Kintone

This MCP server lets you securely connect kintone to your AI assistant by using OAuth within Cloudflare Workers. It avoids storing sensitive API keys locally and enables a shared, multi-user connection that works from web, desktop, and other MCP clients.

How to use

You can access the remote MCP server from your MCP client (for example Claude Web, Claude Desktop, or other compatible tools) to perform kintone operations without embedding credentials in the client. Use the SSE endpoint to establish the session and authorize access. Once authenticated, your MCP client can request kintone resources such as records, app settings, file handling, and notifications through the MCP server. The workflow supports multiple users from a single deployment, all sharing the same kintone OAuth integration.

Key usage patterns you can follow after setup:

• Connect a client to the remote MCP server endpoint and complete the OAuth flow to authorize your cybozu.kintone account.

How to install

# Prerequisites
- Cloudflare account
- cybozu.com domain administrator rights (OAuth client creation)
- Node.js 18 or newer
- Wrangler CLI

# 1. Acquire OAuth credentials from cybozu.com
# Follow the official process to create an OAuth client. Key items you will obtain:
# - Client ID
# - Client Secret
# - Subdomain (your cybozu.com domain)
# - Redirect URI will be set during setup

# 2. Clone the MCP server project
git clone https://github.com/r3-yamauchi/kintone-oauth-mcp-server-cfw.git
cd kintone-oauth-mcp-server-cfw

# 3. Install dependencies
npm install

# 4. Configure environment variables in wrangler configuration
# Edit wrangler.jsonc and fill in the values you obtained
{
  "vars": {
    "CYBOZU_CLIENT_ID": "<your cybozu.com client id>",
    "CYBOZU_CLIENT_SECRET": "<your cybozu.com client secret>",
    "CYBOZU_SUBDOMAIN": "<your cybozu.com sub domain>",
    "COOKIE_ENCRYPTION_KEY": "<your cookie encryption key>",
    "WORKER_URL": "<your worker url>"
  }
}

# 5. Create a Cloudflare KV namespace for OAuth state
wrangler kv:namespace create "OAUTH_KV"

# Note the KV namespace ID and add it to wrangler.jsonc where required

# 6. Deploy to Cloudflare Workers
wrangler deploy

After deployment, set the redirection endpoint in your cybozu.com OAuth client to the deployed Workers URL with /callback appended. For local development you can use the development URL and add /callback when testing.

Additional configuration and usage notes

Claude Web app integrations require you to add a remote MCP server connection using the SSE URL. Use the following as the integration URL: https://<your-subdomain>.workers.dev/sse. After you authorize, Claude will be able to access kintone through the MCP server.

Claude Desktop users can add a local MCP configuration that points to the remote server. The example configuration assumes your SSE endpoint is at the deployed workers URL.

Troubleshooting tips

If you encounter a 401 Unauthorized, verify that your Cybozu OAuth client is configured with the exact redirect URI, the required scopes, and that the client_id and client_secret are correct. Ensure the environment variables CYBOZU_CLIENT_ID, CYBOZU_CLIENT_SECRET, CYBOZU_SUBDOMAIN, and COOKIE_ENCRYPTION_KEY are properly set. Check the developer console for messages like OAuth Callback Received or Starting Token Exchange to pinpoint where the flow is failing.

Architectural overview

This solution runs on Cloudflare Workers for a scalable, serverless MCP server. It uses KV storage to persist OAuth state and encrypted cookies to remember approved clients. The MCP Remote library defines the client-server communication protocol and maintains an SSE connection for ongoing interactions.

Security and notes

The design intentionally avoids storing API keys in the client. OAuth is used to access kintone resources securely. Deploy once to serve many users on the same cybozu.com domain, keeping credentials off client devices.

Available tools

getRecords

Fetches a list of records from a kintone app, including pagination support and query parameters as needed.

getRecord

Retrieves a single record by its ID from a kintone app.

addRecord

Adds a new record to a kintone app.

addRecords

Adds multiple records to a kintone app in a single operation.

updateRecord

Updates an existing record in a kintone app by its ID.

getRecordComments

Retrieves comments associated with a specific record.

addRecordComment

Adds a comment to a specific record.

evaluateRecordsAcl

Evaluates access control for records to determine permissions.

getApp

Retrieves basic information for a kintone app.

getAppFields

Retrieves the field list for a kintone app.

searchApps

Searches for apps within the kintone domain.

getAppSettings

Retrieves general settings for a kintone app.

getFormLayout

Gets the form layout for a kintone app.

getViews

Retrieves list views configuration for an app.

getProcessManagement

Fetches process management settings for an app.

getAppReports

Retrieves graph/report configurations for an app.

getAppCustomize

Retrieves JavaScript/CSS customization settings for an app.

getAppActions

Retrieves action configurations for an app.

uploadFile

Uploads a file to kintone and returns file metadata.

downloadFile

Downloads a file from kintone using file metadata.

getAppAcl

Retrieves the access control list for an app.

getRecordAcl

Retrieves access control for a specific record.

getFieldAcl

Retrieves field-level access control for an app.

getAppNotificationsGeneral

Fetches general notification settings for an app.

getAppNotificationsPerRecord

Fetches per-record notification settings.

getAppNotificationsReminder

Fetches reminder notification settings for an app.

updateAppCustomize

Updates JavaScript/CSS customization for an app.

deployApp

Deploys app customization to a live environment.