MCP Server for Frappe

Nsuregrowth · May 25, 2025, 7:16am

Any plan for an offical MCP server for ERPNext/Frappe ?
This could be powerful to interact wth Database through just NLP.

Would love to know the nuances around this.

raj_007 · May 25, 2025, 8:43am

That’s Here. And one I’m also building.

Nsuregrowth · May 25, 2025, 2:27pm

Thanks for this, any thoughts on the security piece, giving access an LLM of our database is something which I am not 100 % sure, what are your views, anything i could read which helps me understand the nuances around this

agaitan · November 18, 2025, 1:38am

will be good

Sanath_Udayawansa2 · December 10, 2025, 3:46am

hose repo no longer available. May be it is better to have official MCP server for better implementation of AI with erpnext. I found this GitHub - rakeshgangwar/erpnext-mcp-server: Connect AI assistants to your ERPNext instance via the Model Context Protocol (MCP) using the official Frappe API. but need improvements in reporting part. in this case frappe assistant core to good job. but it is very trikey to implement with new authentication sysytem. you can do with the help of AI to set it up since no proper guid for authentication system still.

golu07 · October 16, 2026, 5:38am

Happy to share that we have built Frax, an MCP tool

Check it out here: GitHub - sanskar-onehash/frax: MCP server for secure ERP automation, AI-assisted operations, reporting, and Frappe integrations. · GitHub

We’ve been using it internally, and the experience has been awesome so far!

Give it a try, and we’d love to hear your feedback. If you run into any issues or have ideas for improvement, feel free to share them. We’re always looking for ways to make it better!

BlakeWest · October 16, 2026, 1:56pm

Thanks for this!

federico_calvo · October 16, 2026, 3:21pm

github.com/frappe/frappe

feat(mcp): add a built-in MCP server (#44431)

develop ← aryadharmadhikari:feat/builtin-mcp

opened 07:41AM - 14 Oct 26 UTC

aryadharmadhikari

+2798 -4

## Summary Add a built-in MCP endpoint at `/api/v2/mcp` so agents can inspect… site metadata, read and change documents, and call whitelisted methods. The server provides 15 tools that reuse Frappe’s authentication, permissions, and API handlers. It uses existing dependencies without adding the MCP SDK. MCP is enabled by default and configurable per site through **MCP Settings**. This follows the goal of #41933. no-docs: Usage instructions and connection examples for MCP Inspector, Codex, and Claude Code are included in `frappe/mcp/README.md`. ## Architecture ```mermaid sequenceDiagram participant U as User participant H as AI host participant C as MCP client participant F as Frappe MCP endpoint participant D as Frappe documents and permissions U->>H: Find my open ToDos H->>C: Ask what tools Frappe provides C->>F: tools/list over HTTP POST with credentials F->>F: Resolve site and authenticate user F-->>C: Tool names, site descriptions, and input schemas C-->>H: Available tools H->>C: Call list_documents with ToDo filters C->>F: tools/call over HTTP POST with credentials F->>F: Resolve site, authenticate, and validate arguments F->>D: Check permissions and query matching documents D-->>F: Permitted results F-->>C: JSON tool result with site and user identity C-->>H: Result H-->>U: Summarize the ToDos ``` The MCP client forms protocol messages. Tool handlers call existing Python API handlers directly, without another HTTP request. ## Tools ### Site and metadata discovery | Tool | Purpose | | --- | --- | | `get_site_info` | Identify the site, user, roles, modules, and server settings. | | `search_doctypes` | Find DocTypes by name or module. | | `get_doctype_schema` | Inspect fields, child table references, and permission flags. | | `search_methods` | Find whitelisted API functions and document methods. | | `get_method_schema` | Inspect an API function’s arguments and documentation. | | `list_document_methods` | List whitelisted instance methods for a DocType. | | `get_document_method_schema` | Inspect an instance method’s arguments and documentation. | ### Document operations | Tool | Purpose | | --- | --- | | `list_documents` | Query filtered rows with field selection, sorting, and pagination. | | `get_document` | Read one document, including permitted fields and child rows. | | `count_documents` | Count matching documents. | | `create_document` | Create one document. | | `update_document` | Update one document. | | `delete_document` | Delete one document. | Lists query rows directly, default to 20 names, and return `has_next_page`. Writes operate on one document per call through API v2 validation and controller hooks. ### Method execution | Tool | Purpose | | --- | --- | | `call_method` | Invoke a whitelisted API function or API Server Script. | | `call_document_method` | Invoke a stored document’s whitelisted method, including submit and cancel. | Method calls preserve existing overrides and API Server Script dispatch, without an MCP-specific method allowlist. ## Authentication and permissions The endpoint reuses API key/secret authentication, OAuth bearer tokens, and existing sessions with their CSRF rules. OAuth uses Frappe’s existing provider and discovery endpoints. - Authenticated users can inspect DocType schemas without gaining document access. - Method discovery remains restricted to System Managers. - Document operations enforce Frappe permissions. - Calling a known method follows its existing authorization behavior. Whitelisted RPC methods remain responsible for their own business permission checks. ## Site configuration and identity **MCP Settings** is a Single DocType managed by System Managers: | Field | Behavior | | --- | --- | | Enable MCP | Checked by default. Uncheck to disable the endpoint. | | Server Name | Defaults to the site name when empty. | | Server Description | Describes the site’s purpose. | | Agent Instructions | Optional guidance exposed during initialization, server discovery, and through `get_site_info`. | The `disable_mcp_server` site config can also force MCP off. Each connection uses its site’s URL and credentials. Tool descriptions identify the site, and tool results include the site and authenticated user. ## Protocol and request handling - Streamable HTTP with synchronous JSON responses. - Support for `2025-11-25` initialization and `2026-07-28` request metadata and server discovery. - Server validation of headers, origins, JSON-RPC messages, and tool arguments. Pydantic supplies strict input schemas. - Text and structured tool results, with `isError: true` for tool failures. The request parser leaves MCP’s JSON body to the transport and prevents `cmd` from overriding routing. ### Transactions Successful POST requests commit through Frappe’s normal transaction handling. Tool execution or serialization failures roll back pending database changes. Changes explicitly committed within a called method cannot be undone by a later rollback. ## Related API permission fix API v2 now checks write permission on the stored document before applying update data. Previously, incoming assignment fields could make a caller pass the permission check after mutation. The fix protects both REST and MCP updates and includes regression coverage for denied and permitted updates.