← Back to directory
K

kintone MCP Server

Official
kintone's official local MCP server for managing apps, records, and spaces
Category
Database #35 of 58
Stars
★ 58 Popular
Transport
stdio (local process)
Runtime
Docker · Node.js
Credentials
API key / credential required
License
Apache-2.0
Last commit
Tools
26
53FMRS · D

kintone MCP Server is Cybozu's official, open-source (Apache-2.0) local MCP server that exposes about 25 tools over the kintone REST API for managing apps, fields, forms, records, and spaces. It supports MCPB, Docker, and npm installs plus multiple auth methods, but does not support guest spaces and is explicitly outside kintone's official API support channel, with issues tracked via GitHub.

Strongest · Documentation 15/20 Weakest · Security and permissions 3/20

Reliability
8/20
Security and permissions
3/20
Maintenance
14/20
Documentation
15/20
Setup experience
13/20
Why each score
Reliability 8/20
The README shows a CI badge and an npm version badge, implying some automated build/publish pipeline exists, and lists 25 tools whose descriptions are internally consistent with typical kintone REST API operations (get/add/update/delete apps, records, spaces, etc.) with no visible contradictions. However, this review had no access to an actual server manifest (manifest not cached), no CI workflow file contents, and no test code, so the real behavior of MCP init/tool-list handshake, input/output schemas, and error handling cannot be verified — everything remains at the level of documentation claims. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence (real CI workflow plus committed tests covering key paths); given the total absence of such evidence, the score is further reduced to 8.
Security and permissions 3/20
This server exposes several irreversible, high-impact operations: kintone-delete-records (bulk record deletion), kintone-delete-space (space deletion), kintone-delete-form-fields (field deletion), and kintone-deploy-app (pushes app configuration to the production/operational environment). Nowhere in the README (install, config, tool list, limitations, troubleshooting) is there any indication that the server itself requires a confirmation step, dry-run mode, or other safety gate before executing these destructive actions — the safety boundary relies entirely on the calling client/user's discretion. This matches the red-line criterion of 'irreversible delete/deploy defaults without confirmation.' Additionally, credentials (username/password, API token, client certificate password) are passed via CLI arguments or environment variables; the CLI-argument path carries the common risk of credentials appearing in process listings, and the docs do not mention any log redaction. Based on this red-line finding, security is scored 3, with the red-line issue explicitly flagged here.
Maintenance 14/20
This repository is the official kintone (Cybozu) local MCP server, giving it clear ownership. The README includes a CI badge, an npm package version badge, the Apache-2.0 license, a link to a CONTRIBUTING.md guide, and a channel for bug reports/feature requests via GitHub Issues; the 'Support Policy' section also clarifies governance by stating the project is outside kintone's official API support desk and directs users to Issues instead. These signals indicate an actively maintained, clearly owned project. However, the README does not show concrete release history, a changelog, release cadence, or a dependency-update policy, nor a dedicated security-response channel, leaving some governance and versioning gaps — hence 14 rather than a top score.
Documentation 15/20
Documentation is fairly comprehensive: three installation paths (MCPB extension, Docker image, npm global install) with concrete steps, an MCP client configuration file example, a configuration options table (mapping CLI flags to env vars, required/optional status, and precedence rules), a separate authentication guide link, a full list of 25 tools with brief descriptions, usage notes, several documented limitations (e.g., no attachment-field registration, no guest-space support), troubleshooting guidance for connection/auth/permission errors, and a privacy policy reference. The gap is that the tool list only gives a name and a one-line description per tool, without per-tool input parameter schemas, return structures, or worked call examples (e.g., JSON Schema or sample payloads), and there is no mention of API call cost or rate-limit implications. Overall usable but with detail gaps, scored 15.
Setup experience 13/20
Installation paths are clear and cover mainstream scenarios: Claude Desktop users can drag-and-drop the MCPB package for a one-click install with a GUI form for credentials; Docker and npm both provide copy-pasteable commands; and standard MCP client (e.g., Claude Code, Cursor) config file paths and JSON examples are given, along with HTTPS_PROXY setup guidance for proxied environments. The steps are concise and platform coverage (Docker/npm/MCPB) is broad. However, per the static calibration rule, setup cannot exceed 15 without verifiable execution evidence (e.g., actual run logs or passing integration tests), and no first-hand evidence of a successful run is present in the material — only procedural instructions — so the score is capped at 13.

Static review · not runListed 2026-08-26

Read the FMRS scoring method →

Fit and risk

What it can accessWrites / deletes local filesUses the network

Best for

  • Teams already using the kintone platform who want an AI assistant to operate on apps and records
  • Administrators who need to bulk-maintain kintone fields, forms, or general settings
  • Developers who want to drive kintone REST API operations via natural language

Not for

  • Users who do not use the kintone platform
  • Scenarios requiring access to apps inside kintone guest spaces (unsupported)
  • Bulk record imports that need to set attachment field contents directly (unsupported)

Required permissions

  • A kintone login username and password, or API token(s) (up to 9, comma-separated)
  • Optional Basic auth username and password
  • Optional client certificate (PFX file and password) for secure-access domains
  • Actual app access depends on the View/Add/Edit/Delete kintone permissions granted to the account or token used

Risks and side effects

  • The server can directly call the kintone REST API to add, update, and delete records, fields, and app settings, so mistakes can cause data loss or broken app configurations
  • Credentials (password, API token, client certificate password) are passed via command-line arguments or environment variables, so config files and env vars must be protected from exposure
  • Guest space apps are not supported, which can cause access issues if business processes rely on them
  • The README states this server is outside kintone's official API support channel; issues must be reported via GitHub Issues

Setup

Before you start

Runtime:Docker · Node.js

KINTONE_BASE_URL required Base URL of your kintone environment (e.g. https://example.cybozu.com); required.
KINTONE_PASSWORD optionalsecret kintone login password; sensitive, paired with KINTONE_USERNAME.
KINTONE_API_TOKEN optionalsecret API token generated in kintone app settings; up to 9 comma-separated tokens can be given instead of password auth.
KINTONE_BASIC_AUTH_PASSWORD optionalsecret Password for Basic authentication; optional.
KINTONE_PFX_FILE_PASSWORD optionalsecret Password for the PFX certificate file; optional.
Other optional settings (5)
KINTONE_USERNAME optional kintone login username; used with password auth as an alternative to an API token.
KINTONE_BASIC_AUTH_USERNAME optional Username for environments with Basic authentication enabled; optional.
KINTONE_PFX_FILE_PATH optional Path to a PFX file for client certificate authentication; optional (domain must be .s.cybozu.com).
HTTPS_PROXY optional HTTPS proxy URL for corporate environments (e.g. http://proxy.example.com:8080); optional.
KINTONE_ATTACHMENTS_DIR optional Directory where kintone-download-file saves downloaded files; the tool errors out if unset.

1) MCPB: download kintone-mcp-server.mcpb from the GitHub Releases page, drag it into Claude Desktop's Extensions page, confirm the install, then enter the kintone Base URL, username, and password in the setup dialog. 2) Docker: install Docker, then run docker run -i --rm -e KINTONE_BASE_URL=... -e KINTONE_USERNAME=... -e KINTONE_PASSWORD=... ghcr.io/kintone/mcp-server, or configure it as a stdio command in your client's mcp.json. 3) npm: run npm install -g @kintone/mcp-server, then launch with kintone-mcp-server --base-url ... --username ... --password ... (or the equivalent environment variables).

claude_desktop_config.json
{"mcpServers":{"kintone":{"type":"stdio","command":"docker","args":["run","-i","--rm","-e","KINTONE_BASE_URL","-e","KINTONE_USERNAME","-e","KINTONE_PASSWORD","ghcr.io/kintone/mcp-server:latest"],"cwd":"${cwd}","env":{"KINTONE_BASE_URL":"https://example.cybozu.com","KINTONE_USERNAME":"username","KINTONE_PASSWORD":"password"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "kintone": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "KINTONE_BASE_URL",
        "-e",
        "KINTONE_USERNAME",
        "-e",
        "KINTONE_PASSWORD",
        "ghcr.io/kintone/mcp-server:latest"
      ],
      "cwd": "${cwd}",
      "env": {
        "KINTONE_BASE_URL": "https://example.cybozu.com",
        "KINTONE_USERNAME": "username",
        "KINTONE_PASSWORD": "password"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add kintone -e KINTONE_BASE_URL=https://example.cybozu.com -e KINTONE_USERNAME=username -e KINTONE_PASSWORD=password -- docker run -i --rm -e KINTONE_BASE_URL -e KINTONE_USERNAME -e KINTONE_PASSWORD ghcr.io/kintone/mcp-server:latest

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

After starting the server, tools such as kintone-get-apps should appear in your client's tool list; asking 'List my kintone apps' and getting back an app list confirms the connection works.

Troubleshooting

  1. Connection errors: verify the Base URL is correct (e.g. https://example.cybozu.com), set the HTTPS_PROXY environment variable if behind a proxy, and retry after a few minutes for transient failures
  2. Authentication errors: verify the username and password; do not specify username/password and an API token together (password auth takes priority if both are set); when using a client certificate, confirm you're using the secure-access domain (e.g. .s.cybozu.com)
  3. Permission errors: confirm the user or API token has access to the target app (app management or record view permission may be required); confirm the app is not in a guest space; when using an API token, confirm it has been granted the needed View/Add/Edit/Delete permissions
  4. Before using kintone-download-file, you must set --attachments-dir or KINTONE_ATTACHMENTS_DIR to a save directory or the tool call will error; a nonexistent directory will be created automatically

Things to try

Once connected, you can ask your AI assistant things like:

  • List all apps in my kintone environment.
  • Read the form fields of app 10, then add a single-line text field named 'Notes'.
  • Query records created today in app 20 and add a comment to each record.
  • Download the files in the attachment field of record 5 and save them locally.

Tools 26

kintone-get-apps read-only
Get information for multiple apps
kintone-get-app read-only
Get detailed information for a single app
kintone-get-form-fields read-only
Get an app's field settings
kintone-get-form-layout read-only
Get an app's form layout
kintone-update-form-fields writes
Update an app's field settings
kintone-update-form-layout writes
Update an app's form layout
kintone-delete-form-fields destructive
Delete fields from an app
kintone-get-process-management read-only
Get process management settings
Show 18 more tools
kintone-get-app-deploy-status read-only
Check whether app settings have been deployed to the production environment
kintone-get-general-settings read-only
Get an app's general settings
kintone-add-form-fields writes
Add fields to an app
kintone-get-records read-only
Retrieve multiple records
kintone-add-records writes
Add multiple records
kintone-update-records writes
Update multiple records
kintone-delete-records destructive
Delete multiple records
kintone-update-statuses writes
Update the status of multiple records
kintone-get-record-comments read-only
Get comments on a record
kintone-add-record-comment writes
Add a comment to a record
kintone-add-app writes
Create an app in the test environment
kintone-deploy-app writes
Deploy app settings to the production environment
kintone-update-general-settings writes
Change an app's general settings
kintone-download-file writes
Save files from an attachment field
kintone-add-space-from-template writes
Create a space from a template
kintone-update-space writes
Update space settings
kintone-get-space read-only
Get information about a space
kintone-delete-space destructive
Delete a space

Use cases

Let an AI assistant query and summarize record data in kintone apps
Bulk add, update, or delete kintone records
Manage kintone app fields, form layouts, and general settings
Deploy app configuration changes from the test environment to production
Create and manage kintone spaces and record comments

Supported clients

Claude Desktop
Claude CodePartial support
CursorPartial support

Listed from the project's documentation, not tested by this site.

Overview

An official local MCP server maintained by Cybozu that connects to the kintone REST API. It provides tools to manage apps, form fields and layouts, process management, general settings, records (CRUD plus comments and status updates), attachment downloads, and spaces (create from template, update, delete). It can be installed as an MCPB package for Claude Desktop, a Docker image, or an npm package, and supports username/password, API token, Basic auth, or client certificate authentication.

Similar servers

Source revision 9ef17842be49 Data synced 2026-10-12 Read the FMRS scoring method