io.github.EthanQC/feishu-user-plugin
NPM · FEISHU-USER-PLUGIN · SCANNED SEP 30
Feishu/Lark MCP server + CLI tool. 85 tools, 3 auth layers. Send as user via cookie+protobuf.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 55 of 166 dependencies flagged as unhealthy (3 deprecated). View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 89 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability75
- 78% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 11474 tokens (~134/item across 85 items; 85 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 96% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 15 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_calendar_event" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 85 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.EthanQC/feishu-user-plugin MCP server?
io.github.EthanQC/feishu-user-plugin runs locally as an npm package, launched with npx -y feishu-user-plugin. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · feishu-user-plugin
claude mcp add ethanqc-feishu-user-plugin -- npx -y feishu-user-plugin
{
"mcpServers": {
"ethanqc-feishu-user-plugin": {
"command": "npx",
"args": [
"-y",
"feishu-user-plugin"
]
}
}
} {
"servers": {
"ethanqc-feishu-user-plugin": {
"command": "npx",
"args": [
"-y",
"feishu-user-plugin"
]
}
}
} codex mcp add ethanqc-feishu-user-plugin -- npx -y feishu-user-plugin
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ethanqc-feishu-user-plugin": {
"type": "local",
"command": [
"npx",
"-y",
"feishu-user-plugin"
],
"enabled": true
}
}
} openclaw mcp add ethanqc-feishu-user-plugin --command npx --arg -y --arg feishu-user-plugin
mcp_servers:
ethanqc-feishu-user-plugin:
command: "npx"
args: ["-y", "feishu-user-plugin"] {
"McpServers": {
"ethanqc-feishu-user-plugin": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"feishu-user-plugin"
]
}
}
} assistant mcp add ethanqc-feishu-user-plugin -t stdio -c npx -a -y feishu-user-plugin
{
"mcpServers": {
"ethanqc-feishu-user-plugin": {
"command": "npx",
"args": [
"-y",
"feishu-user-plugin"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 30 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Sept 26 −3
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 0
- Stability: 0.97 → pass security
- 23 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 30 Sept 2026 · Analysed npm/feishu-user-plugin@1.3.14
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 166 packages
| Packages resolved | 166 |
|---|---|
| Deprecated | 3 |
| Stale | 55 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_reaction ~63
[Official API] Add an emoji reaction to a message.
| Name | Type | Req | Description |
|---|---|---|---|
| emoji_type | string | yes | Emoji type string, e.g. "THUMBSUP", "SMILE", "HEART" |
| message_id | string | yes | Message ID (om_xxx) |
No output schema declared.
No examples provided.
batch_send ~210
[User Identity / Official API] Send the same or different content to multiple targets in one call. Each target dispatches sequentially with a small delay (anti-rate-limit) and reports per-target success/error. Identity is the cookie user (user-identity sends) unless target.via=bot. Use for broadcast / fan-out scenarios.
| Name | Type | Req | Description |
|---|---|---|---|
| delay_ms | number | – | Delay between sends in milliseconds (default 200, increase for risky volumes). |
| targets | array | yes | Array of targets. Each entry: { type: "user"|"group"|"chat", id: <user_name | group_name | chat_id>, content: { kind: "text"|"image"|"file"|"post", ... } }. For kind="text": { text }. For "image": {… |
No output schema declared.
No examples provided.
complete_task ~81
[Official API + UAT, v1.3.7] Mark a task complete (or uncomplete it). Convenience wrapper around update_task with completed_at.
| Name | Type | Req | Description |
|---|---|---|---|
| completed | boolean | – | true → mark complete (uses Date.now()); false → uncomplete (sets completed_at to "0"). Default true. |
| task_guid | string | yes | Task GUID |
No output schema declared.
No examples provided.
copy_wiki_node ~114
[Official API] Deep-copy a Wiki node into a different location (and optionally a different space). Underlying resource is duplicated.
| Name | Type | Req | Description |
|---|---|---|---|
| node_token | string | yes | Wiki node token to copy |
| space_id | string | yes | Source space ID |
| target_parent_token | string | – | Destination parent wiki node token (optional) |
| target_space_id | string | – | Destination space ID (optional; same-space copy if omitted) |
| title | string | – | Title for the copy (optional; defaults to source title) |
No output schema declared.
No examples provided.
create_calendar_event ~344
[Official API + UAT, v1.3.7] Create a new calendar event. Requires `calendar:calendar.event:create` scope (re-run `npx feishu-user-plugin oauth` after enabling). The current identity (UAT-first) must have writer or owner permission on the calendar. Time fields: A time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events.
| Name | Type | Req | Description |
|---|---|---|---|
| attendee_ability | string | – | What attendees may do (optional) |
| calendar_id | string | yes | Calendar ID (use list_calendars; primary calendar has type="primary"). |
| description | string | – | Description / notes (optional) |
| end_time | object | yes | A time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events. |
| free_busy_status | string | – | Whether this event blocks the calendar (optional) |
| location | object | – | Optional. {name, address?, latitude?, longitude?}. |
| need_notification | boolean | – | Whether to notify attendees on create (default true) |
| recurrence | string | – | iCal RRULE recurrence string (optional) |
| reminders | array | – | Reminders before event start (optional). E.g. [{minutes:15}]. |
| start_time | object | yes | A time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events. |
| summary | string | yes | Event title |
| visibility | string | – | Event visibility (optional) |
No output schema declared.
No examples provided.
create_doc ~131
[Official API] Create a new Feishu document. Can place directly under a Wiki space by passing wiki_space_id (optionally wiki_parent_node_token for nested placement) — the plugin creates the doc in drive then attaches it as a Wiki node.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | – | Parent folder token (optional; ignored when wiki_space_id is set) |
| title | string | yes | Document title |
| wiki_parent_node_token | string | – | Parent wiki node token within the space (optional; defaults to space root) |
| wiki_space_id | string | – | Wiki space ID to place the doc under (optional) |
No output schema declared.
No examples provided.
create_folder ~41
[Official API] Create a new folder in Drive.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Folder name |
| parent_token | string | – | Parent folder token (optional) |
No output schema declared.
No examples provided.
create_group ~60
[Official API] Create a new group chat (as bot). Can add initial members.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Group description (optional) |
| name | string | yes | Group name |
| user_ids | array | – | Initial member open_ids (optional) |
No output schema declared.
No examples provided.
create_okr_progress_record ~383
[Official API + UAT, v1.3.7] Add a progress note to an OKR objective or key result. Feishu requires `source_title`, `source_url`, and a block-structured `content`; this tool exposes a simple `content_text` and auto-wraps it into the single-paragraph block format. Pass richer `content` directly if you need lists / mentions / docs links / images.
| Name | Type | Req | Description |
|---|---|---|---|
| content | object | – | Optional: full Feishu block structure ({blocks:[...]}). If provided, overrides content_text. |
| content_text | string | – | Plain-text progress note. Auto-wrapped into the Feishu block format. Use `content` instead for rich text. |
| progress_percent | number | – | Optional progress percent (0-100) to bump alongside the note. |
| progress_status | number | – | Optional status code (Feishu enum: 1=on track, 2=at risk, 3=blocked, etc). |
| source_title | string | – | Source label (default "Progress update"). Shown next to the note in the OKR UI. |
| source_url | string | – | Source URL (default https://feishu.cn/). Feishu requires a URL even for plain notes. |
| source_url_mobile | string | – | Optional mobile-specific source URL. |
| source_url_pc | string | – | Optional PC-specific source URL. |
| target_id | string | yes | ID of the OKR objective or key result. Get from get_okrs response (`objective_list[].id` or `objective_list[].kr_list[].id`). |
| target_type | number | yes | 1 = objective, 2 = key result. Pick based on which level target_id refers to. |
| user_id_type | string | – | Type of user IDs in mentioned_user_list etc. (default open_id) |
No output schema declared.
No examples provided.
create_p2p_chat ~47
[User Identity] Create or get a P2P (direct message) chat. Returns numeric chat_id.
| Name | Type | Req | Description |
|---|---|---|---|
| user_id | string | yes | Target user ID from search_contacts |
No output schema declared.
No examples provided.
create_task ~157
[Official API + UAT, v1.3.7] Create a new task. summary is required; due / members / etc. are optional.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Task description (optional) |
| due | object | – | Due time (optional). {timestamp:"<unix-millis>", is_all_day?:true|false} |
| extra | string | – | Free-form extra metadata (optional) |
| members | array | – | Initial members (optional). Each: {id:"<open_id>", role:"assignee"|"follower", type?:"user", name?:"..."} |
| repeat_rule | string | – | Recurrence (optional, RFC5545 RRULE) |
| summary | string | yes | Task title |
No output schema declared.
No examples provided.
create_wiki_node ~173
[Official API] Create a new Wiki node inside a space. obj_type picks the underlying resource (doc/sheet/bitable/mindnote/file/docx/slides). UAT-first so the resource is owned by the user.
| Name | Type | Req | Description |
|---|---|---|---|
| node_type | string | – | origin = real resource, shortcut = pointer to existing node (default: origin) |
| obj_type | string | yes | Underlying resource type |
| origin_node_token | string | – | Required when node_type=shortcut — the wiki node this shortcut points at |
| parent_node_token | string | – | Parent wiki node under which to create (optional; root if omitted) |
| space_id | string | yes | Wiki space ID (from list_wiki_spaces) |
| title | string | – | Node title (optional; Feishu generates a default if absent) |
No output schema declared.
No examples provided.
delete_calendar_event ~105
[Official API + UAT, v1.3.7] Delete a calendar event. Requires `calendar:calendar.event:delete` scope.
| Name | Type | Req | Description |
|---|---|---|---|
| calendar_id | string | yes | Calendar ID |
| event_id | string | yes | Event ID |
| meeting_chat_id | string | – | Optional. If the event has a linked meeting chat, pass its chat_id to also dissolve it. |
| need_notification | boolean | – | Whether to notify attendees of the deletion (default true) |
No output schema declared.
No examples provided.
delete_message ~39
[Official API] Recall/delete a message (bot can only delete its own messages).
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Message ID (om_xxx) |
No output schema declared.
No examples provided.
delete_okr_progress_record ~54
[Official API + UAT, v1.3.7] Delete an OKR progress record by its progress_id (from list_okr_progress_records).
| Name | Type | Req | Description |
|---|---|---|---|
| progress_id | string | yes | Progress record ID |
No output schema declared.
No examples provided.
delete_reaction ~47
[Official API] Remove an emoji reaction from a message.
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Message ID |
| reaction_id | string | yes | Reaction ID (from add_reaction response) |
No output schema declared.
No examples provided.
delete_task ~38
[Official API + UAT, v1.3.7] Permanently delete a task.
| Name | Type | Req | Description |
|---|---|---|---|
| task_guid | string | yes | Task GUID |
No output schema declared.
No examples provided.
delete_wiki_node ~178
[Official API, v1.3.7] Delete a Wiki node. Calls `DELETE /open-apis/wiki/v2/spaces/{space_id}/nodes/{node_token}`. The Feishu SDK does not type this endpoint, so the call goes through raw REST (UAT-first; bot fallback uses `client.request`). **The underlying drive resource (docx / sheet / bitable / file) is NOT deleted** — Feishu treats wiki nodes as pointers. To delete the actual resource as well, follow up with `manage_drive_file(action=delete, type=<obj_type>, file_token=<obj_token>)` (use `get_wiki_node` first to get obj_type / obj_token).
| Name | Type | Req | Description |
|---|---|---|---|
| node_token | string | yes | Wiki node token to delete |
| space_id | string | yes | Wiki space ID |
No output schema declared.
No examples provided.
download_doc_image ~148
[User Identity / Official API] Download an image embedded in a docx document so the model can see it. Pass the `image_token` from `get_doc_blocks` (block.image.token), and optionally the doc/wiki/URL token to scope the lookup. UAT-first. **Size cap:** payloads > 2 MiB MUST pass `save_path`.
| Name | Type | Req | Description |
|---|---|---|---|
| doc_token | string | – | Document ID, wiki node token, or Feishu URL (optional but recommended for permission scoping). |
| image_token | string | yes | Image token (from get_doc_blocks image block) |
| save_path | string | – | Absolute local path. Required when image bytes > 2 MiB. |
No output schema declared.
No examples provided.
download_message_resource ~307
[User Identity / Official API] Download an image or file attached to a message so the model can see / store it. v1.3.7 (C2.4) consolidates the v1.3.6 download_image (mode 1) + download_file. UAT-first, falls back to app. For images, the response includes an inline `image` content block so the model sees pixels. For files, the response includes the bytes as base64 (truncated for display) plus an optional save_path write. **Size cap:** payloads > 2 MiB MUST pass `save_path`. The Anthropic API rejects responses > 5 MB; we cap at 2 MiB so multipart wrapping has headroom. **merge_forward children:** Feishu keys media by the parent merge_forward id, not the child id. Use the child's `parentMessageId` field (returned by read_messages with expand_merge_forward) — not the child id.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | image_key (img_xxx) for kind=image, file_key for kind=file. From read_messages content. |
| kind | string | yes | image or file |
| message_id | string | yes | Message ID (om_xxx). For merge_forward children, use the child's `parentMessageId`. |
| save_path | string | – | Absolute local path. Required when downloaded bytes > 2 MiB (else the response would exceed the Anthropic API 5 MB inline limit). |
No output schema declared.
No examples provided.
forward_message ~158
[Official API] Forward a message to another chat or user. `receive_id` may be a group chat_id (oc_xxx), an open_id (ou_xxx), a union_id, a user_id, or an email — set `receive_id_type` to match (default: chat_id).
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Message ID to forward (om_xxx) |
| receive_id | string | yes | Target chat_id (oc_xxx), open_id (ou_xxx), union_id, user_id, or email — set receive_id_type to match. |
| receive_id_type | string | – | Format of receive_id (default: chat_id). Set to "open_id" when forwarding to a user via their open_id. |
No output schema declared.
No examples provided.
get_calendar_event ~65
[Official API + UAT] Get full details of a single calendar event (summary, description, start/end, attendees, location, attachments, meeting link).
| Name | Type | Req | Description |
|---|---|---|---|
| calendar_id | string | yes | Calendar ID |
| event_id | string | yes | Event ID from list_calendar_events |
No output schema declared.
No examples provided.
get_chat_info ~56
[Official API + User Identity fallback] Get chat details: name, description, member count, owner. Supports both oc_xxx and numeric chat_id.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Chat ID (oc_xxx or numeric) |
No output schema declared.
No examples provided.
get_doc_blocks ~51
[Official API] Get structured block tree of a document. Returns block types, content, and hierarchy for precise document analysis.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | Document ID (from search_docs or create_doc) |
No output schema declared.
No examples provided.
get_freebusy ~170
[Official API + UAT, v1.3.7] Query freebusy windows for one or more users in a time range. Use to find a meeting slot. Requires `calendar:calendar:readonly` (already in default scope set).
| Name | Type | Req | Description |
|---|---|---|---|
| include_external_calendar | boolean | – | Include the user's synced external calendars (optional) |
| only_busy | boolean | – | Only return busy windows (optional) |
| room_ids | array | – | Optional meeting-room IDs. |
| time_max | string | yes | RFC3339 end |
| time_min | string | yes | RFC3339 start, e.g. 2026-05-04T09:00:00+08:00 |
| user_ids | array | yes | Open IDs to query (use get_login_status / search_contacts to look up). |
No output schema declared.
No examples provided.
get_login_status ~23
Check cookie session validity and app credentials status. Also refreshes session.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_new_events ~171
[Plugin v1.3.9] Drain real-time events from the machine-level shared event log. v1.3.8 used per-process in-memory buffers (with duplicate-event problem); v1.3.9 uses ~/.feishu-user-plugin/events.jsonl with a single global cursor — every event delivered exactly once across all MCP processes on this machine. Default returns events from the current active profile only; pass profile="*" to see all.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | – | – |
| event_type | string | – | – |
| event_types | array | – | – |
| max_events | integer | – | – |
| peek | boolean | – | – |
| profile | string | – | Profile filter. Default = current active. Pass "*" or "any" for all profiles. |
| since_seconds | integer | – | – |
No output schema declared.
No examples provided.
get_okrs ~94
[Official API + UAT] Batch-fetch full OKR details (objectives, key results, progress, alignments) by OKR IDs.
| Name | Type | Req | Description |
|---|---|---|---|
| lang | string | – | Response language (optional) |
| okr_ids | array | yes | OKR IDs (max 10 per call). From list_user_okrs. |
| user_id_type | string | – | Type of user_ids in response (default: open_id) |
No output schema declared.
No examples provided.
get_task ~53
[Official API + UAT, v1.3.7] Get full details of a single task by GUID.
| Name | Type | Req | Description |
|---|---|---|---|
| task_guid | string | yes | Task GUID (from list_tasks / create_task / Feishu URL) |
No output schema declared.
No examples provided.
get_user_info ~45
[User Identity] Look up a user's display name by user ID.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | – | Chat context (optional) |
| user_id | string | yes | User ID |
No output schema declared.
No examples provided.
get_wiki_node ~170
[Official API] Resolve a Wiki node token to its underlying object (docx / bitable / sheet / mindnote / file). Returns obj_type + obj_token + space_id so you can read/write the real resource via the usual docx / bitable tools. Accepts bare wiki node token (wikcnXXX), an underlying obj_token (docxXXX / bascnXXX from search_wiki), or a full Feishu /wiki/ URL — the handler tries the wiki endpoint first and falls back to a synthesized node-shape for non-wiki tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| node_token | string | yes | Wiki node token (wikcnXXX / wikmXXX / wiknXXX), underlying obj_token (docxXXX / bascnXXX), or full Feishu /wiki/<token> URL |
No output schema declared.
No examples provided.
list_calendar_events ~150
[Official API + UAT] List events in a calendar within an optional time range. Typical usage: first list_calendars to find calendar_id (primary calendar has type="primary"), then list events in e.g. [now, now+7d] (Unix seconds).
| Name | Type | Req | Description |
|---|---|---|---|
| calendar_id | string | yes | Calendar ID from list_calendars |
| end_time | string | – | Range end (Unix seconds, optional) |
| page_size | number | – | Items per page (default 50) |
| page_token | string | – | Pagination token |
| start_time | string | – | Range start (Unix seconds, optional) |
| sync_token | string | – | Incremental sync token (optional) |
No output schema declared.
No examples provided.
list_calendars ~112
[Official API + UAT] List the current user's calendars (primary + shared + subscribed). Requires UAT — app identity only sees calendars it was explicitly invited to. Requires `calendar:calendar:readonly` scope on the OAuth.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | number | – | Items per page (min 50, default 50). Feishu's calendar endpoint rejects page_size < 50. |
| page_token | string | – | Pagination token |
| sync_token | string | – | Incremental sync token (optional) |
No output schema declared.
No examples provided.
list_chats ~58
[Official API] List all chats the bot has joined. Returns chat_id, name, type.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | number | – | Items per page (default 20, max 100) |
| page_token | string | – | Pagination token |
No output schema declared.
No examples provided.
list_files ~33
[Official API] List files in a Drive folder.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_token | string | – | Folder token (empty for root) |
No output schema declared.
No examples provided.
list_members ~59
[Official API] List all members in a group chat.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Chat ID (oc_xxx) |
| page_size | number | – | Items per page (default 50) |
| page_token | string | – | Pagination token |
No output schema declared.
No examples provided.
list_okr_periods ~69
[Official API + UAT] List OKR periods (quarters / years) defined in the tenant. Use period_ids from this to filter list_user_okrs.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | number | – | Items per page (default 10) |
| page_token | string | – | Pagination token |
No output schema declared.
No examples provided.
list_okr_progress_records ~126
[Official API + UAT, v1.3.7] List progress records for an OKR. Feishu has no native list endpoint — this tool calls get_okrs internally and walks the objective_list / kr_list to extract progress_record IDs (with their target_id and target_type). To read a record's full content, you currently need progressRecord.get (not yet wrapped).
| Name | Type | Req | Description |
|---|---|---|---|
| okr_id | string | yes | OKR ID (from list_user_okrs). |
| user_id_type | string | – | Pass-through to get_okrs (default open_id) |
No output schema declared.
No examples provided.
list_profiles ~75
[Plugin] List all available identity profiles (each profile has its own LARK_COOKIE / APP_ID / APP_SECRET / UAT). v1.3.9 SSOT: profiles live in ~/.feishu-user-plugin/credentials.json::profiles. Legacy fallback: LARK_PROFILES_JSON env var. Marks the currently active profile.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_tasks ~103
[Official API + UAT, v1.3.7] List the current user's tasks. Filter by completion or type.
| Name | Type | Req | Description |
|---|---|---|---|
| completed | boolean | – | true → only completed; false → only pending; omit → all |
| page_size | number | – | Items per page (default Feishu default) |
| page_token | string | – | Pagination token |
| type | string | – | Filter by task type (optional). E.g. "all" / "personal". |
No output schema declared.
No examples provided.
list_user_chats ~85
[User UAT] List group chats the user is in. Note: only returns groups, not P2P. For P2P chats, use search_contacts → create_p2p_chat → read_p2p_messages. Requires OAuth setup.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | number | – | Items per page (default 20) |
| page_token | string | – | Pagination token |
No output schema declared.
No examples provided.
list_user_okrs ~166
[Official API + UAT] List a user's OKRs. Requires the user's open_id (get yours via get_login_status or search_contacts). Filter by period_ids to narrow to a specific quarter.
| Name | Type | Req | Description |
|---|---|---|---|
| lang | string | – | Response language (optional, e.g. "zh_cn", "en_us") |
| limit | number | – | Items per page (default 10, max 10) |
| offset | number | – | Pagination offset (default 0) |
| period_ids | array | – | Filter by OKR period IDs (optional). Get period IDs via list_okr_periods. |
| user_id | string | yes | Target user's open_id (or the matching user_id_type) |
| user_id_type | string | – | Type of user_id (default: open_id) |
No output schema declared.
No examples provided.
list_wiki_nodes ~46
[Official API] List nodes in a Wiki space.
| Name | Type | Req | Description |
|---|---|---|---|
| parent_node_token | string | – | Parent node token (optional) |
| space_id | string | yes | Wiki space ID |
No output schema declared.
No examples provided.
list_wiki_spaces ~20
[Official API] List all accessible Wiki spaces.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
manage_bitable_app ~165
[Official API] Manage a Bitable app. action=create (new app, optional wiki_space_id to attach), copy (duplicate an existing app), get_meta (read app metadata).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform |
| app_token | string | – | Required for copy/get_meta. Native token, wiki node, or Feishu URL. |
| folder_id | string | – | Destination folder token (optional for create/copy; ignored when wiki_space_id is set). |
| name | string | – | New app name. Required for create/copy. |
| wiki_parent_node_token | string | – | Parent wiki node within the space (optional for create). |
| wiki_space_id | string | – | Wiki space ID — create the app directly under this space (create only). |
No output schema declared.
No examples provided.
manage_bitable_field ~288
[Official API] Manage fields (columns) inside a Bitable table. action=list, create, update (Feishu requires `type` even when only renaming), delete.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform |
| app_token | string | yes | Bitable app token. Accepts native token, wiki node, or Feishu URL. |
| field_id | string | – | Field ID — required for update/delete. |
| field_name | string | – | Field display name — required for create, optional for update. |
| property | object | – | Field-type-specific properties (optional). E.g. SingleSelect: {options:[{name:"A"},{name:"B"}]}. |
| table_id | string | yes | Table ID |
| type | number | – | Field type (1=Text, 2=Number, 3=SingleSelect, 4=MultiSelect, 5=DateTime, 7=Checkbox, 11=User, 13=Phone, 15=URL, 17=Attachment, 18=Link, 20=Formula, 21=DuplexLink, 22=Location, 23=GroupChat, 1001=Crea… |
No output schema declared.
No examples provided.
manage_bitable_record ~218
[Official API] Manage records (rows) inside a Bitable table. action=search, get, create, update, delete. create/update/delete accept arrays — single record or up to 500.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform |
| app_token | string | yes | Bitable app token. Accepts native token, wiki node, or Feishu URL. |
| filter | object | – | Filter conditions (search only, optional) |
| page_size | number | – | Results per page (search only, default 20) |
| record_id | string | – | Record ID — required for action=get. |
| record_ids | array | – | Record IDs to delete. Single ID or up to 500. |
| records | array | – | Records to write. For create: [{fields:{field_name:value}}]. For update: [{record_id, fields:{...}}]. Single record or up to 500. |
| sort | array | – | Sort conditions (search only, optional) |
| table_id | string | yes | Table ID |
No output schema declared.
No examples provided.
manage_bitable_table ~250
[Official API] Manage a table inside a Bitable app. action=list, create (with optional initial fields), update (rename), delete.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform |
| app_token | string | yes | Bitable app token (required for all actions). Accepts native token, wiki node, or Feishu URL. |
| fields | array | – | Initial field definitions (create only, optional). Each item: {field_name, type, property?} where type is 1=Text, 2=Number, 3=SingleSelect, 4=MultiSelect, 5=DateTime, 7=Checkbox, 11=User, 13=Phone, 1… |
| name | string | – | Table name — required for create, optional for update (rename). |
| table_id | string | – | Table ID — required for update/delete. |
No output schema declared.
No examples provided.
manage_bitable_view ~149
[Official API] Manage views inside a Bitable table. action=list, create, delete. (Feishu open API does not expose view update — recreate with a new name to change.)
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform |
| app_token | string | yes | Bitable app token. Accepts native token, wiki node, or Feishu URL. |
| table_id | string | yes | Table ID |
| view_id | string | – | View ID — required for delete. |
| view_name | string | – | View name — required for create. |
| view_type | string | – | View type for create: grid (default), kanban, gallery, form, gantt, calendar. |
No output schema declared.
No examples provided.
manage_doc_block ~521
[Official API] Manage content blocks in a document. Single tool replaces v1.3.6 create_doc_block / update_doc_block / delete_doc_blocks. action=create — five modes: (A) Generic — pass `children` array (e.g. [{block_type:2, text:{...}}]). (B) Image from local file — pass `image_path`; plugin uploads and patches. (C) Image from token — pass `image_token` (already uploaded). (D) File attachment from local file — pass `file_path`; plugin handles VIEW-wrap + replace_file. (E) File from token — pass `file_token`. action=update — generic (pass `update_body`), image-replace (pass `image_token`), or file-replace (pass `file_token`). action=delete — pass `parent_block_id` + `start_index` + `end_index` (range delete). `document_id` accepts native ID, wiki node token, or Feishu URL.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform |
| block_id | string | – | Block ID — required for action=update. |
| children | array | – | Generic blocks for create mode A. E.g. [{block_type:2, text:{elements:[{text_run:{content:"Hello"}}]}}] |
| document_id | string | yes | Document ID, wiki node token, or Feishu URL (required for all actions) |
| end_index | number | – | Range end (exclusive) — required for delete. |
| file_path | string | – | Local file path — create mode D (mutually exclusive with other create modes). |
| file_token | string | – | Pre-uploaded docx file token — create mode E, or update file-replace. |
| image_path | string | – | Local image path — create mode B (mutually exclusive with other create modes). |
| image_token | string | – | Pre-uploaded docx image token — create mode C, or update image-replace. |
| index | number | – | Insert position for create (optional, appends to end if omitted). |
| parent_block_id | string | – | Parent block ID — required for create/delete (use document_id for the doc root). |
| start_index | number | – | Range start (inclusive) — required for delete. |
| update_body | object | – | Generic update payload for action=update. E.g. {update_text_elements:{elements:[{text_run:{content:"new text"}}]}}. |
No output schema declared.
No examples provided.
What is the io.github.EthanQC/feishu-user-plugin MCP server?
io.github.EthanQC/feishu-user-plugin is an MCP server listed in the public MCP registry as io.github.EthanQC/feishu-user-plugin. Feishu/Lark MCP server + CLI tool. 85 tools, 3 auth layers. Send as user via cookie+protobuf. This page covers its npm package (feishu-user-plugin).
Is the io.github.EthanQC/feishu-user-plugin MCP server safe to use?
io.github.EthanQC/feishu-user-plugin scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 30 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.EthanQC/feishu-user-plugin MCP server expose?
io.github.EthanQC/feishu-user-plugin exposes 85 tools: manage_bitable_app, manage_bitable_table, manage_bitable_field, manage_bitable_view, manage_bitable_record, and 80 more. Their descriptions and schemas cost roughly 11,474 tokens of context every time the server is loaded.
Is the io.github.EthanQC/feishu-user-plugin MCP server still maintained?
io.github.EthanQC/feishu-user-plugin is still listed as active in the MCP registry. We last reached this channel on 30 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.EthanQC/feishu-user-plugin MCP server under?
io.github.EthanQC/feishu-user-plugin declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.