Labsco
MCP SERVER

Kintone OAuth MCP Server

by r3-yamauchi ↗

kintone for the browser version of Claude — a Cloudflare Workers server with 28 tools and OAuth, so no API key ever lands on a laptop.

ERP & Vertical Business Systems
Summary
Deploy once, and nobody stores a key.

The reason to take the Workers detour is that credentials never sit on a user's machine: the OAuth flow runs in the browser, tokens live in KV, and the same deployment serves everyone on the domain — which is also what makes it usable from the web version of Claude. Two setup details decide whether it works: the redirect endpoint must match the deployed Worker URL exactly, and the OAuth client's user settings control who is allowed to use the server at all.

What it is

A remote MCP server for kintone, deployed to Cloudflare Workers. Authentication is OAuth against cybozu.com rather than a stored API key, and one deployment serves every user on the same cybozu.com domain.

What you get
  • Record work: read one or many, add one or several at once, update, comment, and evaluate access rights — `getRecords`, `getRecord`, `addRecord`, `addRecords`, `updateRecord`, `getRecordComments`, `addRecordComment`, `evaluateRecordsAcl`
  • App configuration as data: basic info, fields, search, general settings, form layout, views, process management, graphs, customization and actions — `getApp`, `getAppFields`, `searchApps`, `getAppSettings`, `getFormLayout`, `getViews`, `getProcessManagement`, `getAppReports`, `getAppCustomize`, `getAppActions`
  • File upload and download — `uploadFile`, `downloadFile`
  • Permission inspection at app, record and field level — `getAppAcl`, `getRecordAcl`, `getFieldAcl`
  • Notification settings, per app, per record and reminders — `getAppNotificationsGeneral`, `getAppNotificationsPerRecord`, `getAppNotificationsReminder`
  • Deployment control for customization — `updateAppCustomize` and `deployApp`, which pushes app settings to the running environment
  • Two authentications chained: the MCP client authorizes against the Worker, and the Worker authorizes against kintone
Requirements

A Cloudflare account and Wrangler, Node.js 18 or newer, and administrator rights on the cybozu.com domain to create the OAuth client. The scopes are `k:app_record:read`, `k:app_record:write`, `k:app_settings:read`, `k:app_settings:write`, `k:file:read` and `k:file:write`. Deployment settings live in `wrangler.jsonc` as `CYBOZU_CLIENT_ID`, `CYBOZU_CLIENT_SECRET`, `CYBOZU_SUBDOMAIN`, `COOKIE_ENCRYPTION_KEY` and `WORKER_URL`, plus a KV namespace created with `wrangler kv:namespace create "OAUTH_KV"` for OAuth state. After `wrangler deploy`, the redirect endpoint in cybozu.com common administration must be set to the Worker URL with `/callback` appended, and clients connect to the `/sse` URL.

Setup effort

One command plus a key — wrangler deploy, then supply credentials