MCP Server for Frappe

A secure, audit-logged Model Context Protocol (MCP) server for Frappe. This app allows you to expose specific DocTypes and operations to MCP clients (like AI agents) with strict granular permissions, ensuring secure and controlled access to your Frappe data.

Features

• Secure Authentication: dedicated MCP User access via Token or API Key.
• Granular Allowlist: Explicitly allow specific DocTypes and operations (Create, Read, Update, Delete).
• Field-Level Control: Restrict which fields can be read or written.
• Audit Logging: Every request is logged with latency, status, and payload summaries.
• Strict Validation: All filters and inputs are validated against the allowlist.

Installation

1. Get the app:

   bench get-app https://github.com/mascor/frappe-mcp-server
   

2. Install on your site:

   bench --site  install-app mcp_server
   

Configuration

1. Setup MCP User & Settings

You can use the included setup script to quickly configure the server with a default user and token:

bench --site  execute mcp_server.setup.setup_mcp

This will:

• Create a user [email protected] (if not exists).
• Generate a secure X-MCP-Token and save it in MCP Server Settings.
• Enable the MCP Server.

Alternatively, go to MCP Server Settings in Desk and configure manually.

2. Configure Allowlist

By default, no access is allowed. You must explicitly allow DocTypes.

1. Go to MCP Doctype Allowlist.
2. Create a new record for the DocType you want to expose (e.g., ToDo).
3. Check the operations you want to allow (Allow Read, Allow Create, etc.).
4. (Optional) restricting fields and filters in the child tables for tighter security.

Usage

The server exposes standard MCP tools via the API.

Authentication

The server supports API Key authentication (recommended for MCP clients).

Include the Authorization header in all requests.

Tools

mcp_ping

Health check and version info.

curl -X POST https:///api/method/mcp_server.api.ping \
     -H "Authorization: token :"

search_docs

Search for documents with filters.

{
    "doctype": "ToDo",