freee-mcp
The freee-mcp server offers read-only access and controlled writes for freee HR attendance (punch clock and employee applications). Key capabilities include:
System Check: Verify backend (
freee_backend_status) and authentication (freee_auth_status).Identity: Retrieve authenticated user/company (API only,
freee_me).Punch Management: View available actions (
freee_clock_status), preview a specific punch (e.g., in, break-start, break-end, out) with a fingerprint for confirmation (freee_clock_prepare_action), and commit the punch only after preview and explicit user approval (freee_clock_commit_action).Team Attendance: Read department or monthly attendance summaries (
freee_team_status).Application Approvals: List applications by status (pending, returned, approved, all) (
freee_approvals_list), view full details of an application (freee_approval_detail), preview approve/return actions with a fingerprint (freee_approval_prepare_action), and commit the action after preview and user confirmation (freee_approval_commit_action).
All writes require a valid fingerprint from the corresponding preview and explicit user approval in the same message; they never execute automatically. The server does not support task execution.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@freee-mcpShow me my team's attendance status"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
freee MCP + CLI + Agent Skill
This project gives Claude Code, Codex, OpenCode, Pi, and other local coding agents safe, testable access to freee HR attendance workflows. Business logic lives in one shared core service, exposed through a local STDIO MCP server, a CLI, and a shared Agent Skill. The core supports two mutually exclusive backends: the freee Public API or controlled Playwright browser automation.
Install with your coding agent
Use Claude Code, Codex, Pi, OpenCode, or another local coding agent? Copy this prompt into it:
Install freee MCP and its Agent Skill from https://github.com/newbdez33/freee-mcp for the coding agent you are currently running. Detect whether this is Claude Code, Codex, Pi, OpenCode, or another agent and follow the matching user-scoped installation path in the README. Prefer the agent's native plugin or package manager; otherwise register the documented portable STDIO MCP command and install skills/freee in the agent's global Skill location. Do not ask me to clone the repository, start the agent from that repository, or add project-scoped configuration. Never ask me to paste a freee username, password, Client Secret, or Token into chat or command arguments. If credentials are missing, show the exact local System Keychain setup command returned by the MCP or companion CLI. Verify only read-only authentication and tool discovery; do not perform a real punch or approval action while installing.The repository is public. Users do not need a GitHub account or a working copy: the selected agent manages the plugin, package, or npm cache internally. The installed tools and Skill are user-scoped and work from any project directory.
Claude Code
Claude Code installs both MCP and the Skill through the native plugin marketplace:
claude plugin marketplace add https://github.com/newbdez33/freee-mcp.git
claude plugin install freee@freee-tools --scope userRun /reload-plugins in an existing Claude Code session, or start a new session from any directory. The plugin loads both the local STDIO MCP server and the freee Skill at user scope; users never need to open Claude Code from this repository. Run /mcp to inspect the connection.
For first-time Playwright authentication, ask Claude to check freee authentication. If credentials are missing, it returns an installation-specific command. Run that exact command yourself in a local interactive terminal. The command hides the username and password while saving them to System Keychain. MCP installation and approval never receive freee credentials.
Update Claude Code
Updates remain explicit by default so attendance code does not change without the user's knowledge. Copy this prompt into Claude Code when an update is wanted:
Update my installed freee@freee-tools Claude Code plugin and its marketplace, then reload plugins and verify the freee MCP connection. Preserve plugin data, System Keychain credentials, and the external Playwright profile. Do not manually clone the source repository and do not perform any real freee punch or approval action.The equivalent manual update is:
claude plugin marketplace update freee-tools
claude plugin update freee@freee-tools --scope userThen run /reload-plugins. Claude Code switches the MCP and Skill to the new cached plugin version without requiring a repository checkout or a new MCP registration. System Keychain entries, persistent plugin data, and the external ~/.freee-agent/playwright-profile survive normal plugin updates.
Plugin releases use semantic versions. Maintainers must bump package.json and .claude-plugin/plugin.json together; the test suite enforces that they match. Users remain on the last installed version until an explicit update succeeds.
Codex
Codex installs skills/freee with its Skill installer and registers this pinned, portable STDIO command at user scope:
codex mcp add freee -- npx --yes --package='github:newbdez33/freee-mcp#v0.4.7' freee-mcpThe opening installation prompt asks Codex to perform both steps. Restart Codex if the newly installed Skill is not discovered immediately, then use /mcp to verify the server connection.
OpenCode and other MCP clients
Register this as a user-level STDIO MCP command using the client's settings or MCP installer:
npx --yes --package='github:newbdez33/freee-mcp#v0.4.7' freee-mcpInstall skills/freee from this repository in the client's global Agent Skills location. OpenCode recognizes ~/.agents/skills/freee; other Agent Skills-compatible clients may use a different user-level directory. The opening installation prompt lets the running agent select the correct location without creating project files.
Pi
Install the repository as a user-level Pi package:
pi install git:github.com/newbdez33/freee-mcpPi loads the bundled skills/freee directory. If the installed Pi environment has no MCP extension, the Skill uses the package's companion CLI, which calls the same core service and enforces the same scoped-authorization, fingerprint, and state checks.
Update an existing installation
Copy this prompt into the agent that owns the installation:
Update my user-scoped freee installation from https://github.com/newbdez33/freee-mcp using the update mechanism for the coding agent you are currently running. For Claude Code, update freee-tools and freee@freee-tools, then reload plugins. For Codex, OpenCode, or another portable MCP installation, update the pinned GitHub release tag in the MCP command and refresh the global skills/freee installation. For Pi, update the installed Pi package. Preserve ~/.freee-agent, Claude plugin data, System Keychain credentials, and the external Playwright profile. Restart or reload the agent and verify only the read-only MCP connection or CLI status. Do not manually clone the repository and do not perform any real freee punch or approval action.For Pi, the equivalent manual update is pi update. Portable MCP installations deliberately pin a release tag; updating replaces only the code version in the MCP registration and Skill, while credentials and browser state remain outside the package cache.
Related MCP server: attendance-engine
Design decisions
FREEE_BACKEND=api|playwrightexplicitly selects the backend for every business operation. Onlyautoselects a backend by detecting an existing API configuration.A backend failure is final for that operation. The system never falls back to the other backend.
MCP is the primary business-operation interface for MCP-capable agents, providing tool discovery, input schemas, read-only/write annotations, and configurable host approval behavior.
The CLI remains the deterministic local interface for OAuth setup, System Keychain configuration, and troubleshooting.
MCP and CLI call the same
FreeeService; authentication, business rules, and backend selection are not duplicated.One shared Agent Skill directs supported agents to prefer MCP and use the CLI only when MCP is unavailable or local setup is required. An error must never be bypassed by switching interfaces.
Business writes are authorized by their human-readable outcome and scope, not by asking the user to approve an internal fingerprint. An exact instruction or scoped policy lets the Agent prepare, validate, commit, and verify sequential single-item operations without a second prompt per item. See ADR-0004.
The Playwright backend stores the freee username and password in System Keychain and fills them only on the expected official freee login page.
The legacy
freee-checkinproject informed the login flow and selectors, but this project does not reuse its.envpassword, force clicks, environment-variable logging, or unconfirmed scheduled writes.
Business capability status
This table describes the current main branch. “Covered” means the behavior and its safety stops have automated unit or protocol tests; it does not mean that a real freee write was performed. Real-environment evidence is tracked separately in the live validation checklist, while planned implementation work remains in TODO.md.
Business capability | Backend | Implementation | Automated tests | Real freee validation |
Backend selection and authentication status | API + Playwright | Complete; one backend is selected exclusively | Covered | API OAuth/System Keyring and Playwright System Keychain/headless login validated |
Current user and company identity | API | Complete; Playwright identity is not implemented | Covered | API path validated |
Current punch status and available actions | API + Playwright | Complete | Covered | Both read paths validated |
Clock in, break start/end, and clock out | API + Playwright | Complete for current-time punches | Covered, including confirmation and stale-state rejection | Real commits pending ( |
Personal monthly status, warnings, and work-month navigation | Playwright | Complete | Covered | Current-month status/warnings and cross-month navigation validated; remaining state variants pending ( |
Standalone personal monthly totals and detailed absence/late/early-leave anomalies | API + Playwright | Not implemented; calendar warnings and manager summaries expose only part of this information | — | — |
Submit a personal monthly closing application | Playwright | Complete with prepare/commit fingerprint | Covered | Pending ( |
Withdraw a pending personal monthly closing application | Playwright | Complete with prepare/commit fingerprint | Covered | Pending ( |
Discover enabled personal application and leave types | Playwright | Complete | Covered | Full-day, timed half-day, special-leave, and correction form variants validated |
List, filter, paginate, and inspect personal applications | Playwright | Complete | Covered | Pending/returned/approved/all filters and exact details validated; page 2 pending ( |
Create a leave application | Playwright | Complete, including explicit timed-leave ranges | Covered | Validated ( |
Create a work-time correction | Playwright | One replacement work segment with one optional complete break pair, or an exact | Covered | Replacement form variants validated read-only; deletion covered synthetically; real commit pending ( |
Create an overtime application | Playwright | Not implemented; disabled or unverified forms stop safely | Safe-refusal path covered | Current validation account does not enable the form |
Withdraw a pending personal application | Playwright | Complete with prepare/commit fingerprint | Covered | Validated ( |
Cancel an approved personal application | Playwright | Complete; creates and verifies a separate cancellation application | Covered | Validated through final approval ( |
Department monthly attendance and issue summary | Playwright | Complete for the currently visible management scope | Covered | Current-month summary and date-mismatch guard validated |
Department daily punch status through Public API | API | Implemented but role-gated | Covered | Expected |
Date-specific employee punch detail | Playwright | Not implemented | — | — |
Recursive child-department aggregation | Playwright | Not implemented | — | — |
List, filter, paginate, and inspect manager applications | Playwright | Complete | Covered | Filters, pagination, exact detail, and processed history validated |
Approve general employee applications | Playwright | Complete for exact actions and scoped condition-based runs; each item uses prepare/commit fingerprint | Covered | Single-item flow validated, including post-write detail verification |
Return general employee applications | Playwright | Complete for exact actions and scoped condition-based runs; each item uses prepare/commit fingerprint | Covered | Single-item flow validated ( |
List and fully review monthly closing applications | Playwright | Complete; includes member summary, daily rows, alerts, checks, and verified period navigation | Covered | Approved historical review validated; naturally pending cross-month and prepare-fingerprint validation remains ( |
Approve or return monthly closing applications | Playwright | Complete for exact actions and scoped condition-based runs; each item uses a dedicated full-review fingerprint | Covered | Single-item write pending ( |
Delete returned or draft personal applications | Playwright | Not implemented | — | — |
Scoped business automation | API + Playwright | Complete for every supported commit category through verified sequential single-item operations | Covered by MCP, Skill, and Codex-config assertions | Underlying single-item flows are tested independently |
Persistent scoped-policy state and audit logging | API + Playwright | Not implemented; the Agent or configured invocation retains authorization for its stated run | — | — |
Development quick start
npm ci
npm test
npm run validate
npm run package:smokeEnd users do not use this checkout at runtime. For local plugin development, load the repository explicitly for one Claude Code session:
claude --plugin-dir /absolute/path/to/freee-mcpThe repository keeps .codex/config.toml for Codex development. The Claude plugin manifest is .claude-plugin/plugin.json; its marketplace is .claude-plugin/marketplace.json. The plugin resolves its own cached path and persistent data directory, so neither Claude Code nor MCP depends on the user's current working directory.
The Codex configuration keeps default_tools_approval_mode = "writes" for future or unreviewed writes and sets all seven reviewed business commit tools to tool-level approve: punch, personal monthly submit/withdraw, personal application create/cancel/withdraw, general manager approval/return, and dedicated monthly approval/return. This prevents the host from interrupting an already authorized scoped run for every single-item commit. The server still requires confirm: true, a matching preview fingerprint, the current freee state, all leave dependencies, and every monthly payment/work-period mapping on each commit.
Maintainer release workflow
Every pull request and push to main runs tests, validates the Claude plugin and canonical Agent Skill, scans Git history for secrets, and starts the packed CLI and MCP from an isolated npm cache. GitHub Action dependencies are pinned to full commit SHAs.
Releases are explicit and run only from the repository's main branch:
Update
package.json,package-lock.json,.claude-plugin/plugin.json, and the portable#v...commands in all three READMEs to the same SemVer version.Merge that version change after CI passes.
In GitHub Actions, run the
Releaseworkflow frommainand enter the version without thevprefix.
The workflow repeats all validation, creates or verifies an annotated vVERSION tag at the current main commit, generates English release notes from merged work, and attaches the portable package with its SHA-256 checksum. It never publishes to npm and receives no freee credentials.
MCP tools
MCP tool | Type | Purpose |
| Read-only | Show the MCP version and exclusively selected backend |
| Read-only | Verify authentication without returning credentials |
| Read-only | Read the current user and company identities on the API backend |
| Read-only | Show currently available punch actions |
| Read-only preview | Generate a punch preview and fingerprint |
| Write | Revalidate the fingerprint and create one real punch |
| Read-only | Read a department or current web-management monthly summary |
| Read-only | Read a requested or currently selected personal 月次勤怠締め month |
| Read-only preview | Generate a monthly submit or withdrawal preview and fingerprint |
| Write | Revalidate the fingerprint and submit or withdraw one monthly application |
| Read-only | Show enabled personal application types and date-specific leave types |
| Read-only | List the current employee's pending, returned, approved, or all applications |
| Read-only | Read one current-employee application and its available actions |
| Read-only preview | Fill and validate a leave or work-time correction form, including exact |
| Write | Revalidate and submit one personal application; deletion creates a correction request rather than directly deleting a raw record |
| Read-only preview | Validate cancellation of one approved personal application and generate a fingerprint |
| Write | Revalidate and create one cancellation application for an approved personal application |
| Read-only preview | Generate a withdrawal preview and fingerprint for one pending application |
| Write | Revalidate and withdraw one pending personal application |
| Read-only | List pending, approved, returned, or all applications |
| Read-only | List 月次勤怠締め applications with explicit payment and mapped work periods |
| Read-only | Verify payment/work periods and review the applicant's summary, daily attendance, alerts, and checks |
| Read-only preview | Bind both periods and the complete monthly review/action into a fingerprint |
| Write | Rederive both periods, revalidate the complete review, and approve or return one application |
| Read-only | Read one application's full details, including structured before/after values for supported work-time corrections |
| Read-only preview | Generate an approval or return preview and fingerprint |
| Write | Revalidate the fingerprint and approve or return one application |
The MCP server can also be started manually:
npm run mcpIt is a STDIO protocol process. Under normal use, the client starts it automatically; no separate terminal window needs to remain open.
Source-development CLI commands
Installed users should use MCP from any directory when their agent supports it. When local interactive setup is required, the MCP or installed Skill provides an absolute package-resolved command. The npm run freee -- commands below are for maintainers working in a source checkout.
# Read-only
npm run freee -- backend status
npm run freee -- auth status
npm run freee -- me
npm run freee -- clock status
npm run freee -- team status
npm run freee -- monthly status --period YYYY-MM
npm run freee -- requests options --date YYYY-MM-DD
npm run freee -- requests list --status pending|returned|approved|all --page 1
npm run freee -- requests detail --id APPLICATION_NO
npm run freee -- approvals list
npm run freee -- approvals list --status all
npm run freee -- approvals list --status approved --page 2
npm run freee -- approvals detail --id APPLICATION_NO
npm run freee -- monthly-approvals list --status pending|returned|approved|all --page 1
npm run freee -- monthly-approvals review --id APPLICATION_NO
npm run freee -- browser status
npm run freee -- browser credentials-status
# Configure Playwright credentials securely in System Keychain
npm run freee -- browser configure --confirm
# Punches: --confirm asserts an exact instruction or active scoped policy
npm run freee -- clock in --confirm
npm run freee -- clock break-start --confirm
npm run freee -- clock break-end --confirm
npm run freee -- clock out --confirm
# Monthly attendance: prepare first; commit when the preview matches the authorization
npm run freee -- monthly prepare-action --action submit|withdraw --period YYYY-MM
npm run freee -- monthly commit-action --action submit|withdraw \
--period YYYY-MM --fingerprint PREVIEW_SHA256 --confirm
# Current employee applications: inspect, prepare, match the authorization, then commit
npm run freee -- requests prepare-create --kind leave --date YYYY-MM-DD \
--leave-type "EXACT_FREEE_LABEL" \
[--leave-start HH:MM --leave-end HH:MM] --reason "REASON"
npm run freee -- requests commit-create --kind leave --date YYYY-MM-DD \
--leave-type "EXACT_FREEE_LABEL" \
[--leave-start HH:MM --leave-end HH:MM] --reason "REASON" \
--fingerprint PREVIEW_SHA256 --confirm
npm run freee -- requests prepare-create --kind work-time-correction \
--date YYYY-MM-DD --clock-in HH:MM --clock-out HH:MM \
[--break-start HH:MM --break-end HH:MM] [--reason "REASON"]
npm run freee -- requests prepare-create --kind work-time-correction \
--date YYYY-MM-DD --work-time-action delete [--reason "REASON"]
npm run freee -- requests commit-create --kind work-time-correction \
--date YYYY-MM-DD --work-time-action delete [--reason "REASON"] \
--fingerprint PREVIEW_SHA256 --confirm
npm run freee -- requests prepare-cancel --id APPLICATION_NO [--reason "REASON"]
npm run freee -- requests commit-cancel --id APPLICATION_NO [--reason "REASON"] \
--fingerprint PREVIEW_SHA256 --confirm
npm run freee -- requests prepare-withdraw --id APPLICATION_NO
npm run freee -- requests commit-withdraw --id APPLICATION_NO \
--fingerprint PREVIEW_SHA256 --confirm
# Employee applications: prepare each item; use an exact instruction or active policy
npm run freee -- approvals prepare-action --id APPLICATION_NO --action approve|return
npm run freee -- approvals commit-action --id APPLICATION_NO \
--action approve|return --fingerprint PREVIEW_SHA256 --confirm
# Monthly attendance approvals: review each item; use an exact instruction or active policy
npm run freee -- monthly-approvals prepare-action \
--id APPLICATION_NO --action approve|return
npm run freee -- monthly-approvals commit-action \
--id APPLICATION_NO --action approve|return \
--fingerprint PREVIEW_SHA256 --confirmCommands emit JSON and identify the selected business backend. Before a real punch, the service rechecks the available action using the same backend. Before an application action, it rereads the complete detail and requires the SHA-256 fingerprint to match the read-only preview. An unavailable action, changed detail, ambiguous page, or missing confirmation stops before an API POST or browser click. If a commit returns no complete JSON envelope, treat its result as unknown and never retry the write; use the corresponding read-only status, list, or detail command to verify the exact target.
MCP and CLI writes follow the same automation-first safety model. Every real action uses a prepare tool or command and an unchanged fingerprint, but the user authorizes the human-readable result and scope rather than the hash. A precise instruction can authorize one action or an explicit set immediately; a scoped policy can cover punches, personal monthly submit/withdraw, personal application create/cancel/withdraw, general approvals/returns, and dedicated monthly approvals/returns. Its boundary may define identity, action, dates or periods, candidate conditions, reasons, limits, dependency order, failure handling, and an expressly authorized follow-up chain. If the original request is already precise, the Agent does not ask again after prepare. It validates each fingerprint, commits, and verifies internally through sequential single-item calls. Known pre-click changes can be reread and reprepared under the same authorization when they still match. Unknown writes are never retried. Development, testing, inspection, and vague help requests authorize no real write.
The API implementation of team status is complete and tested, but the attendance_manager role used at GCU cannot read employee memberships through the Public API. The API backend returns the permission error and does not fall back to Playwright.
The Playwright backend supports System Keychain credentials, persistent login, personal punch status and actions, personal monthly attendance submit/withdraw, personal application list/detail/leave/work-time-correction/withdraw/approved-application cancellation, department monthly attendance summaries, general employee application handling, and dedicated monthly attendance review/approval/return. It enters the Employee Portal from the freee home page, reads personal punch controls, reads visible members, closing applications, attendance issues, monthly work totals, and one exact applicant's daily attendance table, and processes authorized applications through the application workflow. The browser profile stays outside the repository.
Monthly attendance applications
monthly status reads the requested work month, or the month currently selected in freee when --period is omitted. With --period YYYY-MM, the Playwright backend reads freee's current payment-month/work-month pair, preserves that offset, uses the official bounded year/month navigator, and verifies that both the expected payment month and requested work month are displayed before parsing any status. A missing or ambiguous navigator, an unexpected period label, or a failed post-navigation check stops safely. The result includes the normalized state, freee status label, matching application when present, available actions, and visible calendar warnings such as days that still require an application or correction. The Agent evaluates every warning against the exact instruction or policy; a warning that the authorization does not cover stops that item.
Monthly writes use the same two-step safety model as other writes. monthly prepare-action --action submit opens the creation form, reads the target month, application route, approval steps, form checks, and calendar warnings, but does not click the final 申請 button. Calendar warnings are bound into the fingerprint. --action withdraw reads the exact pending application and verifies that 申請を取り下げる is available. When the complete preview matches the exact instruction or active policy, the commit command rereads it, requires the unchanged fingerprint, performs one click, and verifies the resulting monthly state without another user prompt. An ambiguous or unknown result is never retried automatically.
Personal attendance applications
requests list explicitly selects the employee-side 申請 tab and synchronizes each 申請中, 差戻し, 承認済, or 全て filter with the matching freee response before parsing. requests detail searches every employee-side page for one exact application No. and reports withdraw when one visible, enabled 申請を取り下げる button is present or cancel when an approved item exposes an exact official 取消申請 link.
Call requests options before creating an application. With --date, it reads the exact leave types configured by the company for that date. Leave and work-time correction forms are supported. A replacement correction accepts one work segment and one optional complete break pair. A deletion correction uses work_time_action=delete in MCP or --work-time-action delete in CLI, forbids all clock and break fields, and selects only the exact 勤務時間を削除 control. It creates a 勤務時間修正 approval request rather than directly deleting a raw day record. The current test company does not enable 残業, so the capability result reports overtime as unavailable and this version does not guess or bypass an unverified overtime form.
Creation, approved-application cancellation, and pending withdrawal use separate prepare and commit commands. A deletion prepare binds the exact date, workTimeAction: "delete", reason, route, and selected 勤務時間を削除 option. Its commit rebuilds that preview, rechecks the exact selection immediately before clicking, and accepts only one new same-date 勤務時間修正 application whose content is exactly 勤務時間を削除. An authorized date set is processed through one complete single-date flow at a time without per-date prompts. Cancellation prepare binds the original approved application, optional cancellation reason, official ApprovalRequest::Revoke form, approval route, and recent application list. Its commit creates and verifies exactly one new cancellation application; manager approval of that new request is included only when the authorized final outcome expressly covers the follow-up. Creation and cancellation never click the final 申請 during prepare, while withdrawal never clicks 申請を取り下げる. Every commit reconstructs the same preview, checks it against the exact instruction or active policy, clicks once, and verifies the resulting state. An unknown result is never retried automatically.
Employee application handling
approvals list explicitly selects freee's manager-side 承認 tab and defaults to its pending 未承認 queue; it never reads the default employee-side 申請 tab as an approval queue. Each result includes the applicant. --status returned|approved|all reads other manager-side states, while --page N selects one page. Results report page, pageCount, totalCount, and the current page's applicationCount, so agents can continue without emitting an unbounded employee history. The browser waits for the exact freee response and matching rendered row count before parsing, preventing one filter's stale rows from being returned for another. approvals detail --id searches the complete paginated manager workflow and returns the application fields, approval route, department, comments, and freee automatic-check results. For supported 勤務時間修正 applications, workTimeChange provides structured before and after values for clock-in, clock-out, break start, and break end; null means freee displayed 未入力. The same comparison is included in approval previews and their safety fingerprints. Both commands are read-only.
Each general application is still written through two single-item steps:
approvals prepare-actionreads the current full detail, verifies that the requested button is available, and returns a preview and content fingerprint without clicking a business control.The Agent compares the applicant, type, target date, content, reason, automatic checks, action, and fingerprint with the exact instruction or active policy, then may call
approvals commit-action ... --confirmwith the unchanged values. The user does not need to inspect the hash or send a second confirmation after prepare.
A conditional policy may cover one pass, repeated scans, a date/employee/type range, a limit, or a configured recurring invocation. If the user's instruction already supplies the needed conditions, approve/return mapping, scope, termination, dependency-safe order, and failure handling, the Agent starts without forcing a restatement-confirmation round trip; otherwise it asks only for the material ambiguity. It reads every pending page on each scan, evaluates full details, and sequentially prepares and commits matching applications. A known pre-click preview change may be reread and prepared again under the same policy. Before a 休暇 approval, prepare and commit both scan every pending page for a same-applicant, same-date 勤務時間修正; an authorized correction is processed first, otherwise that leave is skipped. An isolated nonmatch, unavailable action, or ambiguity skips that item while independent applications continue. An unknown result is never retried and quarantines that item and its dependent leave chain; the whole run stops only for expired or unclear authorization, backend or identity changes, untrustworthy pagination, or another systemic safety failure.
Before committing, the CLI rereads the detail. A fingerprint mismatch, missing button, application processed by someone else, or new comment stops the operation and requires a new preview. After the click, the application is reread through the synchronized paginated workflow and must expose the exact expected 承認済 or 差戻し state. When a self-application leaves the manager history after return, the exact same No. and immutable target fields may instead be verified in the employee history. An application missing from both workflows, or any mismatched target, is reported as unknown and must never be retried automatically. Development tests never perform real approvals or returns.
Monthly attendance approval review
monthly-approvals list filters one synchronized manager approval page to 月次勤怠締め applications. It parses one explicit payment month from text such as 2026年09月の支払分, derives the work month from freee's displayed payment-month/work-month relationship, verifies that pair with the official navigator, and returns both paymentPeriod and work period. It never treats the payment month or 対象日 as the work month and never hardcodes a one-month subtraction. Use pageCount to inspect later source pages; sourceTotalCount is the complete count before type filtering, while applicationCount is the monthly count on the returned page.
monthly-approvals review --id verifies the exact application type and one explicit payment month consistent with 対象日. It maps that payment month through freee's displayed relationship, navigates the attendance monitor to the resulting work month, maps the applicant to one unique visible member, opens the employee's official attendance page, and verifies the same payment/work pair again before reading the daily table. A missing or ambiguous mapping returns MONTHLY_APPROVAL_PERIOD_MAPPING_UNCONFIRMED; a navigation mismatch, duplicate employee identity, missing attendance link, or changed table schema also stops safely instead of returning a partial review. A successful review returns both periods, the monthly summary, one uniquely identified daily attendance table, per-day alerts, page warnings, application detail, and consolidated automatic checks.
Use monthly-approvals prepare-action --id NO --action approve|return before every monthly manager write. Its fingerprint binds the explicit payment month, freee-verified work month, full application, monthly summary, daily rows, alerts, checks, and requested action. monthly-approvals commit-action ... --confirm is permitted when that complete preview matches an exact instruction or active scoped business policy. The Agent may approve or return monthly applications conditionally in one authorized run, internally processing them one by one without per-item user prompts. Every commit still rederives the mapping, reconstructs the review, reopens the exact application, and stops before clicking if either month or any bound data changed. After one click, it applies the same post-write verification as the general approval workflow. This specialized single-item write path remains pending real freee validation (LV-W10).
Backend selection
The backend is selected once using this priority and is never mixed during an operation:
FREEE_BACKEND=api: use only the Public API.FREEE_BACKEND=playwright: use only Playwright, even if an API configuration still exists locally.Unset or
FREEE_BACKEND=auto: select API when an API configuration exists; otherwise select Playwright.
A source-development checkout can select:
FREEE_BACKEND=playwright
FREEE_BROWSER_HEADLESS=trueOnly non-sensitive switches belong in .env. Never store a username, password, Token, or Client Secret there.
API credentials
The CLI supports two credential modes:
system: the normal and recommended mode. Client Secret and OAuth Tokens use macOS Keychain, Windows Credential Manager, or the Linux system keyring.environment: intended for CI, servers, or a temporary Access Token. It cannot rotate a Refresh Token automatically.
Configuration contains only the Client ID, callback address, and backend metadata; it never contains a Client Secret or Token. A source checkout uses .freee/oauth.json, while the Claude plugin keeps the same data in its persistent plugin data directory.
For an installed Claude plugin, ask Claude to configure the API backend. The installed Skill supplies a plugin-resolved CLI command and stores this non-secret configuration in persistent plugin data. The source-checkout commands below are for development.
System Keyring (recommended)
npm run freee -- auth configure --store system --client-id YOUR_CLIENT_ID --confirmThe command reads the Client Secret through a hidden interactive prompt. It stores the Client Secret and OAuth Token set in the operating-system credential store. The Access Token and one-time Refresh Token are updated together.
Environment mode (CI or temporary use)
Inject FREEE_ACCESS_TOKEN through a CI Secret, container Secret, or parent process, then run:
npm run freee -- auth configure --store environment --confirmEnvironment mode cannot safely persist the new Refresh Token returned by freee, so it does not support OAuth login or automatic refresh. Never put a real Token in the repository .env file.
OAuth renewal
Configure this exact callback URL in the freee development application:
http://127.0.0.1:48181/callbackThen, while the user is present and explicitly agrees to authorization, run:
npm run freee -- auth configure --store system --client-id YOUR_CLIENT_ID --confirm
npm run freee -- auth login --confirm
npm run freee -- auth statusauth login opens the official freee authorization page, validates a random local callback state, and writes the Tokens to System Keyring.
After authorization, the CLI refreshes an Access Token before it expires. A 401 response also triggers at most one refresh and one retry. Every freee Refresh Token is single-use, so each refresh stores the new Access Token and Refresh Token together. A cross-process lock prevents Codex and Claude Code from consuming the same Refresh Token concurrently.
The source-checkout .freee/oauth.json contains no Token or Secret and is ignored by Git. The plugin equivalent lives in persistent plugin data and survives normal plugin updates.
Playwright credentials
With the installed plugin, ask Claude to check freee authentication, then run the exact setupCommand it returns directly in a local interactive terminal. For source development, the equivalent command is:
npm run freee -- browser configure --confirmThe command reads the username, password, and password confirmation through hidden prompts, writes them to System Keychain, and verifies the readback. Its output contains no credential values. Username and password options are not accepted, and credentials are never read from .env, MCP arguments, or chat.
Complete the first login using the exact nextStep returned by the configuration command. In a source checkout, the equivalent command is:
FREEE_BROWSER_HEADLESS=false npm run freee -- browser statusPlaywright fills credentials only after validating accounts.secure.freee.co.jp, and main-frame navigation is limited to p.secure.freee.co.jp and ep.secure.freee.co.jp. The user completes MFA, CAPTCHA, or abnormal-login verification in the visible browser. A successful session is cached in the private persistent profile, while System Keychain credentials remain the recovery source when the session expires. Headless mode can then be restored.
In headless mode, the runtime derives the User-Agent from the selected local Chrome channel and removes only the HeadlessChrome product token before starting the persistent session. Playwright keeps the matching request header and User-Agent Client Hints. This is limited User-Agent normalization: navigator.webdriver remains enabled, no stealth or fingerprint-evasion package is used, and the project does not claim that a site cannot recognize browser automation.
When MCP first discovers that web credentials are missing, freee_auth_status or another tool returns the local setup command. The agent may only show that command to the user; it must never request or collect the username or password in chat.
The persistent browser profile defaults to ~/.freee-agent/playwright-profile and is restricted to the current user. The CLI rejects a profile configured inside the repository.
For an explicitly supervised source-development diagnostic only, set FREEE_BROWSER_DIAGNOSTIC_DIR to a private temporary directory outside the repository. Personal-application preparation and submission capture numbered full-page screenshots around the controlled form and submit steps, while monthly status reads capture the selected attendance calendar state. The directory and image files are restricted to the current user, are never enabled by default, and must never be committed or attached to a public issue without reviewing and redacting personal data.
Agent Skill
The canonical Skill lives at skills/freee:
Codex:
.agents/skills/freeelinks to the canonical Skill.Claude Code: the user-level
freee@freee-toolsplugin loads the canonical Skill automatically in every project;.claude/skills/freeeremains only for source development.
Both clients therefore share the same MCP mappings, CLI setup guidance, and safety rules. Business operations prefer MCP; authentication setup and MCP troubleshooting continue to use the CLI.
Documentation
License
This project is available under the MIT License.
Available Tools
27 toolsfreee_approval_commit_actionCommit a freee application actionADestructive
Change one real application after matching its preview and authorization for the exact action or an active scoped business policy. A policy may map user-defined conditions to approve or return, cover later-discovered matches within its stated scope, and use this single-item tool sequentially without per-item confirmation; the Agent evaluates full detail and matches the fingerprint on the user's behalf. Skip isolated nonmatches or ambiguous items and continue independent work. A known pre-click preview error may be prepared again under the same policy, but an unknown write must never be retried. A 休暇 approval repeats the complete pending 勤務時間修正 dependency check, then reopens the exact target and revalidates its detail, action, and fingerprint before any click.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. | |
| action | Yes | approve maps to 承認; return maps to 申請者へ差し戻す. | |
| confirm | Yes | Must be true only when this exact write matches a precise user instruction or a still-active scoped business policy. The Agent validates the preview and fingerprint on the user's behalf; no separate per-item confirmation is required. | |
| fingerprint | Yes | The unchanged SHA-256 fingerprint returned by the matching prepare tool. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructive/write behavior; the description adds valuable extra context: unknown writes must never be retried, known preview errors may be reprepared under the same policy, and 休暇 approvals revalidate the dependency check and fingerprint before clicking. No statement contradicts the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and every sentence carries operational meaning, but the policy/retry/dependency clauses make it dense and longer than necessary. It earns its place for a destructive tool, yet could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a high-stakes commit action with no output schema, the description covers the matching requirement, sequential usage, skip behavior, retry constraints, and a special dependency revalidation case. It misses only minor details like explicit auth/rate limits, which are less critical here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema carries parameter documentation. The description references 'fingerprint' and 'preview' but adds little beyond what the schema already states about confirm and fingerprint semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb ('Change') and resource ('one real application'), and qualifies that it happens after preview/authorization matching for the exact action or an active scoped policy. It does not explicitly say 'approves or returns' in its main clause, but the policy language and action parameter make the commit behavior clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the sequential single-item usage model, says to skip nonmatches or ambiguous items, and gives explicit retry vs. never-retry rules for preview errors and unknown writes. It does not name sibling tools directly, but the prepare/commit pairing and exclusions are strong enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_approval_detailfreee application detailARead-onlyIdempotent
Read one application, including applicant, dates, content, reason, comments, approval route, and automatic checks. A supported 勤務時間修正 also returns structured workTimeChange.before and workTimeChange.after values; null time fields mean freee displayed 未入力.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds valuable behavioral context beyond these: it specifies the exact data returned (applicant, dates, content, etc.), and for 勤務時間修正 it discloses the structured workTimeChange.before/after fields, including the semantics of null time fields (freee displayed 未入力). This enriches the agent's understanding of tool output and edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: two sentences. The first sentence front-loads the core purpose and output summary. The second sentence adds a specific sub-type behavior in a tight, information-dense manner without fluff. Every word contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read tool with a single parameter and no output schema, the description adequately covers the return content (applicant, dates, content, reason, comments, approval route, automatic checks) and special case (勤務時間修正). It also explains the null semantics, which is essential for interpreting results. There is no missing critical behavior for the intended use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: the only parameter 'id' has a description ('The numeric No. shown in the freee application list'). The tool description does not add any parameter details beyond the schema. Since the schema already fully documents the parameter, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Read one application' with a specific verb and resource, and enumerates the returned components (applicant, dates, content, reason, comments, approval route, automatic checks). This differentiates it from sibling list/detail tools like freee_approvals_list and freee_personal_application_detail. The mention of a supported 勤務時間修正 subtype further specifies scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: when you need to read a single application by id. It states 'Read one application', which gives clear context. However, it does not explicitly mention when not to use it or point to alternatives (e.g., 'for listing, use freee_approvals_list'). Despite lacking explicit exclusions, the context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_approval_prepare_actionPreview a freee application actionARead-onlyIdempotent
Read and preview one available approval or return action, including any structured 勤務時間修正 before/after comparison, and return a binding fingerprint. For an exact instruction or active scoped business policy, the Agent evaluates the complete detail and matches the fingerprint without per-item user confirmation. Before approving a 休暇 application, every pending approval-list page is checked for same-applicant, same-date 勤務時間修正 applications; a blocker or an unreliable applicant/date stops this item without a fingerprint. No application is changed.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. | |
| action | Yes | approve maps to 承認; return maps to 申請者へ差し戻す. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description reinforces this with 'No application is changed.' It adds meaningful behavioral context: the tool returns a binding fingerprint, may bypass per-item confirmation under exact instructions or policies, and performs safety checks that can block the item. The fingerprint is mentioned but its format and lifecycle are not explained, which keeps this from being a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loads the core purpose in the first sentence. The subsequent sentences add necessary behavioral constraints, but the final sentence is somewhat dense with domain terms and conditional logic. Overall every sentence earns its place, though the structure could be slightly clearer for an agent scanning quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description reasonably explains that a binding fingerprint is returned and that no changes are applied. It also covers the important cross-application consistency check for 休暇 and 勤務時間修正. It does not fully explain what the fingerprint is or how the agent should use it afterward, but given the absence of an output schema, the description provides adequate context for invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already fully documents id and action, including the enum values for approve and return. The description does not add substantial parameter-level detail beyond confirming the action types are 'approval or return action.' This matches the baseline of 3 when structured schema carries the parameter documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Read and preview one available approval or return action.' It also distinguishes this from the commit sibling by explicitly saying 'No application is changed' and framing the tool as a preview that returns a fingerprint. This clearly separates it from freee_approval_commit_action and other prepare/commit siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys when this prepare step is appropriate: before committing an action, especially when an exact instruction or active scoped policy lets the agent skip per-item confirmation. It also includes a specific pre-approval check for 休暇 applications against same-date 勤務時間修正 entries. It does not explicitly name 'use freee_approval_commit_action next,' but the preview-vs-commit distinction is clear from the wording and sibling context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_approvals_listfreee application listARead-onlyIdempotent
Read applications visible in the current account's approval workflow. Defaults to pending applications.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | One freee approval-list page. Use pageCount from the result to continue. | |
| status | No | pending |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds context about scope (current account) and default status (pending), but does not disclose additional behaviors such as pagination mechanics or rate limits. This is consistent with the annotations, so no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the main verb, and contains no filler. Every phrase adds value: the action, the scope, and the default behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with rich annotations and a clear schema, the description is adequate. It tells what the tool does and its default, while the schema covers pagination and status filtering. It does not explicitly mention pagination or filterable statuses, but these are inferable from the schema, and the absence of an output schema is mitigated by the tool's straightforward list nature.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: the 'page' parameter is well-described, while 'status' lacks a description. The tool description mentions the default status (pending), which provides minimal parameter context, but it does not explain the meaning of each status value or add details about the page parameter beyond what the schema already states. The description offers limited compensation for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and identifies the resource as 'applications visible in the current account's approval workflow.' This distinguishes it from sibling tools like 'freee_approval_detail' (single item) and 'freee_personal_applications_list' (personal applications), though it does not explicitly name alternatives. It clearly states the tool's purpose without being tautological.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing approval workflow applications and notes the default pending status, but it provides no explicit guidance on when to use this tool versus related list tools (e.g., freee_monthly_approvals_list) or when not to use it. There are no exclusions or alternative tool references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_auth_statusfreee authentication statusARead-onlyIdempotent
Verify freee authentication without returning any credential or secret. Missing Playwright credentials return safe local setup guidance.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive; the description adds that no credentials/secrets are returned and explains the behavior when Playwright credentials are missing, which is valuable context beyond the annotations. This helps the agent understand failure modes and safety guarantees.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two clear sentences, front-loaded with the main purpose, no fluff. Each sentence adds distinct information: the first states what it does and a safety guarantee, the second describes the behavior in a missing-credential scenario. Perfectly sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple status check with rich annotations and no output schema, this description covers the essential behaviors: what it does, safety guarantees, and failure mode. It could mention the success return format but that's not critical given no output schema and the clear purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters, the description has nothing to compensate for; it appropriately doesn't mention parameters. Baseline for zero-param tools is 4, and the description lives up to that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Verify' and names the resource 'freee authentication', clearly distinguishing it from sibling status tools like freee_clock_status and freee_backend_status. It also adds the important caveat about not returning credentials, which further sharpens the purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it should be used to check authentication state but provides no explicit guidance on when to choose it over sibling tools or when not to use it. The conditional about missing credentials gives some context but no alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_backend_statusfreee backend statusARead-onlyIdempotent
Read the exclusive freee backend selected for this MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds useful context that the backend is exclusive and selected for the MCP server process, but does not elaborate on return format or any additional behavioral traits. This does not contradict annotations, so a mid-range score is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that is front-loaded and contains zero wasted words. It efficiently communicates the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters), strong annotations covering safety, and the clear one-line purpose, the description is adequate. The absence of an output schema is less critical here because the tool is a read-only status check, and the description provides enough context for basic invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description does not need to explain parameters since there are none, and the schema coverage is 100% (empty schema).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the resource 'exclusive freee backend selected for this MCP server process'. It distinguishes this from sibling status tools (auth, clock, team) by focusing on the backend itself, which is a unique scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as freee_auth_status, freee_clock_status, or freee_team_status. No context is given for selecting this tool or excluding others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_clock_commit_actionCommit a freee clock actionA
Create one real punch after its matching preview when the exact action or an active scoped business policy is user-authorized. The Agent may validate the fingerprint and continue without a second prompt; never call without authorization or retry an unknown write.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| confirm | Yes | Must be true only when this exact write matches a precise user instruction or a still-active scoped business policy. The Agent validates the preview and fingerprint on the user's behalf; no separate per-item confirmation is required. | |
| company_id | No | Optional freee company ID. Unsupported by the Playwright backend. | |
| fingerprint | Yes | The unchanged SHA-256 fingerprint returned by the matching prepare tool. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate a non-read-only, non-idempotent, open-world write; the description enriches this by disclosing the real-world side effect ('real punch'), the mandatory authorization requirement, and the no-retry policy for unknown writes. It also explains that the agent may validate the fingerprint and proceed without a second prompt, which is important behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry a large amount of decision-relevant information: the core operation, the sequencing relative to preview, the user-authorization condition, and the safety rule. It is front-loaded and free of filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a non-idempotent write with no output schema, the description covers the invocation-critical requirements: when to call, authorization, fingerprint validation, and no-retry behavior. It does not describe the return payload or mismatch handling, but the included guidance lets the agent invoke correctly and avoid unsafe calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high (75%) and the individual parameter descriptions in the schema are already detailed, especially for fingerprint and confirm. The description adds no new parameter-level meaning beyond restating the authorization and preview concepts; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific operation: 'Create one real punch after its matching preview', using a precise verb and resource. It clearly differentiates this tool from the prepare/status siblings by emphasizing the real punch versus the preview and the commit-after-preview sequence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit call conditions: after the matching preview and only when the action or an active scoped business policy is user-authorized. It also gives explicit prohibitions ('never call without authorization or retry an unknown write'), although it does not name the prepare tool as an alternative by name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_clock_prepare_actionPreview a freee clock actionARead-onlyIdempotent
Read and preview one currently available punch action, returning a binding fingerprint. No punch is created.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| company_id | No | Optional freee company ID. Unsupported by the Playwright backend. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral context beyond these: it returns a 'binding fingerprint' and explicitly states that no punch is created. This helps the agent understand the tool's role and side effects without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that covers the core behavior, return value, and side-effect absence without any redundant wording. Every word earns its place; it is concise yet informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a preview tool with strong annotations and a simple parameter set, the description adequately covers the purpose (read and preview), output (binding fingerprint), and the fact that it is non-mutating. It does not explain the fingerprint's downstream use or the Playwright backend limitation for company_id, but these are partly covered by annotations and the schema. Given no output schema, the description gives enough context to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool description does not elaborate on parameters; it simply says 'a punch action' without explaining the action enum or the company_id field. Schema description coverage is 50% — the required 'action' parameter has no description in the schema, and while its enum is self-documenting, its exact semantics are not explained. The company_id parameter's 'unsupported by Playwright backend' note appears only in the schema, not in the description, so the description provides no added meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the tool's function with a specific verb and resource: 'Read and preview one currently available punch action, returning a binding fingerprint.' This distinguishes it from sibling tools like freee_clock_commit_action (which would actually create the punch) and freee_clock_status (which likely reports current state). The title 'Preview a freee clock action' reinforces the purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a safe, no-op preview by stating 'No punch is created,' which hints that this tool is for dry-run validation before committing. However, it does not explicitly mention alternatives or contrast with freee_clock_commit_action or freee_clock_status. Usage guidance is present but implicit, not directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_clock_statusfreee clock statusARead-onlyIdempotent
Read the current available freee punch actions. This tool never creates a punch.
| Name | Required | Description | Default |
|---|---|---|---|
| date | No | Optional date in YYYY-MM-DD format. | |
| company_id | No | Optional freee company ID. Unsupported by the Playwright backend. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, and non-destructive behavior. The description adds domain-specific context by stating 'never creates a punch' and 'current available,' reinforcing the read-only nature and indicating the tool reflects a stateful snapshot. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary action, and contains no filler. Every word contributes to the tool's purpose and safety profile.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with high schema coverage and strong annotations, the description adequately conveys the purpose. It does not elaborate on the effect of the date parameter or the format of the returned punch actions, but this is not critical given the schema covers parameter basics and the tool's purpose is straightforward.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters documented in the input schema. The tool description adds no additional parameter semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and clearly identifies the resource ('current available freee punch actions'). It also explicitly states 'This tool never creates a punch,' which distinguishes it from write-oriented sibling tools like freee_clock_prepare_action and freee_clock_commit_action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for checking available actions before performing a punch, but it does not explicitly state when to use this tool versus the prepare/commit siblings. 'This tool never creates a punch' provides a negative guideline, but no direct alternative or precondition is mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_mefreee identityARead-onlyIdempotent
Read the authenticated freee user and company identities. Available on the API backend.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior, so the safety profile is clear. The description adds the 'authenticated' requirement and 'API backend' availability, which are not in the annotations. However, it does not disclose return format, pagination, or error behavior. Given the strong annotation coverage, the added context is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no redundant language. It front-loads the action ('Read') and immediately specifies the resource. Every word serves a purpose, and it conveys the essential information efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (no parameters, no output schema) and the strong annotations, the description is nearly complete. It states the input (none), the operation (read), and the resource (identities). It could optionally detail what 'identities' includes, but the tool name and sibling context make it sufficiently clear for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema fully covers the input space. With no parameters, the description correctly omits parameter details, and no additional semantics are needed. The baseline for 0 parameters is 4, and the description does not introduce any confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb 'Read' and a specific resource: 'the authenticated freee user and company identities'. This distinguishes it from sibling tools like freee_clock_status or freee_approval_list, which focus on different domains. The phrase 'Available on the API backend' adds deployment context without obscuring the primary purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context through 'authenticated' and 'API backend', suggesting it is for retrieving current user/company info on the backend. However, it does not explicitly mention when not to use this tool or name alternatives like freee_auth_status, which might also relate to identity. The guidance is implied but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_monthly_approval_commit_actionCommit a freee monthly attendance approval actionADestructive
Approve or return one real 月次勤怠締め application after authorization for the exact action or an active scoped business policy. The Agent may use this single-item tool sequentially without per-item confirmation, but every call recomputes the payment-month/work-month mapping and matches the complete monthly review and fingerprint. Ambiguous or changed mapping stops before any click; never retry an unknown write.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. | |
| action | Yes | approve maps to 承認; return maps to 申請者へ差し戻す. | |
| confirm | Yes | Must be true only when this exact write matches a precise user instruction or a still-active scoped business policy. The Agent validates the preview and fingerprint on the user's behalf; no separate per-item confirmation is required. | |
| fingerprint | Yes | The unchanged SHA-256 fingerprint returned by the matching prepare tool. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as destructive and non-read-only, but the description adds valuable behavioral detail: every call recomputes the payment-month/work-month mapping, matches the complete monthly review and fingerprint, and stops before any click if mapping is ambiguous or changed. The explicit 'never retry an unknown write' guidance is especially useful for a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and uses three focused sentences. Each sentence adds important operational or safety context, though the phrase 'real 月次勤怠締め' and some policy phrasing could be tightened without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive single-item commit tool, the description supplies the critical context: authorization requirements, sequential use allowance, fingerprint matching, mapping recomputation, and no-retry behavior. It is complete enough for safe invocation, though it does not explicitly reference the prepare tool by name or describe the success response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters. The description reinforces the confirmation and fingerprint concepts but does not add substantial meaning beyond the schema. This meets the baseline for full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Approve or return one real 月次勤怠締め application.' The name and title also clearly indicate this is the commit step for a monthly approval action, distinguishing it from prepare/review siblings. It is not tautological and gives the agent a precise sense of what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states when to use the tool: only after authorization for the exact action or an active scoped business policy. It also gives explicit negative guidance: ambiguous or changed mapping stops before any click and unknown writes must never be retried. However, it does not explicitly name the alternative prepare tool or say 'use the prepare action first,' though the schema's fingerprint reference implies this.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_monthly_approval_prepare_actionPreview a freee monthly attendance approval actionARead-onlyIdempotent
Review one exact 月次勤怠締め application and bind its explicit payment month, freee-verified work month, detail, monthly summary, daily attendance, alerts, automatic checks, and requested approval/return action into a fingerprint. For an exact instruction or active scoped business policy, the Agent evaluates the complete review and matches the fingerprint without per-item user confirmation. Ambiguous mapping produces no fingerprint; no application is changed.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. | |
| action | Yes | approve maps to 承認; return maps to 申請者へ差し戻す. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds relevant behavioral context: no application is changed, ambiguous mappings produce no fingerprint, and confirmation is bypassed only for exact instructions/policies. This is consistent with the annotations and adds value beyond them, though it does not discuss auth or rate-limit considerations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences front-load the core operation and each sentence contributes information: what is reviewed, when matching applies, and what happens when mapping is ambiguous. The first sentence's long enumeration is heavy, but it communicates the content of the fingerprint without being redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description leaves the return contract implicit: it says the tool 'bind[s] ... into a fingerprint' and that ambiguity 'produces no fingerprint', but it never explicitly states that the tool returns this fingerprint or that it should be passed to freee_monthly_approval_commit_action. The overall prepare/commit pattern is inferable from sibling names, but not spelled out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well documented. The description adds only indirect context ('one exact application' for id, 'requested approval/return action' for action), which does not materially expand on the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific verb ('Review') and resource ('one exact 月次勤怠締め application') and states the output concept ('bind ... into a fingerprint'). It establishes a preview-like, non-mutating behavior, but it does not explicitly name sibling tools such as freee_monthly_approval_commit_action or freee_monthly_approval_review to clarify the boundary, relying on the fingerprint jargon for differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear condition for use: 'For an exact instruction or active scoped business policy', and describes the behavior in ambiguous cases ('Ambiguous mapping produces no fingerprint'). It does not explicitly state when to prefer this over commit_action or review, so alternatives are not called out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_monthly_approval_reviewReview a freee monthly attendance applicationARead-onlyIdempotent
Read one exact 月次勤怠締め application. Its explicit payment month is mapped through freee's displayed payment-month/work-month relationship, then that work month's summary, daily attendance, alerts, and automatic checks are verified. Ambiguous mapping stops without a review.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already supply the read-only, idempotent, non-destructive profile. The description adds genuine behavioral context: the payment-month-to-work-month mapping and the early stop when mapping is ambiguous. That is useful beyond annotations, though it leaves unclear whether stopping means an error or an empty result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two focused sentences with no filler. The opening sentence immediately establishes the operation and resource, and the second sentence compactly explains the mapping caveat that governs behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only review tool, the description covers the essential workflow: what is read, what is verified, and when it stops. It doesn't describe the output shape, but with no output schema and a simple review-oriented tool, this is a minor gap rather than a blocking one.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single id parameter has 100% schema coverage with a clear description ('numeric No. shown in the freee application list'). The tool description adds no parameter detail, but the schema already carries the semantics, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete verb and resource: it reads one exact monthly attendance closure application and enumerates what gets verified (summary, daily attendance, alerts, automatic checks). This clearly distinguishes it from list/status/action siblings even without naming alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use guidance. It never tells the agent to invoke this before an approval action, nor does it contrast with freee_approval_detail or the monthly prepare/commit tools. The mapping-stop clause is a behavioral condition, not a usage rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_monthly_approvals_listfreee monthly attendance approval listARead-onlyIdempotent
Read only 月次勤怠締め applications from one explicit approval-list page. Each result exposes its explicit paymentPeriod and mapped work period, using freee's displayed payment-month/work-month relationship; ambiguous mapping fails closed.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | One freee approval-list page. Use pageCount from the result to continue. | |
| status | No | pending |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false, so the description doesn't need to repeat safety. It adds meaningful behavior: results expose explicit paymentPeriod and mapped work period, and ambiguous mapping fails closed. This goes beyond annotations and clarifies error-prone edge cases, earning a strong score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The core purpose is front-loaded in the first sentence, and the second sentence adds precisely one valuable nuance about mapping behavior. Every word earns its place; structure is optimal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with 2 params and no output schema, the description covers core intent, a behavioral edge case (fail closed), and output expectations (paymentPeriod, work period). Pagination is handled in the schema's page description. It doesn't cover error messages or status interaction, but given annotations and simplicity, it's sufficiently complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: the page parameter is well described in the schema, while status is only defined by enum values with no extra text. The tool description adds minimal parameter context—only 'one explicit approval-list page' restates the page intent. It does not explain how status filters results or how the mapping interacts with parameters. Baseline 3 is appropriate given the partial schema coverage and small extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb-resource pair: 'Read only 月次勤怠締め applications' (list monthly attendance approvals). It scopes to 'one explicit approval-list page' and adds a distinguishing detail about exposing paymentPeriod and mapped work period, which separates it from the general freee_approvals_list sibling. This is specific and actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for monthly attendance approvals on a specific page but never explicitly names alternatives (e.g., freee_approvals_list for general approvals) or states when NOT to use this tool. The 'fail closed' clause hints at a boundary condition, but it's not framed as a usage guideline. No exclusion or alternative routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_monthly_commit_actionCommit a freee monthly attendance actionADestructive
Submit or withdraw one real monthly attendance application after its matching preview when the exact action or an active scoped business policy is user-authorized. The Agent may validate the fingerprint and continue without a second prompt; never retry an unknown write.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | submit creates a 月次勤怠締め application; withdraw uses 申請を取り下げる. | |
| period | No | Optional work month in YYYY-MM. Playwright selects and verifies that work month before reading. | |
| confirm | Yes | Must be true only when this exact write matches a precise user instruction or a still-active scoped business policy. The Agent validates the preview and fingerprint on the user's behalf; no separate per-item confirmation is required. | |
| fingerprint | Yes | The unchanged SHA-256 fingerprint returned by the matching prepare tool. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as destructive, non-read-only, and non-idempotent. The description goes further by disclosing that the agent may validate the fingerprint and continue without a second prompt, and by warning never to retry an unknown write. This is meaningful behavioral context beyond the annotations and does not contradict them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler, front-loaded with the core action and followed by essential behavioral guardrails. Every clause earns its place, including the authorization condition and the retry warning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent commit tool with no output schema, the description plus schema cover authorization, sequencing, fingerprint handling, and safety. It does not describe post-commit outcomes or error responses, but that is not required given the annotations and open-world hint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already gives rich semantics for action, period, confirm, and fingerprint. The description adds only a brief echo of fingerprint validation ('validate the fingerprint'), so it does not materially improve on the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise action ('Submit or withdraw'), a specific resource ('one real monthly attendance application'), and a clear phase ('after its matching preview'), which distinguishes it from the matching prepare tool and other commit tools. The scope is unambiguous, so an agent knows exactly what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear when-to-use context: after the matching preview, only when the exact action or an active scoped business policy is user-authorized, and with fingerprint validation. It does not explicitly name sibling alternatives or state when not to use it, but the sequencing and authorization conditions are strong enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_monthly_prepare_actionPreview a freee monthly attendance actionARead-onlyIdempotent
Read and preview one monthly submit or withdrawal action, returning a binding fingerprint. No application is changed.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | submit creates a 月次勤怠締め application; withdraw uses 申請を取り下げる. | |
| period | No | Optional work month in YYYY-MM. Playwright selects and verifies that work month before reading. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only and non-destructive behavior. The description adds the valuable context that this is a preview returning a binding fingerprint and that no application is changed, enriching the behavioral picture without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences cover purpose, outcome, and safety guarantee with no redundant wording. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter tool with rich schema annotations and no output schema, the description covers the essential elements: the action type, the read-only nature, and the fingerprint return. A minor gap is that it does not mention that this should precede a commit step, but that is inferable from the sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters have detailed descriptions (action enum with meanings, period pattern and behavior). The tool description adds little beyond what the schema already conveys, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads and previews a monthly submit or withdrawal action, with a specific outcome (returning a binding fingerprint). This distinguishes it from sibling commit tools and other monthly actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It indicates this is a preview-only step and explicitly states that no application is changed, which tells the agent when to use it (before committing) and when not to use it (to actually apply changes). However, it does not explicitly name the commit counterpart for follow-up.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_monthly_statusfreee monthly attendance statusARead-onlyIdempotent
Read the requested or currently selected personal 月次勤怠締め month and its available actions without changing freee.
| Name | Required | Description | Default |
|---|---|---|---|
| period | No | Optional work month in YYYY-MM. Playwright selects and verifies that work month before reading. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only and idempotent behavior, and the description reinforces this with 'without changing freee'. It adds extra behavioral context beyond annotations by explaining the period parameter behavior ('Playwright selects and verifies that work month before reading') and the fallback to the currently selected month, which is useful for understanding how the tool operates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the core action, the resource, and the non-destructive nature immediately. The Japanese term '月次勤怠締め' is specific and meaningful in context, and the sentence is compact without sacrificing key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema, strong annotations), the description covers the essential behavior: reading a specific month and its available actions. It does not detail the output format or enumerate what 'available actions' might be, but it provides sufficient completeness for a status-checking tool among well-defined siblings. A slightly more explicit description of the returned data would justify a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds semantic value by clarifying that the optional period parameter corresponds to a 'requested' month, while omitting it means the tool reads the 'currently selected' month. This helps the agent understand optionality and fallback behavior, going beyond the schema's straightforward pattern description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') with a clear resource ('personal 月次勤怠締め month') and scope ('and its available actions'). It also clarifies that the operation does not alter anything, which distinguishes it from sibling prepare/commit tools. This is a clear, unambiguous purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a read-only inspection use case but does not explicitly state when to use this tool versus alternatives like freee_monthly_prepare_action or freee_monthly_commit_action. It mentions 'without changing freee' but lacks explicit when-to-use or when-not-to-use guidance, so usage must be inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_commit_cancelSubmit a freee approved-application cancellationADestructive
Create one real cancellation application after its matching preview when the exact action or an active scoped business policy is user-authorized. The result is a new cancellation application that may still require approval; a follow-up approval is authorized only when the policy expressly covers that chain. Never retry an unknown write.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. | |
| reason | No | Optional application reason. Empty is allowed when freee allows it. | |
| confirm | Yes | Must be true only when this exact write matches a precise user instruction or a still-active scoped business policy. The Agent validates the preview and fingerprint on the user's behalf; no separate per-item confirmation is required. | |
| fingerprint | Yes | The unchanged SHA-256 fingerprint returned by the matching prepare tool. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry the safety profile (readOnly=false, destructive=true, idempotent=false), and the description adds genuine context beyond them: the resulting application 'may still require approval,' follow-up approval is 'authorized only when the policy expressly covers that chain,' and writes must never be blindly retried. These caveats are consistent with the annotations — no contradiction — and materially shape how an agent should treat the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences of roughly 60 words, front-loaded with the core action followed by two distinct behavioral caveats; every sentence earns its place. The prose is dense and occasionally awkward ('when the exact action or an active scoped business policy is user-authorized'), but the structural economy is good.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent write with no output schema, the description covers the essential operational context: ordering after prepare, authorization requirements, approval-chain limitations, and retry caution. It does not describe the return value, failure/error behavior, or what happens to the original approved application, which are notable gaps for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (id, reason, confirm, fingerprint) are already documented with types, constraints, and meaning, yielding the baseline of 3. The description's authorization phrasing mirrors, rather than extends, the confirm parameter's semantics and adds no per-parameter detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action — 'Create one real cancellation application' — with a clear resource and an ordering constraint, 'after its matching preview,' that distinguishes it from the prepare_cancel sibling and, via the word 'cancellation,' from commit_create/commit_withdraw. The authorization clause is grammatically dense and slightly obscures the core purpose, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied by 'after its matching preview' and reinforced by the schema's reference to 'the matching prepare tool,' signaling a prepared-commit sequence. However, no alternative tools are named and no explicit when-not-to-use conditions are given; 'Never retry an unknown write' is a retry rule, not a tool-selection rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_commit_createSubmit a freee personal applicationA
Submit one real leave or work-time correction application after its matching preview when the exact action or an active scoped business policy is user-authorized. The Agent may process an authorized date set sequentially without per-item confirmation. A work_time_action=delete submission creates and verifies an exact 勤務時間を削除 request; never retry an unknown write.
| Name | Required | Description | Default |
|---|---|---|---|
| date | Yes | Application target date in YYYY-MM-DD format. | |
| kind | Yes | Use the options tool first. Overtime is reported as unavailable until its company form is enabled and safely supported. | |
| reason | No | Optional application reason. Empty is allowed when freee allows it. | |
| confirm | Yes | Must be true only when this exact write matches a precise user instruction or a still-active scoped business policy. The Agent validates the preview and fingerprint on the user's behalf; no separate per-item confirmation is required. | |
| clock_in | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| break_end | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| clock_out | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| leave_end | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| leave_type | No | ||
| break_start | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| fingerprint | Yes | The unchanged SHA-256 fingerprint returned by the matching prepare tool. | |
| leave_start | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| work_time_action | No | Only for work-time-correction. Omit or use replace to change times; delete selects the exact 勤務時間を削除 option and forbids all clock/break fields. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond annotations: user-authorization requirements, sequential processing without per-item confirmation, the exact behavior of work_time_action=delete, and a strong 'never retry an unknown write' safety rule. It does not contradict the annotations, though it omits full side-effect or response details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three dense sentences with no filler. Each sentence contributes a distinct actionable constraint: authorization and preview requirement, sequential processing, and the delete-specific behavior plus retry prohibition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a complex 13-parameter write tool with no output schema, the description covers the essential workflow: matching preview, authorization, sequential processing, the delete variant, and a no-retry rule. Minor gaps remain: overtime is not mentioned and no response format is indicated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 92%, so the schema already documents individual parameters well and the baseline is 3. The description only incidentally reinforces the work_time_action=delete behavior and retry policy; it does not add substantial parameter-level meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: submit one real application after its matching preview, distinguishing it from preparation or cancellation workflows. However, it names only 'leave or work-time correction' while the schema also allows 'overtime', so it is not fully aligned with the accepted kinds.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear preconditions: use only after the matching preview and only when the exact action or an active scoped business policy is user-authorized. It also states that an authorized date set may be processed sequentially without per-item confirmation. It does not explicitly contrast with sibling commit tools like cancel/withdraw, but 'matching preview' identifies the correct workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_commit_withdrawWithdraw a freee personal applicationADestructive
Withdraw one real personal application after its matching preview when the exact action or an active scoped business policy is user-authorized. The Agent may validate the fingerprint and continue without a second prompt; never retry an unknown write.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. | |
| confirm | Yes | Must be true only when this exact write matches a precise user instruction or a still-active scoped business policy. The Agent validates the preview and fingerprint on the user's behalf; no separate per-item confirmation is required. | |
| fingerprint | Yes | The unchanged SHA-256 fingerprint returned by the matching prepare tool. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and idempotentHint=false, so a write with no retry is expected. The description adds valuable behavioral guidance beyond the annotations: the agent may validate the fingerprint and proceed without a second prompt, and it must never retry an unknown write, which is critical safety context for a destructive mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry the entire behavioral contract: when to act, what the agent may do, and what it must never do. The safety-critical retry warning is front-loaded in a short final clause, and there is no filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent write with no output schema, the description covers the trigger condition, authorization requirement, fingerprint validation, and retry prohibition. It is slightly light on explicit linkage to the prepare_withdraw sibling and on what a successful withdrawal returns, but the schema and wording together give enough context to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and each parameter already has a clear description, so the description does not need to re-explain them. It lightly reinforces the fingerprint's validation role and the confirm parameter's user-authorization meaning, but does not add significant semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Withdraw') and resource ('one real personal application'), and 'after its matching preview' clearly positions it as the commit counterpart to a prepare step. This differentiates it from the many personal-application sibling tools, especially prepare_withdraw and the commit_create/commit_cancel variants.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly frames when the tool is appropriate: after the matching preview and only when the exact action or an active scoped business policy is user-authorized. It does not explicitly name alternative tools or say 'use commit_cancel instead for cancellation,' but the preview-commit pairing conveys the intended usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_detailfreee personal application detailARead-onlyIdempotent
Read one application submitted by the current employee and report whether pending withdrawal or approved-application cancellation is currently available.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so safety is covered. The description adds valuable behavioral context beyond annotations by specifying the tool's special reporting of withdrawal/cancellation availability, which is not inferable from structured data alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant words. It efficiently communicates the action, scope, and unique purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with one parameter, strong annotations, and no output schema, the description provides sufficient context. It states the read purpose and the key reporting behavior, though it does not detail error cases or exact return format, which is acceptable given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description of the 'id' parameter ('The numeric No. shown in the freee application list'). The tool description does not add further parameter detail, but the schema already carries the semantic load, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifically states the action ('Read one application'), the resource ('application submitted by the current employee'), and a unique behavior (report whether withdrawal/cancellation is available). This distinguishes it clearly from sibling tools like list, prepare, or commit actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing details and availability status of a single application, but does not explicitly state exclusions or alternatives like 'use freee_personal_applications_list to list all'. The context is clear enough for an agent to infer when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_optionsfreee personal application optionsARead-onlyIdempotent
Read application types enabled for the current employee and, for an optional date, the leave types configured in freee. No application is changed.
| Name | Required | Description | Default |
|---|---|---|---|
| date | No | Optional date in YYYY-MM-DD format. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds 'No application is changed' to reinforce the safe read-only nature, and clarifies that data is scoped to the current employee with an optional date affecting leave types, providing contextual value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no redundant phrasing. The first sentence states the action and scope; the second sentence provides safety reassurance. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one optional parameter and no output schema, the description fully explains what is read, who it applies to, and that no changes occur. The potential return values are implicitly clear from the description, so no additional explanation is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage for the single optional date parameter, so baseline is 3. The description adds meaning by stating 'for an optional date, the leave types configured', which clarifies the date's specific role in determining leave types, going beyond the schema's basic 'Optional date in YYYY-MM-DD format.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it reads application types enabled for the current employee and leave types for an optional date. This is a specific verb+resource, distinguishing it from sibling list/detail tools like freee_personal_applications_list and freee_personal_application_detail by focusing on configuration/options.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context that this tool is for reading available types/options, not for creating, updating, or cancelling applications. It does not explicitly name exclusions or alternatives, but the scope ('enabled for the current employee') implies when it would be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_prepare_cancelPreview a freee approved-application cancellationARead-onlyIdempotent
Open and validate the cancellation form for one exact approved personal application without submitting it. Returns the original application, cancellation reason, route, and a binding fingerprint.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. | |
| reason | No | Optional reason for cancelling the approved application. Empty is allowed when freee allows it. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive hints. The description adds valuable context beyond these: that the form is validated, that nothing is submitted, and that it returns the original application, cancellation reason, route, and a binding fingerprint. This clarifies the operation's behavior and output without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and resource, and every word earns its place. It avoids repetition of schema details and communicates scope, validation, and return content efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two simple parameters and no output schema, the description is fully complete. It names the key return elements (original application, reason, route, fingerprint) and the non-submitting behavior. The complexity is low, and the description covers all essential aspects an agent needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not meaningfully enhance parameter understanding beyond the schema; it only loosely references the cancellation reason and the target application. No new syntax or additional meaning is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('Open and validate') and a specific resource ('cancellation form for one exact approved personal application'), clearly distinguishing it from submit/commit tools. The phrase 'without submitting it' explicitly differentiates it from commit_cancel.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies this is a preview/validation step before a cancellation commit, stating 'without submitting it'. It specifies the target is 'one exact approved personal application', giving context for when to use it. However, it does not explicitly name alternatives or exclusions, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_prepare_createPreview a freee personal applicationARead-onlyIdempotent
Fill and validate one leave or work-time correction form without submitting it, returning the route, exact values, and a binding fingerprint. For work_time_action=delete, select exactly 勤務時間を削除; this previews a correction request, not a direct raw-record deletion.
| Name | Required | Description | Default |
|---|---|---|---|
| date | Yes | Application target date in YYYY-MM-DD format. | |
| kind | Yes | Use the options tool first. Overtime is reported as unavailable until its company form is enabled and safely supported. | |
| reason | No | Optional application reason. Empty is allowed when freee allows it. | |
| clock_in | No | Required for a replacement work-time correction; forbidden for delete. | |
| break_end | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| clock_out | No | Required for a replacement work-time correction; forbidden for delete. | |
| leave_end | No | Required with leave_start when the selected leave type exposes a time range. | |
| leave_type | No | Required for leave; use one exact label returned by the options tool for this date. | |
| break_start | No | Optional local time in HH:MM. Required clock fields depend on kind. | |
| leave_start | No | Required with leave_end when the selected leave type exposes a time range. | |
| work_time_action | No | Only for work-time-correction. Omit or use replace to change times; delete selects the exact 勤務時間を削除 option and forbids all clock/break fields. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds real behavioral substance beyond the annotations: validation without submission, a binding fingerprint, and the clarification that delete previews a correction request rather than raw record deletion. This aligns with the readOnlyHint/idempotentHint/destructiveHint annotations without contradicting them. It does not cover error cases or fingerprint lifecycle, but those are not core to the tool's safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The first sentence front-loads the verb, resource, scope, and outputs; the second handles the non-obvious delete special case. Nothing in the description repeats the schema or annotations unnecessarily.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description does explain the primary return content: route, exact values, and a binding fingerprint. Conditional parameter rules and the options-tool-first guidance live in the schema, which is acceptable given 100% coverage. It stops just short of explicitly telling the agent to pass the fingerprint to commit_create, leaving that to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters, so the description does not need to repeat them. It still adds meaning for work_time_action=delete by stressing the exact Japanese label and emphasizing that this is a correction-request preview, not a direct deletion. That semantic clarification is useful, though modest on top of an already fully documented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action — fill and validate a leave or work-time correction form without submitting — and names concrete outputs: route, exact values, and a binding fingerprint. This clearly distinguishes prepare_create from commit_create and other application tools. The only slight omission is that overtime is not mentioned, but the schema explicitly handles that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly frames the tool as a preview/no-submit step and gives a conditional rule for work_time_action=delete. However, it never explicitly names alternatives such as commit_create or the options tool, nor states 'use this before committing' or 'use that to actually submit.' The usage context is implied rather than directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_application_prepare_withdrawPreview a freee personal application withdrawalARead-onlyIdempotent
Read one exact pending personal application and return a binding fingerprint without withdrawing it.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The numeric No. shown in the freee application list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
While annotations already indicate read-only, non-destructive, and idempotent behavior, the description adds valuable context: it returns a 'binding fingerprint' and specifically does not withdraw, plus it targets 'pending' applications. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, tightly worded sentence that front-loads the core action and result. No filler or redundant information, making it highly concise while retaining essential details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple single-parameter schema, strong annotations, and clear description of the return value ('binding fingerprint'), the description is largely complete. The term 'binding fingerprint' is not elaborated, but the tool's role in a prepare/commit flow is evident.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description fully covers the only parameter (id) with a clear explanation ('The numeric No. shown in the freee application list'). The tool description adds no additional parameter semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Read'), the specific resource ('one exact pending personal application'), and the outcome ('return a binding fingerprint without withdrawing it'). This distinguishes it from sibling tools like commit_withdraw, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use as a preview step before withdrawal ('without withdrawing it'), but does not explicitly mention alternatives or when not to use. It lacks direct comparison to other tools such as prepare_cancel or detail, leaving usage guidance largely inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_personal_applications_listfreee personal application listARead-onlyIdempotent
Read the current employee's pending, returned, approved, or complete personal application list.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | One employee application-list page. Use pageCount from the result to continue. | |
| status | No | pending |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds context by scoping to the current employee and listing statuses, but does not disclose additional behaviors like pagination or response format beyond what schema already covers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the action and resource, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple list operation, strong annotations (readOnly, idempotent), and a schema that documents the page parameter, the description is mostly sufficient. However, the ambiguous 'complete' versus 'all' and lack of return-value details keep it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%. The page parameter is well-documented in the schema, but the status parameter only has an enum. The description re-states statuses but uses 'complete' instead of the enum value 'all', introducing ambiguity and potentially misleading an agent. It adds no meaningful parameter semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the specific resource 'current employee's personal application list' with statuses. It distinguishes from sibling tools like freee_personal_application_detail by specifying it is a list operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: it reads the current employee's personal application list, scoped to specific statuses. However, it does not explicitly mention alternatives or when-not-to-use compared to sibling list tools like freee_approvals_list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
freee_team_statusfreee team attendanceBRead-onlyIdempotent
Read department attendance or the selected monthly attendance-monitor summary without changing freee.
| Name | Required | Description | Default |
|---|---|---|---|
| date | No | Optional date in YYYY-MM-DD format. | |
| group_id | No | Optional department ID. Unsupported by the Playwright backend. | |
| company_id | No | Optional freee company ID. Unsupported by the Playwright backend. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description reinforces read-only with 'without changing freee' and hints at a dependency on a 'selected' summary, but does not disclose nuances like unsupported parameters (group_id/company_id) or UI-state dependence beyond that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that communicates the core action and scope without any filler. Every word serves a purpose, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and a description that does not explain what the returned data looks like, the agent lacks crucial context. The tool's behavior depends on an unspecified 'selected' summary, and the unsupported backend parameters are only mentioned in the schema, not the description, leaving the overall invocation and interpretation incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with all three parameters already described, including the notable caveat that group_id and company_id are 'Unsupported by the Playwright backend.' The tool description adds no extra parameter semantics, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Read' and identifies the resource as 'department attendance' or 'monthly attendance-monitor summary', which clearly distinguishes it from sibling tools that focus on individual clock status or approvals. However, the phrase 'selected monthly attendance-monitor summary' is ambiguous about what 'selected' refers to, slightly reducing clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like freee_clock_status or freee_approvals_list. It simply states what it reads, without any explicit context, prerequisites, or exclusion criteria, leaving the agent to infer usage from the name and siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Every tool has a clearly distinct purpose. The prepare/commit pairs are well-separated by their read vs write semantics, and the status, list, detail, and review tools each target a specific resource or workflow step. No two tools appear to do the same thing.
All tools follow the freee_<domain>_<action> snake_case pattern. The prepare_action/commit_action suffix is used uniformly, and list tools consistently use plural domain names while single-item operations use singular. The naming is highly predictable.
27 tools is above the 25 threshold set in the rubric, making the set feel heavy. While the prepare/commit safety pattern and the multiple subdomains (clock, monthly, personal applications, approvals) justify many of the tools, the overall count is excessive for a single server and may overwhelm an agent.
The tool surface covers the main workflows: personal application list/create/cancel/withdraw, monthly attendance status/submit/approve, clock punches, and approval list/detail/action. Minor gaps exist, such as no direct tool for editing an existing application or listing all employees, but these are workaround-able and likely outside the server's intended scope.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server providing attendance data queries via the CloudTime API.
MCP server exposing klokin time-tracking operations (employees, time entries, stores) to AI clients.
チームの働き方を支援するグループウェア Work Handler の MCP サーバー。組織・メンバーの参照、出退勤の共有、タイムカード、承認フロー等を本人の権限の範囲で操作できる。
Hosted MCP server with managed OAuth for 15+ toolkits: Google Workspace, Fitbit, Oura, Kalshi, etc.
Related MCP Servers
- AlicenseAqualityDmaintenanceAn MCP server that automates TimeCard timesheet management using Playwright browser automation. It enables users to manage projects, activities, and daily hours entries through natural language interactions.63MIT
- AlicenseAqualityDmaintenanceattendance-engine-mcp is a Model Context Protocol server that gives AI agents deterministic, fixture-backed tools for workforce attendance and wage-and-hour compliance. Built on @attendance-engine/core — a pure-function, zero-deps, 100%-covered TypeScript engine — it lets Claude, Cursor, Windsurf, or any MCP host correctly answer the questions HR/payroll teams actually ask: did this person clock i8201MIT
- AlicenseNot gradedqualityDmaintenanceMCP server for managing Kaiten tasks through AI agents like Claude, enabling task retrieval, creation, updating, and time logging.6442MIT
- FlicenseNot gradedqualityDmaintenanceEnables managing freee HR operations like employee data, attendance, leave, and approvals through natural language in MCP-compatible clients such as Claude Desktop.1
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/newbdez33/freee-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server