worksmobile-mcp

Unofficial NAVER WORKS (LINE WORKS) Drive admin CLI + MCP server, built on the Developer API's service-account delegation (JWT delegated_user).

Existing WORKS MCP servers focus on the end-user plane (your own mail/calendar/files via User OAuth). This project covers the admin plane that they don't:

• act as any member of your tenant via delegation (like Google domain-wide delegation)

• shared-drive governance: list drives, inspect accessibleRange/permissionType, grant/revoke drive- and folder-level permissions, toggle folder inheritance (enable/disable)

• share-create ("shared with me" shortcuts), My Drive scaffolding, upload/download, search

Not affiliated with NAVER / WORKS MOBILE Corp. "NAVER WORKS", "LINE WORKS" and worksmobile.com are their trademarks/properties. Official API docs: https://developers.worksmobile.com/

Safety design

WORKS Drive permission APIs have sharp edges. This tool encodes them:

• Every mutating operation requires explicit confirmation — CLI: --yes (non-interactive runs refuse without it); MCP: confirm=true parameter. Agents are expected to ask the human before setting it.

• Bulk permission delete ("all-delete") is not exposed at all — its semantics flipped between WORKS versions (masters-only vs open to everyone).

• Destructive semantics are spelled out in tool docs: drive accessibleRange PATCH transitions wipe granted permissions; folder enable breaks inheritance; disable drops folder grants.

Related MCP server: synology-office-mcp

Setup

1. In the Developer Console, create an app with service-account delegation, note Client ID/Secret, create the service account, and download the private key. Grant OAuth scopes (file, user.read).

2. Configure credentials:

pip install worksmobile-mcp        # or: uv tool install worksmobile-mcp
mkdir -p ~/.config/worksmobile
cp .env.example ~/.config/worksmobile/.env   # then fill in values

Config resolution: process env (WORKS_*) > $WORKS_ENV_FILE > ./.env > ~/.config/worksmobile/.env.

CLI

worksmobile drives                              # list shared drives
worksmobile drive @2001000000xxxxxx             # accessibleRange / permissionType
worksmobile ls --sd @2001000000xxxxxx           # list files
worksmobile perms @2001000000xxxxxx --folder FID
worksmobile grant @2001000000xxxxxx --target pm@corp.com --type WRITE --folder FID --yes
worksmobile share FID --owner host@corp.com --to pm@corp.com --type WRITE --yes
worksmobile download FID --sd @2001000000xxxxxx -o report.hwp
worksmobile call GET /users/me/drive/files      # raw API escape hatch

All read commands accept --user someone@corp.com to act as that member.

MCP server

stdio (local agents — Claude Code, Codex, Cursor, Gemini CLI):

claude mcp add worksmobile -- worksmobile-mcp

{ "mcpServers": { "worksmobile": { "command": "worksmobile-mcp" } } }

Streamable HTTP (remote / chat surfaces):

worksmobile-mcp --transport streamable-http --port 8123

⚠️ The delegated service account can act as any member. If you expose the HTTP transport beyond localhost, put real authentication in front of it, or don't.

Tools

⚠ = requires confirm=true.

API notes (hard-won)

• accessibleRange is 3-valued: TENANT / DOMAIN / MEMBER. New drives default to DOMAIN+WRITE. PATCH transitions are destructive (MEMBER→DOMAIN deletes all grants; →MEMBER fails while folder-level grants exist).

• Folder-level permissions accept individual users only (no org units); the target must already be a drive member (undocumented, observed).

• Folder enable = masters-only until you grant; disable = grants dropped, inheritance back.

• share-create works on My Drive folders only — team-drive folders can't produce "shared with me" shortcuts.

• A pure service-account token has no My Drive (403); hosting requires delegation to a real account.

• Upload is 2-step (metadata POST → uploadUrl PUT); download is a 302 whose storage location also requires the Bearer token.

• GET /sharedrives responds {"sharedrives": [...]} (docs imply a bare array).

License

MIT