MS, HTTP_REQUEST_TIMEOUT_MS, ISSUER_URL, KUBERNETES_SERVICE_HOST, MCP_JWT_AUDIENCE, MCP_JWT_AUDIENCE_ENFORCE, MCP_PUBLIC_BASE_URL, OTEL_DEPLOYMENT_ENVIRONMENT, OTEL_ENABLED, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_METRICS_EXPORTER, OTEL_SERVICE_NAME, OTEL_TRACES_SAMPLER_ARG, OTEL_TRACES_SAMPLER_RULES, RATE_LIMIT_ENABLED, REDIS_URL, SIGN_CORS_ALLOWED_ORIGINS, SIGN_ISSUER_URL, SIGN_LOG_LEVEL, SIGN_PORT, SIGN_RATE_LIMIT_ENABLED, SIGN_REDIS_URL, SIGN_SCOPE
Where it talks to
freee.co.jp (its own)Also ninja-sign.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names ninja-sign.com as well as its own vendor. The guard injects FREEE_AUTHORIZATION_ENDPOINT, FREEE_CLIENT_SECRET, FREEE_SIGN_CLIENT_SECRET, FREEE_TOKEN_ENDPOINT, JWT_SECRET, OPENAI_APPS_CHALLENGE_TOKEN, SIGN_AUTHORIZATION_ENDPOINT, SIGN_JWT_SECRET, SIGN_TOKEN_ENDPOINT only into requests to freee.co.jp (and its subdomains) and refuses the rest.

$vet-skills run --secrets FREEE_AUTHORIZATION_ENDPOINT=freee.co.jp,FREEE_CLIENT_SECRET=freee.co.jp,FREEE_SIGN_CLIENT_SECRET=freee.co.jp,FREEE_TOKEN_ENDPOINT=freee.co.jp,JWT_SECRET=freee.co.jp,OPENAI_APPS_CHALLENGE_TOKEN=freee.co.jp,SIGN_AUTHORIZATION_ENDPOINT=freee.co.jp,SIGN_JWT_SECRET=freee.co.jp,SIGN_TOKEN_ENDPOINT=freee.co.jp -- npx -y freee-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: README links to an external installer. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 42 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
21sprocessdependency install exit 0
41sfilesystemread ~/.config/freee-mcp/config.json outside project
41sfilesystemwrote ~/.config/freee-mcp/config.json
41sclaimedstartup only: exited (0) before answering · (node:669) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created) {"level":"info","time":1794523013660,"service":"freee-mcp","version":"0.38.0","transport_mode":"stdio","trace_sampled":false,"msg":"Starting freee MCP server"} {"level":"fatal","time":1794523013667,"service":"freee-mcp","ver
41sprocessscript backend runs setup only
41sprocessno install scripts to re-run

Static findings

HIGH
README links to an external installerREADME.md → https://github.com/freee/freee-mcp/releases/latest/download/freee-api-skill.ziphttps://github.com/freee/freee-mcp/releases/latest/download/freee-api-skill.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/freee-sign-mcp.js:4 · File type combined with upload action — agent may exfiltrate local data files…romises";import Xe from"node:path";function Se(){return Xe.join(k(),"sign-tokens.json")}async function Te(e){let r=Se(),t=Xe.dirname(r);try{await se.mkdir(t,{recursive:!0}),await se.writeFile(r,JSON.stringify(e,null,2),{mode:w})}catch(n){t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/freee-mcp.js:45 · npx invocation of non-well-known package — may execute untrusted code`),console.log(` npx add-skill freee/freee-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/freee-mcp.js:2 · npx invocation of non-well-known package — may execute untrusted code…業務委託管理・サーベイ・開業・人事評価・申告APIをサポート。詳細ガイドはfreee-api-skill skillを参照。skillが未インストールの場合は npx skills add freee/freee-mcp で追加",Ot=1e4,Mt=30000,Dt=120000;var M=()=>{};import Ge from"…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/freee-remote-mcp.js:59 · File type combined with upload action — agent may exfiltrate local data files…jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".csv":"text/csv",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"}});import{z as re}from"zod";function Vn(e){x(e,"freee_file_upload"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/freee-sign-mcp.js:2 · File type combined with upload action — agent may exfiltrate local data files…l,Tr,Ot;var J=R(()=>{Pe();m();Sr=_r(import.meta.url),{version:yt}=Sr("../package.json");Tr=["fatal","error","warn","info","debug","trace","silent"];Ot=f.object({ISSUER_URL:f.string({required_error:"ISSUER_URL is required for serve mode."})…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/freee-mcp.js:76 · File type combined with upload action — agent may exfiltrate local data files…ema file ${e}: ${o.error.message}`);return o.data}var ho={accounting:"accounting.json",hr:"hr.json",invoice:"invoice.json",pm:"pm.json",sm:"sm.json",it_management:"it-management.json",fixed_asset_management:"fixed-asset-management.json",re…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/freee-sign-remote-mcp.js:21 · File type combined with upload action — agent may exfiltrate local data files…Error(`Sign token exchange failed: ${s.status} ${c.slice(0,200)}`)}let i=await s.json(),a=K.safeParse(i);if(!a.success)throw Error(`Invalid Sign token response: ${a.error.message}`);return{accessToken:a.data.access_token,refreshToken:a.dat…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/freee-remote-mcp.js:83 · File type combined with upload action — agent may exfiltrate local data files…=>"");throw Error(`freee token exchange failed: ${s.status} ${l}`)}let c=await s.json(),a=$e.safeParse(c);if(!a.success)throw Error(`Invalid freee token response: ${a.error.message}`);return{accessToken:a.data.access_token,refreshToken:a.d…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/freee-sign-remote-mcp.js:4 · npx invocation of non-well-known package — may execute untrusted code…・マイ印鑑・チーム管理をサポート。詳細ガイドはfreee-api-skill skillのSIGN-GUIDE.mdを参照。skillが未インストールの場合は npx skills add freee/freee-mcp で追加",xo,me=null,X="/oauth/sign-callback",Mo,Fo;var D=m(()=>…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/freee-remote-mcp.js:2 · npx invocation of non-well-known package — may execute untrusted code…業務委託管理・サーベイ・開業・人事評価・申告APIをサポート。詳細ガイドはfreee-api-skill skillを参照。skillが未インストールの場合は npx skills add freee/freee-mcp で追加",rt=7776000,ce="/oauth/freee-callback",nt="freee-mcp:oa…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Dense URL-encoded contentdist/openapi/minimal/hr.json:903 · Dense URL-encoded content — may be obfuscating payloads…l>\n <li><a href=\\\"https://support.freee.co.jp/hc/ja/articles/900004490226-%E5%8B%A4%E6%80%A0%E5%9F%BA%E6%9C%AC%E8%A8%AD%E5%AE%9A%E3%82%92%E8%A1%8C%E3%81%86#h_01EYPYTR9HZ7YB8V5F18VMD1BT\"target=\\\"_blank\\\">『退勤を自動打刻する』</a>の設定を使用している場合…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionbin/freee-mcp.js:18 · File type combined with upload action — agent may exfiltrate local data files…ry{return(await be.readdir(e)).filter((r)=>r.startsWith("tokens-")&&r.endsWith(".json"))}catch{return[]}}async function Bt(e){let t=j();try{let r=await qt();if(r.length>0){let n=Ye.join(t,r[0]),o=await be.readFile(n,"utf8"),i=JSON.parse(o)…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/freee-sign-mcp.js:4 · npx invocation of non-well-known package — may execute untrusted code…・マイ印鑑・チーム管理をサポート。詳細ガイドはfreee-api-skill skillのSIGN-GUIDE.mdを参照。skillが未インストールの場合は npx skills add freee/freee-mcp で追加",Pr,H=null,Or,In;var P=R(()=>{J();m();j=process.env.FRE…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Dense URL-encoded contentdist/openapi/minimal/accounting.json:3927 · Dense URL-encoded content — may be obfuscating payloads…\n <a href=\"https://support.freee.co.jp/hc/ja/articles/213726523--%E5%80%8B%E4%BA%BA-freee%E4%BC%9A%E8%A8%88%E3%81%AE%E3%83%97%E3%83%A9%E3%83%B3%E3%81%AB%E3%81%A4%E…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionbin/freee-remote-mcp.js:14 · File type combined with upload action — agent may exfiltrate local data files…ry{return(await lt.readdir(e)).filter((r)=>r.startsWith("tokens-")&&r.endsWith(".json"))}catch{return[]}}async function Zr(e){let t=ae();try{let r=await Yr();if(r.length>0){let n=Dt.join(t,r[0]),o=await lt.readFile(n,"utf8"),i=JSON.parse(o…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/freee-sign-remote-mcp.js:4 · File type combined with upload action — agent may exfiltrate local data files….enum(Mo).optional()})});async function $o(e){try{return{success:!0,data:await e.json()}}catch{return{success:!1,error:"Response body was not valid JSON"}}}function _(e,t){return{content:[{type:"text",text:e}],...t?.isError?{isError:!0}:{}…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)bin/freee-remote-mcp.js:83 · MCP server using network transport (SSE/HTTP) — data sent over network…ional(),display_name:ie.string().nullable().optional()})).optional()})});import{McpServer as Ms}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as Uu}from"@modelcontextprotocol/sdk/server/stdio.js";function co(e,t…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagebin/freee-sign-mcp.js:26 · npx invocation of non-well-known package — may execute untrusted code`),console.log(` npx skills add freee/freee-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/freee-remote-mcp.js:37 · File type combined with upload action — agent may exfiltrate local data files…(()=>{_n();Qt=Be.dirname(as(import.meta.url));ls=cs();ps={accounting:"accounting.json",hr:"hr.json",invoice:"invoice.json",pm:"pm.json",sm:"sm.json",it_management:"it-management.json",fixed_asset_management:"fixed-asset-management.json",re…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)bin/freee-sign-remote-mcp.js:21 · MCP server using network transport (SSE/HTTP) — data sent over network…n: ${H} - transport: ${r}`))}var $r=m(()=>{br();I();nt();D();Mr();ve()});import{McpServer as es}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as Uc}from"@modelcontextprotocol/sdk/server/stdio.js";function Gr(e){…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈50 tok
1 file · 20 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for freee-mcp@0.38.0 as of 38 h ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/freee-mcp/config.json, ~/.config/freee-mcp/config.json.
  2. Unclaimed publisher≈ +8 on the totalClaim freee: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim freeePropose a patch to the maintainer