Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.zhuzhen-team/feishu-user-plugin

NPM · FEISHU-USER-PLUGIN · SCANNED SEP 20

Feishu/Lark MCP server + CLI tool. 85 tools, 3 auth layers. Send as user via cookie+protobuf.

Available components

0 this week 75 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 56 of 169 dependencies flagged as unhealthy (3 deprecated). View diagnostics → Partial
Provenance & Transparency23
Schema Quality & AI Usability74
  • 78% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 12575 tokens (~147/item across 85 items; 85 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
  • Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 97% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 15 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_calendar_event" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 85 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.zhuzhen-team/feishu-user-plugin MCP server?

io.github.zhuzhen-team/feishu-user-plugin runs locally as an npm package, launched with npx -y feishu-user-plugin. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · feishu-user-plugin

# add to Claude Code
claude mcp add zhuzhen-team-feishu-user-plugin -- npx -y feishu-user-plugin
// .cursor/mcp.json
{
  "mcpServers": {
    "zhuzhen-team-feishu-user-plugin": {
      "command": "npx",
      "args": [
        "-y",
        "feishu-user-plugin"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "zhuzhen-team-feishu-user-plugin": {
      "command": "npx",
      "args": [
        "-y",
        "feishu-user-plugin"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add zhuzhen-team-feishu-user-plugin -- npx -y feishu-user-plugin
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zhuzhen-team-feishu-user-plugin": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "feishu-user-plugin"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add zhuzhen-team-feishu-user-plugin --command npx --arg -y --arg feishu-user-plugin
# ~/.hermes/config.yaml
mcp_servers:
  zhuzhen-team-feishu-user-plugin:
    command: "npx"
    args: ["-y", "feishu-user-plugin"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "zhuzhen-team-feishu-user-plugin": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "feishu-user-plugin"
      ]
    }
  }
}
# add to Vellum
assistant mcp add zhuzhen-team-feishu-user-plugin -t stdio -c npx -a -y feishu-user-plugin
// mcp.json
{
  "mcpServers": {
    "zhuzhen-team-feishu-user-plugin": {
      "command": "npx",
      "args": [
        "-y",
        "feishu-user-plugin"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 19 Sept 26 +1
    • Stability: 0.97 → pass security
  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 12 Sept 26 +1
    • Stability: 0.97 → pass security
  • 10 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 8 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/feishu-user-plugin@1.4.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 169 packages
Packages resolved 169
Deprecated 3
Stale 56
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 85 exposed · ~12,575 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_reaction ~63

[Official API] Add an emoji reaction to a message.

NameTypeReqDescription
emoji_typestringyesEmoji type string, e.g. "THUMBSUP", "SMILE", "HEART"
message_idstringyesMessage ID (om_xxx)

No output schema declared.

No examples provided.

batch_send ~210

[User Identity / Official API] Send the same or different content to multiple targets in one call. Each target dispatches sequentially with a small delay (anti-rate-limit) and reports per-target success/error. Identity is the cookie user (user-identity sends) unless target.via=bot. Use for broadcast / fan-out scenarios.

NameTypeReqDescription
delay_msnumberDelay between sends in milliseconds (default 200, increase for risky volumes).
targetsarrayyesArray of targets. Each entry: { type: "user"|"group"|"chat", id: <user_name | group_name | chat_id>, content: { kind: "text"|"image"|"file"|"post", ... } }. For kind="text": { text }. For "image": {…

No output schema declared.

No examples provided.

complete_task ~81

[Official API + UAT, v1.3.7] Mark a task complete (or uncomplete it). Convenience wrapper around update_task with completed_at.

NameTypeReqDescription
completedbooleantrue → mark complete (uses Date.now()); false → uncomplete (sets completed_at to "0"). Default true.
task_guidstringyesTask GUID

No output schema declared.

No examples provided.

copy_wiki_node ~114

[Official API] Deep-copy a Wiki node into a different location (and optionally a different space). Underlying resource is duplicated.

NameTypeReqDescription
node_tokenstringyesWiki node token to copy
space_idstringyesSource space ID
target_parent_tokenstringDestination parent wiki node token (optional)
target_space_idstringDestination space ID (optional; same-space copy if omitted)
titlestringTitle for the copy (optional; defaults to source title)

No output schema declared.

No examples provided.

create_calendar_event ~344

[Official API + UAT, v1.3.7] Create a new calendar event. Requires `calendar:calendar.event:create` scope (re-run `npx feishu-user-plugin oauth` after enabling). The current identity (UAT-first) must have writer or owner permission on the calendar. Time fields: A time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events.

NameTypeReqDescription
attendee_abilitystringWhat attendees may do (optional)
calendar_idstringyesCalendar ID (use list_calendars; primary calendar has type="primary").
descriptionstringDescription / notes (optional)
end_timeobjectyesA time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events.
free_busy_statusstringWhether this event blocks the calendar (optional)
locationobjectOptional. {name, address?, latitude?, longitude?}.
need_notificationbooleanWhether to notify attendees on create (default true)
recurrencestringiCal RRULE recurrence string (optional)
remindersarrayReminders before event start (optional). E.g. [{minutes:15}].
start_timeobjectyesA time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events.
summarystringyesEvent title
visibilitystringEvent visibility (optional)

No output schema declared.

No examples provided.

create_doc ~131

[Official API] Create a new Feishu document. Can place directly under a Wiki space by passing wiki_space_id (optionally wiki_parent_node_token for nested placement) — the plugin creates the doc in drive then attaches it as a Wiki node.

NameTypeReqDescription
folder_idstringParent folder token (optional; ignored when wiki_space_id is set)
titlestringyesDocument title
wiki_parent_node_tokenstringParent wiki node token within the space (optional; defaults to space root)
wiki_space_idstringWiki space ID to place the doc under (optional)

No output schema declared.

No examples provided.

create_folder ~41

[Official API] Create a new folder in Drive.

NameTypeReqDescription
namestringyesFolder name
parent_tokenstringParent folder token (optional)

No output schema declared.

No examples provided.

create_group ~60

[Official API] Create a new group chat (as bot). Can add initial members.

NameTypeReqDescription
descriptionstringGroup description (optional)
namestringyesGroup name
user_idsarrayInitial member open_ids (optional)

No output schema declared.

No examples provided.

create_okr_progress_record ~383

[Official API + UAT, v1.3.7] Add a progress note to an OKR objective or key result. Feishu requires `source_title`, `source_url`, and a block-structured `content`; this tool exposes a simple `content_text` and auto-wraps it into the single-paragraph block format. Pass richer `content` directly if you need lists / mentions / docs links / images.

NameTypeReqDescription
contentobjectOptional: full Feishu block structure ({blocks:[...]}). If provided, overrides content_text.
content_textstringPlain-text progress note. Auto-wrapped into the Feishu block format. Use `content` instead for rich text.
progress_percentnumberOptional progress percent (0-100) to bump alongside the note.
progress_statusnumberOptional status code (Feishu enum: 1=on track, 2=at risk, 3=blocked, etc).
source_titlestringSource label (default "Progress update"). Shown next to the note in the OKR UI.
source_urlstringSource URL (default https://feishu.cn/). Feishu requires a URL even for plain notes.
source_url_mobilestringOptional mobile-specific source URL.
source_url_pcstringOptional PC-specific source URL.
target_idstringyesID of the OKR objective or key result. Get from get_okrs response (`objective_list[].id` or `objective_list[].kr_list[].id`).
target_typenumberyes1 = objective, 2 = key result. Pick based on which level target_id refers to.
user_id_typestringType of user IDs in mentioned_user_list etc. (default open_id)

No output schema declared.

No examples provided.

create_p2p_chat ~47

[User Identity] Create or get a P2P (direct message) chat. Returns numeric chat_id.

NameTypeReqDescription
user_idstringyesTarget user ID from search_contacts

No output schema declared.

No examples provided.

create_task ~157

[Official API + UAT, v1.3.7] Create a new task. summary is required; due / members / etc. are optional.

NameTypeReqDescription
descriptionstringTask description (optional)
dueobjectDue time (optional). {timestamp:"<unix-millis>", is_all_day?:true|false}
extrastringFree-form extra metadata (optional)
membersarrayInitial members (optional). Each: {id:"<open_id>", role:"assignee"|"follower", type?:"user", name?:"..."}
repeat_rulestringRecurrence (optional, RFC5545 RRULE)
summarystringyesTask title

No output schema declared.

No examples provided.

create_wiki_node ~173

[Official API] Create a new Wiki node inside a space. obj_type picks the underlying resource (doc/sheet/bitable/mindnote/file/docx/slides). UAT-first so the resource is owned by the user.

NameTypeReqDescription
node_typestringorigin = real resource, shortcut = pointer to existing node (default: origin)
obj_typestringyesUnderlying resource type
origin_node_tokenstringRequired when node_type=shortcut — the wiki node this shortcut points at
parent_node_tokenstringParent wiki node under which to create (optional; root if omitted)
space_idstringyesWiki space ID (from list_wiki_spaces)
titlestringNode title (optional; Feishu generates a default if absent)

No output schema declared.

No examples provided.

delete_calendar_event ~105

[Official API + UAT, v1.3.7] Delete a calendar event. Requires `calendar:calendar.event:delete` scope.

NameTypeReqDescription
calendar_idstringyesCalendar ID
event_idstringyesEvent ID
meeting_chat_idstringOptional. If the event has a linked meeting chat, pass its chat_id to also dissolve it.
need_notificationbooleanWhether to notify attendees of the deletion (default true)

No output schema declared.

No examples provided.

delete_message ~39

[Official API] Recall/delete a message (bot can only delete its own messages).

NameTypeReqDescription
message_idstringyesMessage ID (om_xxx)

No output schema declared.

No examples provided.

delete_okr_progress_record ~54

[Official API + UAT, v1.3.7] Delete an OKR progress record by its progress_id (from list_okr_progress_records).

NameTypeReqDescription
progress_idstringyesProgress record ID

No output schema declared.

No examples provided.

delete_reaction ~47

[Official API] Remove an emoji reaction from a message.

NameTypeReqDescription
message_idstringyesMessage ID
reaction_idstringyesReaction ID (from add_reaction response)

No output schema declared.

No examples provided.

delete_task ~38

[Official API + UAT, v1.3.7] Permanently delete a task.

NameTypeReqDescription
task_guidstringyesTask GUID

No output schema declared.

No examples provided.

delete_wiki_node ~178

[Official API, v1.3.7] Delete a Wiki node. Calls `DELETE /open-apis/wiki/v2/spaces/{space_id}/nodes/{node_token}`. The Feishu SDK does not type this endpoint, so the call goes through raw REST (UAT-first; bot fallback uses `client.request`). **The underlying drive resource (docx / sheet / bitable / file) is NOT deleted** — Feishu treats wiki nodes as pointers. To delete the actual resource as well, follow up with `manage_drive_file(action=delete, type=<obj_type>, file_token=<obj_token>)` (use `get_wiki_node` first to get obj_type / obj_token).

NameTypeReqDescription
node_tokenstringyesWiki node token to delete
space_idstringyesWiki space ID

No output schema declared.

No examples provided.

download_doc_image ~148

[User Identity / Official API] Download an image embedded in a docx document so the model can see it. Pass the `image_token` from `get_doc_blocks` (block.image.token), and optionally the doc/wiki/URL token to scope the lookup. UAT-first. **Size cap:** payloads > 2 MiB MUST pass `save_path`.

NameTypeReqDescription
doc_tokenstringDocument ID, wiki node token, or Feishu URL (optional but recommended for permission scoping).
image_tokenstringyesImage token (from get_doc_blocks image block)
save_pathstringAbsolute local path. Required when image bytes > 2 MiB.

No output schema declared.

No examples provided.

download_message_resource ~307

[User Identity / Official API] Download an image or file attached to a message so the model can see / store it. v1.3.7 (C2.4) consolidates the v1.3.6 download_image (mode 1) + download_file. UAT-first, falls back to app. For images, the response includes an inline `image` content block so the model sees pixels. For files, the response includes the bytes as base64 (truncated for display) plus an optional save_path write. **Size cap:** payloads > 2 MiB MUST pass `save_path`. The Anthropic API rejects responses > 5 MB; we cap at 2 MiB so multipart wrapping has headroom. **merge_forward children:** Feishu keys media by the parent merge_forward id, not the child id. Use the child's `parentMessageId` field (returned by read_messages with expand_merge_forward) — not the child id.

NameTypeReqDescription
keystringyesimage_key (img_xxx) for kind=image, file_key for kind=file. From read_messages content.
kindstringyesimage or file
message_idstringyesMessage ID (om_xxx). For merge_forward children, use the child's `parentMessageId`.
save_pathstringAbsolute local path. Required when downloaded bytes > 2 MiB (else the response would exceed the Anthropic API 5 MB inline limit).

No output schema declared.

No examples provided.

forward_message ~158

[Official API] Forward a message to another chat or user. `receive_id` may be a group chat_id (oc_xxx), an open_id (ou_xxx), a union_id, a user_id, or an email — set `receive_id_type` to match (default: chat_id).

NameTypeReqDescription
message_idstringyesMessage ID to forward (om_xxx)
receive_idstringyesTarget chat_id (oc_xxx), open_id (ou_xxx), union_id, user_id, or email — set receive_id_type to match.
receive_id_typestringFormat of receive_id (default: chat_id). Set to "open_id" when forwarding to a user via their open_id.

No output schema declared.

No examples provided.

get_calendar_event ~65

[Official API + UAT] Get full details of a single calendar event (summary, description, start/end, attendees, location, attachments, meeting link).

NameTypeReqDescription
calendar_idstringyesCalendar ID
event_idstringyesEvent ID from list_calendar_events

No output schema declared.

No examples provided.

get_chat_info ~56

[Official API + User Identity fallback] Get chat details: name, description, member count, owner. Supports both oc_xxx and numeric chat_id.

NameTypeReqDescription
chat_idstringyesChat ID (oc_xxx or numeric)

No output schema declared.

No examples provided.

get_doc_blocks ~201

[Official API] Get structured block tree of a document. Returns block types, content, and hierarchy for precise document analysis. Follows pagination internally and returns ALL blocks by default — hasMore:false in the response guarantees the complete tree (pre-v1.3.17 silently capped at 500 blocks). For very large docs, pass max_blocks to bound one call (rounded up to 500/page granularity) and page forward by passing the returned nextPageToken back as page_token; a bounded response carries truncated:true + hasMore:true so partial output is never silent.

NameTypeReqDescription
document_idstringyesDocument ID (from search_docs or create_doc)
max_blocksnumberSoft cap on blocks returned in this call (rounded up to page granularity of 500). Omit to fetch the entire document.
page_tokenstringResume cursor — pass the nextPageToken from a previous truncated response to fetch the next slice.

No output schema declared.

No examples provided.

get_freebusy ~170

[Official API + UAT, v1.3.7] Query freebusy windows for one or more users in a time range. Use to find a meeting slot. Requires `calendar:calendar:readonly` (already in default scope set).

NameTypeReqDescription
include_external_calendarbooleanInclude the user's synced external calendars (optional)
only_busybooleanOnly return busy windows (optional)
room_idsarrayOptional meeting-room IDs.
time_maxstringyesRFC3339 end
time_minstringyesRFC3339 start, e.g. 2026-05-04T09:00:00+08:00
user_idsarrayyesOpen IDs to query (use get_login_status / search_contacts to look up).

No output schema declared.

No examples provided.

get_login_status ~23

Check cookie session validity and app credentials status. Also refreshes session.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_new_events ~171

[Plugin v1.3.9] Drain real-time events from the machine-level shared event log. v1.3.8 used per-process in-memory buffers (with duplicate-event problem); v1.3.9 uses ~/.feishu-user-plugin/events.jsonl with a single global cursor — every event delivered exactly once across all MCP processes on this machine. Default returns events from the current active profile only; pass profile="*" to see all.

NameTypeReqDescription
chat_idstring
event_typestring
event_typesarray
max_eventsinteger
peekboolean
profilestringProfile filter. Default = current active. Pass "*" or "any" for all profiles.
since_secondsinteger

No output schema declared.

No examples provided.

get_okrs ~94

[Official API + UAT] Batch-fetch full OKR details (objectives, key results, progress, alignments) by OKR IDs.

NameTypeReqDescription
langstringResponse language (optional)
okr_idsarrayyesOKR IDs (max 10 per call). From list_user_okrs.
user_id_typestringType of user_ids in response (default: open_id)

No output schema declared.

No examples provided.

get_task ~53

[Official API + UAT, v1.3.7] Get full details of a single task by GUID.

NameTypeReqDescription
task_guidstringyesTask GUID (from list_tasks / create_task / Feishu URL)

No output schema declared.

No examples provided.

get_user_info ~45

[User Identity] Look up a user's display name by user ID.

NameTypeReqDescription
chat_idstringChat context (optional)
user_idstringyesUser ID

No output schema declared.

No examples provided.

get_wiki_node ~170

[Official API] Resolve a Wiki node token to its underlying object (docx / bitable / sheet / mindnote / file). Returns obj_type + obj_token + space_id so you can read/write the real resource via the usual docx / bitable tools. Accepts bare wiki node token (wikcnXXX), an underlying obj_token (docxXXX / bascnXXX from search_wiki), or a full Feishu /wiki/ URL — the handler tries the wiki endpoint first and falls back to a synthesized node-shape for non-wiki tokens.

NameTypeReqDescription
node_tokenstringyesWiki node token (wikcnXXX / wikmXXX / wiknXXX), underlying obj_token (docxXXX / bascnXXX), or full Feishu /wiki/<token> URL

No output schema declared.

No examples provided.

list_calendar_events ~150

[Official API + UAT] List events in a calendar within an optional time range. Typical usage: first list_calendars to find calendar_id (primary calendar has type="primary"), then list events in e.g. [now, now+7d] (Unix seconds).

NameTypeReqDescription
calendar_idstringyesCalendar ID from list_calendars
end_timestringRange end (Unix seconds, optional)
page_sizenumberItems per page (default 50)
page_tokenstringPagination token
start_timestringRange start (Unix seconds, optional)
sync_tokenstringIncremental sync token (optional)

No output schema declared.

No examples provided.

list_calendars ~112

[Official API + UAT] List the current user's calendars (primary + shared + subscribed). Requires UAT — app identity only sees calendars it was explicitly invited to. Requires `calendar:calendar:readonly` scope on the OAuth.

NameTypeReqDescription
page_sizenumberItems per page (min 50, default 50). Feishu's calendar endpoint rejects page_size < 50.
page_tokenstringPagination token
sync_tokenstringIncremental sync token (optional)

No output schema declared.

No examples provided.

list_chats ~58

[Official API] List all chats the bot has joined. Returns chat_id, name, type.

NameTypeReqDescription
page_sizenumberItems per page (default 20, max 100)
page_tokenstringPagination token

No output schema declared.

No examples provided.

list_files ~148

[Official API] List files in a Drive folder. UAT-first with app fallback: with user identity (UAT), empty folder_token lists YOUR personal-space ("我的空间") root; via bot it can only see folders shared with the bot (personal-space folders return 403). Response carries viaUser so you know whose view you got. Use the returned file token with manage_drive_file to copy/move/delete.

NameTypeReqDescription
folder_tokenstringFolder token (empty for root — your 我的空间 root when UAT is configured)
page_sizenumberMax files per page (default 50)
page_tokenstringPagination token from a previous nextPageToken

No output schema declared.

No examples provided.

list_members ~59

[Official API] List all members in a group chat.

NameTypeReqDescription
chat_idstringyesChat ID (oc_xxx)
page_sizenumberItems per page (default 50)
page_tokenstringPagination token

No output schema declared.

No examples provided.

list_okr_periods ~69

[Official API + UAT] List OKR periods (quarters / years) defined in the tenant. Use period_ids from this to filter list_user_okrs.

NameTypeReqDescription
page_sizenumberItems per page (default 10)
page_tokenstringPagination token

No output schema declared.

No examples provided.

list_okr_progress_records ~126

[Official API + UAT, v1.3.7] List progress records for an OKR. Feishu has no native list endpoint — this tool calls get_okrs internally and walks the objective_list / kr_list to extract progress_record IDs (with their target_id and target_type). To read a record's full content, you currently need progressRecord.get (not yet wrapped).

NameTypeReqDescription
okr_idstringyesOKR ID (from list_user_okrs).
user_id_typestringPass-through to get_okrs (default open_id)

No output schema declared.

No examples provided.

list_profiles ~75

[Plugin] List all available identity profiles (each profile has its own LARK_COOKIE / APP_ID / APP_SECRET / UAT). v1.3.9 SSOT: profiles live in ~/.feishu-user-plugin/credentials.json::profiles. Legacy fallback: LARK_PROFILES_JSON env var. Marks the currently active profile.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_tasks ~103

[Official API + UAT, v1.3.7] List the current user's tasks. Filter by completion or type.

NameTypeReqDescription
completedbooleantrue → only completed; false → only pending; omit → all
page_sizenumberItems per page (default Feishu default)
page_tokenstringPagination token
typestringFilter by task type (optional). E.g. "all" / "personal".

No output schema declared.

No examples provided.

list_user_chats ~85

[User UAT] List group chats the user is in. Note: only returns groups, not P2P. For P2P chats, use search_contacts → create_p2p_chat → read_p2p_messages. Requires OAuth setup.

NameTypeReqDescription
page_sizenumberItems per page (default 20)
page_tokenstringPagination token

No output schema declared.

No examples provided.

list_user_okrs ~166

[Official API + UAT] List a user's OKRs. Requires the user's open_id (get yours via get_login_status or search_contacts). Filter by period_ids to narrow to a specific quarter.

NameTypeReqDescription
langstringResponse language (optional, e.g. "zh_cn", "en_us")
limitnumberItems per page (default 10, max 10)
offsetnumberPagination offset (default 0)
period_idsarrayFilter by OKR period IDs (optional). Get period IDs via list_okr_periods.
user_idstringyesTarget user's open_id (or the matching user_id_type)
user_id_typestringType of user_id (default: open_id)

No output schema declared.

No examples provided.

list_wiki_nodes ~132

[Official API] List nodes in a Wiki space (50 per page). When hasMore is true, pass the returned pageToken back as page_token to fetch the next page. A page may be EMPTY while hasMore is still true (Feishu permission-filters per page) — do not stop at an empty page; keep paging until hasMore is false.

NameTypeReqDescription
page_tokenstringPagination cursor — pass the pageToken from a previous response to fetch the next page.
parent_node_tokenstringParent node token (optional)
space_idstringyesWiki space ID

No output schema declared.

No examples provided.

list_wiki_spaces ~70

[Official API] List all accessible Wiki spaces. Follows pagination internally and returns ALL spaces (pre-v1.3.17 silently capped at 50). If the upstream cursor stalls, the response carries truncated:true + cursorUnavailable:true instead of hasMore:true because there is no safe resume cursor.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

manage_bitable_app ~165

[Official API] Manage a Bitable app. action=create (new app, optional wiki_space_id to attach), copy (duplicate an existing app), get_meta (read app metadata).

NameTypeReqDescription
actionstringyesOperation to perform
app_tokenstringRequired for copy/get_meta. Native token, wiki node, or Feishu URL.
folder_idstringDestination folder token (optional for create/copy; ignored when wiki_space_id is set).
namestringNew app name. Required for create/copy.
wiki_parent_node_tokenstringParent wiki node within the space (optional for create).
wiki_space_idstringWiki space ID — create the app directly under this space (create only).

No output schema declared.

No examples provided.

manage_bitable_field ~288

[Official API] Manage fields (columns) inside a Bitable table. action=list, create, update (Feishu requires `type` even when only renaming), delete.

NameTypeReqDescription
actionstringyesOperation to perform
app_tokenstringyesBitable app token. Accepts native token, wiki node, or Feishu URL.
field_idstringField ID — required for update/delete.
field_namestringField display name — required for create, optional for update.
propertyobjectField-type-specific properties (optional). E.g. SingleSelect: {options:[{name:"A"},{name:"B"}]}.
table_idstringyesTable ID
typenumberField type (1=Text, 2=Number, 3=SingleSelect, 4=MultiSelect, 5=DateTime, 7=Checkbox, 11=User, 13=Phone, 15=URL, 17=Attachment, 18=Link, 20=Formula, 21=DuplexLink, 22=Location, 23=GroupChat, 1001=Crea…

No output schema declared.

No examples provided.

manage_bitable_record ~251

[Official API] Manage records (rows) inside a Bitable table. action=search, get, create, update, delete. create/update/delete accept arrays — single record or up to 500.

NameTypeReqDescription
actionstringyesOperation to perform
app_tokenstringyesBitable app token. Accepts native token, wiki node, or Feishu URL.
filterobjectFilter conditions (search only, optional)
page_sizenumberResults per page (search only, default 20)
page_tokenstringPagination cursor (search only) — pass the pageToken from a previous response to fetch the next page when hasMore is true.
record_idstringRecord ID — required for action=get.
record_idsarrayRecord IDs to delete. Single ID or up to 500.
recordsarrayRecords to write. For create: [{fields:{field_name:value}}]. For update: [{record_id, fields:{...}}]. Single record or up to 500.
sortarraySort conditions (search only, optional)
table_idstringyesTable ID

No output schema declared.

No examples provided.

manage_bitable_table ~250

[Official API] Manage a table inside a Bitable app. action=list, create (with optional initial fields), update (rename), delete.

NameTypeReqDescription
actionstringyesOperation to perform
app_tokenstringyesBitable app token (required for all actions). Accepts native token, wiki node, or Feishu URL.
fieldsarrayInitial field definitions (create only, optional). Each item: {field_name, type, property?} where type is 1=Text, 2=Number, 3=SingleSelect, 4=MultiSelect, 5=DateTime, 7=Checkbox, 11=User, 13=Phone, 1…
namestringTable name — required for create, optional for update (rename).
table_idstringTable ID — required for update/delete.

No output schema declared.

No examples provided.

manage_bitable_view ~149

[Official API] Manage views inside a Bitable table. action=list, create, delete. (Feishu open API does not expose view update — recreate with a new name to change.)

NameTypeReqDescription
actionstringyesOperation to perform
app_tokenstringyesBitable app token. Accepts native token, wiki node, or Feishu URL.
table_idstringyesTable ID
view_idstringView ID — required for delete.
view_namestringView name — required for create.
view_typestringView type for create: grid (default), kanban, gallery, form, gantt, calendar.

No output schema declared.

No examples provided.

manage_doc_block ~945

[Official API] Manage content blocks in a document. Single tool replaces v1.3.6 create_doc_block / update_doc_block / delete_doc_blocks. action=create — six modes (pass exactly ONE): (A) Generic — pass `children` array (e.g. [{block_type:2, text:{...}}]). (B) Image from local file — pass `image_path`; plugin uploads and patches. (C) Image from token — pass `image_token` (already uploaded). (D) File attachment from local file — pass `file_path`; plugin handles VIEW-wrap + replace_file. (E) File from token — pass `file_token`. (F) Table — pass `table={rows,columns,cells?}`; plugin creates a block_type=31 table (Feishu auto-makes the block_type=32 cells) and fills each provided cell. USE THIS for tables — do NOT hand-build table blocks via `children` (the table block_type is 31, NOT 40; getting it wrong returns invalid_param). action=update — generic (pass `update_body`), image-replace (pass `image_token`), or file-replace (pass `file_token`). ⚠ `update_text_elements` REPLACES the block's ENTIRE elements array — it is a full overwrite, NOT a patch/append. Any element you omit (bold runs, links, prefixes) is permanently lost; to change part of a block, read it first (get_doc_blocks) and resend ALL elements. action=delete — pass `parent_block_id` + `start_index` + `end_index` (range delete). `document_id` accepts native ID, wiki node token, or Feishu URL.

NameTypeReqDescription
actionstringyesOperation to perform
block_idstringBlock ID — required for action=update.
childrenarrayGeneric blocks for create mode A. E.g. [{block_type:2, text:{elements:[{text_run:{content:"Hello"}}]}}]
document_idstringyesDocument ID, wiki node token, or Feishu URL (required for all actions)
end_indexnumberRange end (exclusive) — required for delete.
file_pathstringLocal file path — create mode D (mutually exclusive with other create modes).
file_tokenstringPre-uploaded docx file token — create mode E, or update file-replace.
image_pathstringLocal image path — create mode B (mutually exclusive with other create modes).
image_tokenstringPre-uploaded docx image token — create mode C, or update image-replace.
indexnumberInsert position for create (optional, appends to end if omitted).
parent_block_idstringParent block ID — required for create/delete (use document_id for the doc root).
start_indexnumberRange start (inclusive) — required for delete.
tableobjectCreate a table — create mode F (mutually exclusive with other create modes). Shape: {rows:int>=1, columns:int>=1, cells?:string[][] (row-major plain text; omit/empty-string to leave a cell blank), co…
update_bodyobjectGeneric update payload for action=update. E.g. {update_text_elements:{elements:[{text_run:{content:"new text"}}]}}. ⚠ update_text_elements is a FULL REPLACEMENT of the block's elements array (not pat…

No output schema declared.

No examples provided.

Common questions

What is the io.github.zhuzhen-team/feishu-user-plugin MCP server?

io.github.zhuzhen-team/feishu-user-plugin is an MCP server listed in the public MCP registry as io.github.zhuzhen-team/feishu-user-plugin. Feishu/Lark MCP server + CLI tool. 85 tools, 3 auth layers. Send as user via cookie+protobuf. This page covers its npm package (feishu-user-plugin).

Is the io.github.zhuzhen-team/feishu-user-plugin MCP server safe to use?

io.github.zhuzhen-team/feishu-user-plugin scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.zhuzhen-team/feishu-user-plugin MCP server expose?

io.github.zhuzhen-team/feishu-user-plugin exposes 85 tools: manage_bitable_app, manage_bitable_table, manage_bitable_field, manage_bitable_view, manage_bitable_record, and 80 more. Their descriptions and schemas cost roughly 12,575 tokens of context every time the server is loaded.

Is the io.github.zhuzhen-team/feishu-user-plugin MCP server still maintained?

io.github.zhuzhen-team/feishu-user-plugin is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.zhuzhen-team/feishu-user-plugin MCP server under?

io.github.zhuzhen-team/feishu-user-plugin declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.