Add freee-mcp, the hosted MCP server, to the catalog - #44
Merged
Conversation
The server at mcp.freee.co.jp is its own issuer: its protected resource metadata names an authorization server on the same host, with dynamic client registration (RFC 7591) and the scopes mcp:read and mcp:write. A token from there is not a freee API token, so mcp.freee.co.jp is the only host, and it is opaque, so no agent may hold freee and freee-mcp together. The authorization it fronts is freee's own application, taken with reading and writing both whichever scopes are chosen - the mcp scopes narrow what the server will do, not what the grant covers - so read stays the floor and write sits on the menu. An S256 code challenge is required, not optional: the endpoint refuses a request without one. Registration comes without its management half (RFC 7592): no registration access token is returned and the registration URI answers 405, so a client registered with the wrong redirect URI stays behind for good. The setup text warns about it, as notion-mcp's does. 🤖 Generated with Claude Code
The sentence mirrors what `gete connections` prints, and the catalog gained freee-mcp without it, so the README undersold what ships. The Zendesk addition kept the two in step; this keeps the habit. 🤖 Generated with Claude Code
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
freee hosts a remote MCP server at
https://mcp.freee.co.jp/mcp(freee/freee-mcp). It is a different issuer from the freee API: its protected resource metadata (/.well-known/oauth-protected-resource/mcp) names an authorization server athttps://mcp.freee.co.jp/with its own authorize, token, and registration endpoints, and a token from there is not a freee API token. That is the same shape asnotion-mcp, so the catalog can carry the entry.What
Everything the entry claims is observed from the public endpoints:
mcp.freee.co.jp.api.freee.co.jpstays off the list: naming both would say that either service's token may be sent to the other.freeeis accepted the same way, so one agent cannot hold the two side by side. Pinned by a test.code_challengeis refused withinvalid_request. The entry setspkce: true.mcp:readandmcp:write, but the consent it takes upstream is for freee's own application and covers reading and writing whichever mcp scopes are asked — they narrow what the server will do, not what the grant covers. The entry keepsmcp:readas the floor and offersmcp:writeon the menu, and the setup text tells a read-only agent to say so on itsmcp:block as well, since the tools are a thin pass-through over the whole API surface.registration_access_tokencomes back and the registration URI answers 405, so a client registered with the wrong redirect URI cannot be deleted — the same trapnotion-mcp's setup text warns about, worded the same way here. An application from the freee developer console is refused asinvalid_client: it belongs to the freee API's own authorization server, and this one keeps a register of its own.verified:is absent because no authorization has been taken through Gemini Enterprise yet, as withzendesk.