mcp
Provides an MCP (Model Context Protocol) server implementation for Frappe (Werkzeug/WSGI) apps, exposing registered Python functions as MCP tools over Streamable HTTP via a Frappe REST endpoint.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
TLS enforcement is not explicitly stated in the README; security depends on the surrounding Frappe deployment configuration. Auth guidance references OAuth2 integration with MCP Inspector and includes an allow_guests bypass (warned against). No details are provided about least-privilege scopes, secret storage, or structured error handling behavior. Project uses Werkzeug/WSGI and includes security-related option xss_safe for response sanitization.
⚡ Reliability
Best When
You have a Frappe Framework app and want to serve MCP tools over Streamable HTTP without migrating to an async/ASGI server.
Avoid When
You need tool streaming (SSE), resources/prompts support, or you cannot support/validate the experimental and potentially breaking behavior risk.
Use Cases
- • Expose Frappe app capabilities (backend business logic) as MCP tools to LLM agents
- • Build an MCP endpoint for tool execution against Frappe data/services
- • Rapidly register typed, schema-driven tool functions via decorators and docstring/type inference
Not For
- • Production use without validating stability and security for your specific setup (project is described as highly experimental)
- • Use cases needing MCP resources/prompts/streaming/SSE or non-tool MCP features (currently tools-only)
- • Integrations that require an ASGI-first stack without adapting to Werkzeug/WSGI
Interface
Authentication
Auth is described at a high level (Frappe OAuth2 support + MCP Inspector quick OAuth). A guest-bypass flag exists, but it is explicitly warned against for production.
Pricing
Open-source library; no pricing model described.
Agent Metadata
Known Gotchas
- ⚠ Project is explicitly 'highly experimental' with likely bugs and breaking changes without notice
- ⚠ Tools-only support: resources/prompts/streaming not currently implemented
- ⚠ If @mcp.register() handler does not import tool modules, tools will not be loaded
- ⚠ Setting allow_guests=True bypasses auth (dangerous for production)
- ⚠ Authentication setup depends on Frappe version having OAuth2 updates; otherwise additional OAuth client registration is required
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for mcp.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-30.