getRecordsLABSCO SUMMARY
Deploy once, and nobody stores a key.
The reason to take the Workers detour is that credentials never sit on a user's machine: the OAuth flow runs in the browser, tokens live in KV, and the same deployment serves everyone on the domain — which is also what makes it usable from the web version of Claude. Two setup details decide whether it works: the redirect endpoint must match the deployed Worker URL exactly, and the OAuth client's user settings control who is allowed to use the server at all.
What it is
A remote MCP server for kintone, deployed to Cloudflare Workers. Authentication is OAuth against cybozu.com rather than a stored API key, and one deployment serves every user on the same cybozu.com domain.
What you get
- Record work: read one or many, add one or several at once, update, comment, and evaluate access rights —
getRecords,getRecord,addRecord,addRecords,updateRecord,getRecordComments,addRecordComment,evaluateRecordsAcl - App configuration as data: basic info, fields, search, general settings, form layout, views, process management, graphs, customization and actions —
getApp,getAppFields,searchApps,getAppSettings,getFormLayout,getViews,getProcessManagement,getAppReports,getAppCustomize,getAppActions - File upload and download —
uploadFile,downloadFile - Permission inspection at app, record and field level —
getAppAcl,getRecordAcl,getFieldAcl - Notification settings, per app, per record and reminders —
getAppNotificationsGeneral,getAppNotificationsPerRecord,getAppNotificationsReminder - Deployment control for customization —
updateAppCustomizeanddeployApp, which pushes app settings to the running environment - Two authentications chained: the MCP client authorizes against the Worker, and the Worker authorizes against kintone
Requirements
A Cloudflare account and Wrangler, Node.js 18 or newer, and administrator rights on the cybozu.com domain to create the OAuth client. The scopes are k:app_record:read, k:app_record:write, k:app_settings:read, k:app_settings:write, k:file:read and k:file:write. Deployment settings live in wrangler.jsonc as CYBOZU_CLIENT_ID, CYBOZU_CLIENT_SECRET, CYBOZU_SUBDOMAIN, COOKIE_ENCRYPTION_KEY and WORKER_URL, plus a KV namespace created with wrangler kv:namespace create "OAUTH_KV" for OAuth state. After wrangler deploy, the redirect endpoint in cybozu.com common administration must be set to the Worker URL with /callback appended, and clients connect to the /sse URL.
Setup effort
Build from source — git clone https://github.com/r3-yamauchi/kintone-oauth-mcp-server-cfw.git
USE CASES
01
Using kintone from a browser-based assistant
Connect the Worker's SSE URL as an integration and approve the OAuth prompt, with nothing installed locally.
02
Answering a question about app data
Search apps, read the fields, then pull the records that answer the question.
03
Bulk-loading records
Add several records in one call rather than one request per row.
04
Auditing who can see what
Read the app, record and field level permissions together.
05
Shipping a JavaScript customization
Update the customization settings, then push them to the running environment.
28 tools
Listed in project docs. Your client may show a different list.
getRecordaddRecordaddRecordsupdateRecordgetRecordCommentsaddRecordCommentevaluateRecordsAclgetAppgetAppFieldssearchAppsgetAppSettingsgetFormLayoutgetViewsgetProcessManagementgetAppReportsgetAppCustomizegetAppActionsuploadFiledownloadFilegetAppAclgetRecordAclgetFieldAclgetAppNotificationsGeneralgetAppNotificationsPerRecordgetAppNotificationsReminderupdateAppCustomizedeployAppBEFORE YOU INSTALL
What to know first
Tools you get
28 tools named in the project's documentation.
Requires
- A Cloudflare account and the Wrangler CLI
- Node.js 18 or newer
- Administrator rights on your cybozu.com domain, to create the OAuth client
- CYBOZU_CLIENT_ID and CYBOZU_CLIENT_SECRET, shown when you save the OAuth client in cybozu.com common administration, and written into the vars section of wrangler.jsonc, not your environment
- CYBOZU_SUBDOMAIN, COOKIE_ENCRYPTION_KEY (any random string, e.g. openssl rand -hex 32) and WORKER_URL, in the same vars section
- A KV namespace named OAUTH_KV (wrangler kv:namespace create "OAUTH_KV"), its ID written into wrangler.jsonc
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
In cybozu.com common administration, add an OAuth client (guide: https://cybozu.dev/ja/common/docs/oauth-client/add-client/) with the redirect endpoint set to https://localhost:8788/callback for now and the scopes k:app_record:read, k:app_record:write, k:app_settings:read, k:app_settings:write, k:file:read and k:file:write. Note the client ID and client secret shown after saving, and pick the users allowed to use it in the client's user settings.
TERMINAL
git clone https://github.com/r3-yamauchi/kintone-oauth-mcp-server-cfw.git
cd kintone-oauth-mcp-server-cfw
npm installSet CYBOZU_CLIENT_ID, CYBOZU_CLIENT_SECRET, CYBOZU_SUBDOMAIN, COOKIE_ENCRYPTION_KEY (any random string) and WORKER_URL in the vars section of wrangler.jsonc.
TERMINAL
wrangler kv:namespace create "OAUTH_KV"Write the KV ID it prints into the <YOUR_CLOUDFLARE_KV_ID> field of wrangler.jsonc.
TERMINAL
wrangler deployBack in cybozu.com common administration, change the OAuth client's redirect endpoint to your Worker URL with /callback on the end (https://<YOUR_SUBDOMAIN>.workers.dev/callback).
MCP Clients
Claude.ai
Open Claude's integration settings (https://claude.ai/settings/integrations) and click Add integration.
Give it a name, and enter https://<YOUR_SUBDOMAIN>.workers.dev/sse as the integration URL.
Click Add, then Connect, and approve the OAuth screen.
Neither client setup holds a secret: the kintone sign-in values go into the Worker you deploy.
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"kintone": {
"command": "npx",
"args": [
"mcp-remote",
"https://<YOUR_SUBDOMAIN>.workers.dev/sse"
]
}
}
}Neither client setup holds a secret: the kintone sign-in values go into the Worker you deploy.
