io.github.zhuzhen-team/feishu-user-plugin
NPM · FEISHU-USER-PLUGIN · SCANNED SEP 20
Feishu/Lark MCP server + CLI tool. 85 tools, 3 auth layers. Send as user via cookie+protobuf.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 56 of 169 dependencies flagged as unhealthy (3 deprecated). View diagnostics → Partial
Provenance & Transparency23
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 79 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability74
- 78% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 12575 tokens (~147/item across 85 items; 85 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
- Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 97% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 15 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_calendar_event" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 85 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.zhuzhen-team/feishu-user-plugin MCP server?
io.github.zhuzhen-team/feishu-user-plugin runs locally as an npm package, launched with npx -y feishu-user-plugin. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · feishu-user-plugin
claude mcp add zhuzhen-team-feishu-user-plugin -- npx -y feishu-user-plugin
{
"mcpServers": {
"zhuzhen-team-feishu-user-plugin": {
"command": "npx",
"args": [
"-y",
"feishu-user-plugin"
]
}
}
} {
"servers": {
"zhuzhen-team-feishu-user-plugin": {
"command": "npx",
"args": [
"-y",
"feishu-user-plugin"
]
}
}
} codex mcp add zhuzhen-team-feishu-user-plugin -- npx -y feishu-user-plugin
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"zhuzhen-team-feishu-user-plugin": {
"type": "local",
"command": [
"npx",
"-y",
"feishu-user-plugin"
],
"enabled": true
}
}
} openclaw mcp add zhuzhen-team-feishu-user-plugin --command npx --arg -y --arg feishu-user-plugin
mcp_servers:
zhuzhen-team-feishu-user-plugin:
command: "npx"
args: ["-y", "feishu-user-plugin"] {
"McpServers": {
"zhuzhen-team-feishu-user-plugin": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"feishu-user-plugin"
]
}
}
} assistant mcp add zhuzhen-team-feishu-user-plugin -t stdio -c npx -a -y feishu-user-plugin
{
"mcpServers": {
"zhuzhen-team-feishu-user-plugin": {
"command": "npx",
"args": [
"-y",
"feishu-user-plugin"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −3
- Stability: pass → 0.80 functional
- 19 Sept 26 +1
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −3
- Stability: pass → 0.80 functional
- 12 Sept 26 +1
- Stability: 0.97 → pass security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/feishu-user-plugin@1.4.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 169 packages
| Packages resolved | 169 |
|---|---|
| Deprecated | 3 |
| Stale | 56 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
manage_drive_file ~166
[Official API] Manage a Drive file/doc/folder. action=copy (duplicate to a new name + folder), move (relocate, returns task_id), delete (remove, returns task_id). `type` is always required (Feishu rejects with 1061002 / 1062501 otherwise).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform |
| file_token | string | yes | File/folder token to operate on (required for all actions). |
| folder_token | string | – | Destination folder token — required for action=move; optional for action=copy (defaults to root). |
| name | string | – | New name — required for action=copy. |
| type | string | yes | Resource type — Feishu requires this to know which API table to look up. |
No output schema declared.
No examples provided.
manage_members ~130
[Official API] Add or remove members from a group chat. The Feishu API rejects with code 9499 when the IDs in `member_ids` do not match `member_id_type` — pass `member_id_type` explicitly when using union_id or user_id (default: open_id).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| chat_id | string | yes | Group chat ID (oc_xxx) |
| member_id_type | string | – | Format of member_ids (default: open_id). |
| member_ids | array | yes | Array of member identifiers — IDs must match member_id_type. |
No output schema declared.
No examples provided.
manage_profile_hints ~154
[Plugin v1.3.8] Inspect / set / clear profileHints — the resourceKey → profileName cache the auto-switch middleware uses to remember which profile owns each Feishu resource. Useful when a hint goes stale (e.g., a profile lost access to a doc).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | list = show all hints; set = upsert one; clear = remove one or all. |
| profile | string | – | For set: the profile name to associate with the resource_key. |
| resource_key | string | – | For set/clear: the resourceKey, e.g. "doc:doccnXXX" or "chat:oc_zzz". Omit on clear to wipe all hints. |
No output schema declared.
No examples provided.
manage_task_members ~103
[Official API + UAT, v1.3.7] Add or remove members on a task. Members are objects {id:"<open_id>", role:"assignee"|"follower", type?:"user", name?:""}.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | add or remove |
| members | array | yes | Members to add/remove. Each: {id, role, type?, name?}. |
| task_guid | string | yes | Task GUID |
No output schema declared.
No examples provided.
manage_ws_status ~104
[Plugin v1.3.9] Inspect or control the machine-level WS owner. Actions: info (status dump), reconnect (owner-only; restart WS), claim (try become owner; force=true to steal active lock), rotate (owner-only; force events.jsonl rotation), reconfig (owner-only; re-read credentials.json + apply event subscriptions).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| force | boolean | – | For claim only: steal an active owner lock |
No output schema declared.
No examples provided.
move_wiki_node ~108
[Official API] Move a Wiki node to a different parent (within the same space) or to a different space. Pass at least one of target_parent_token / target_space_id.
| Name | Type | Req | Description |
|---|---|---|---|
| node_token | string | yes | Wiki node token to move |
| space_id | string | yes | Source space ID |
| target_parent_token | string | – | New parent wiki node token (optional) |
| target_space_id | string | – | New target space ID (optional; same-space move if omitted) |
No output schema declared.
No examples provided.
pin_message ~47
[Official API] Pin or unpin a message in a chat.
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Message ID |
| pinned | boolean | – | true to pin, false to unpin |
No output schema declared.
No examples provided.
read_doc ~35
[Official API] Read the raw text content of a Feishu document.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | Document ID or token |
No output schema declared.
No examples provided.
read_doc_markdown ~109
[Plugin v1.3.9] Read a Feishu doc as Markdown (vs get_doc_blocks JSON). Saves ~60% tokens for RAG / digest / summarisation use cases. Accepts native docx token, wiki node token, or full Feishu URL. Embedded images / files appear as feishu://image_token/<TOKEN> placeholders — call download_doc_image for the binary if needed.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | docx token / wiki node / full URL |
No output schema declared.
No examples provided.
read_messages ~584
[Official API + UAT fallback] Read message history from any group. Accepts oc_xxx ID, numeric ID, or chat name (auto-searched). Auto-falls back to UAT for external groups the bot cannot access. Returns newest messages first by default, with sender names resolved. Auto-expands merge_forward messages into their child messages (with original sender / time / content preserved) by default — disable with expand_merge_forward=false. Text messages have URLs extracted into `urls`; Feishu doc links are additionally surfaced as `feishuDocs` so agents can feed them straight into read_doc / get_doc_blocks. **Sender semantics (v1.3.12)**: each message has a `displayLabel` (e.g. `周宇`, `[Bot] Claude聊天助手`, `[匿名]`, `[系统]`, `[已撤回] 怪兽`) — prefer it over raw `senderId` when narrating who-said-what. Also surfaced: `senderType` (user|app|anonymous), `senderIdType` (open_id|union_id|user_id), `senderTenantKey`, `isExternal` (cross-tenant), `isRecalled`, `isThreadReply` (parent_id present). **merge_forward children** carry `originChatId` (the chat the conversation came from, NOT the chat you queried) and best-effort `forwardedFromChatName` — do NOT treat children as native messages of the current group.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Chat ID (oc_xxx), numeric ID, or chat name (auto-searched via bot groups, im.chat.search, and user contacts) |
| end_time | string | – | End timestamp in seconds (optional) |
| expand_merge_forward | boolean | – | Auto-expand merge_forward placeholders into their child messages (default true). Children carry parentMessageId; use that id (not the child id) with download_message_resource (kind=image or file). |
| page_size | number | – | Messages to fetch (default 20, max 50) |
| page_token | string | – | Pagination cursor — pass the pageToken from a previous response to fetch the next (older) page when hasMore is true. |
| sort_type | string | – | Sort order (default: ByCreateTimeDesc = newest first) |
| start_time | string | – | Start timestamp in seconds (optional) |
| via_user | boolean | – | v1.3.12 — explicit identity override. `true` skips the bot path and reads directly via UAT (use when the chat is yours / external and you know bot has no access). `false` skips UAT fallback and surfa… |
No output schema declared.
No examples provided.
read_p2p_messages ~375
[User UAT] Read P2P (direct message) chat history using user_access_token. Works for chats the bot cannot access. Returns newest messages first by default. Auto-expands merge_forward messages into their child messages by default — disable with expand_merge_forward=false. Requires OAuth setup. **Sender semantics (v1.3.12)**: each message has a `displayLabel` (e.g. `周宇`, `[Bot] Claude聊天助手`, `[匿名]`, `[系统]`, `[已撤回] 怪兽`) — prefer it over raw `senderId` when narrating who-said-what. Also surfaced: `senderType` (user|app|anonymous), `senderIdType` (open_id|union_id|user_id), `senderTenantKey`, `isExternal` (cross-tenant), `isRecalled`, `isThreadReply` (parent_id present).
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Chat ID (numeric from create_p2p_chat, or oc_xxx from list_user_chats). Both formats work. |
| end_time | string | – | End timestamp in seconds (optional) |
| expand_merge_forward | boolean | – | Auto-expand merge_forward placeholders into their child messages (default true). Children carry parentMessageId; use that id (not the child id) with download_message_resource (kind=image or file). |
| page_size | number | – | Messages to fetch (default 20, max 50) |
| page_token | string | – | Pagination cursor — pass the pageToken from a previous response to fetch the next (older) page when hasMore is true. |
| sort_type | string | – | Sort order (default: ByCreateTimeDesc = newest first) |
| start_time | string | – | Start timestamp in seconds (optional) |
No output schema declared.
No examples provided.
reply_message ~64
[Official API] Reply to a specific message by message_id (as bot). Only works for text messages; other types return error 230054.
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Message ID to reply to (om_xxx) |
| text | string | yes | Reply text |
No output schema declared.
No examples provided.
respond_calendar_event ~83
[Official API + UAT, v1.3.7] Respond to an event invitation. The current identity must be in the event's attendee list. Requires `calendar:calendar.event:reply` scope.
| Name | Type | Req | Description |
|---|---|---|---|
| calendar_id | string | yes | Calendar ID |
| event_id | string | yes | Event ID |
| rsvp_status | string | yes | Your response |
No output schema declared.
No examples provided.
search_contacts ~37
[User Identity] Search Feishu users, bots, or group chats by name. Returns IDs.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Search keyword |
No output schema declared.
No examples provided.
search_docs ~119
[Official API] Search Feishu documents by keyword. UAT-first with app fallback: with user identity (UAT) the search covers docs visible to YOU, including your personal space; via bot it only covers docs shared with the bot. Response carries viaUser; when hasMore is true, pass the returned nextOffset back as offset to page forward.
| Name | Type | Req | Description |
|---|---|---|---|
| offset | number | – | Pagination offset from a previous nextOffset |
| page_size | number | – | Max results per page (default 10) |
| query | string | yes | Search keyword |
No output schema declared.
No examples provided.
search_messages ~407
[User UAT, v1.3.12] Search the user's IM history by keyword. Wraps Feishu `POST /open-apis/search/v2/message`. Requires UAT with the `search:message` scope (re-run `npx feishu-user-plugin oauth` after v1.3.12 SCOPES update). Feishu does NOT expose a bot-path search; if you only have app credentials this tool will error. Returns `{items, pageToken, hasMore}` where each item is a `{message_id, chat_id, ...}` pointer — call `read_messages(chat_id)` or `read_p2p_messages(chat_id)` to fetch the full message bodies if needed. The pointer-only return keeps the response token-light when searching across many chats. Filter knobs (all optional): - `chat_ids`: only search inside these chats (oc_xxx) - `from_ids`: messages sent by these users (ou_xxx / union_id) - `at_user_ids`: messages that @-mention these users - `message_types`: e.g. `["text", "post"]` - `from_types`: e.g. `["user", "anonymous"]`
| Name | Type | Req | Description |
|---|---|---|---|
| at_user_ids | array | – | Restrict to messages that @-mention these user ids |
| chat_ids | array | – | Restrict to these oc_xxx chats |
| from_ids | array | – | Restrict to messages from these user ids (ou_xxx / union_id) |
| from_types | array | – | Filter by sender types (e.g. ["user","anonymous"]) |
| message_types | array | – | Filter by message types (e.g. ["text","post","image","file","interactive"]) |
| page_size | number | – | Items per page (default 20, max 100) |
| page_token | string | – | Pagination cursor from a previous page |
| query | string | yes | Search keyword. Plain text; Feishu handles tokenization. |
No output schema declared.
No examples provided.
search_wiki ~116
[Official API] Search Wiki nodes by keyword. UAT-first with app fallback: with user identity (UAT) the search covers wiki spaces visible to YOU; via bot it only covers spaces the bot was invited to. Response carries viaUser; when hasMore is true, pass the returned nextOffset back as offset to page forward.
| Name | Type | Req | Description |
|---|---|---|---|
| offset | number | – | Pagination offset from a previous nextOffset |
| page_size | number | – | Max results per page (default 20) |
| query | string | yes | Search keyword |
No output schema declared.
No examples provided.
send_as_user ~220
[User Identity] Send a text message as the logged-in Feishu user. Supports reply threading and real @-mentions (triggers push notifications).
| Name | Type | Req | Description |
|---|---|---|---|
| ats | array | – | Optional @-mentions. Each entry: {userId: "ou_xxx", name: "DisplayName"}. The text must contain each @<name> marker in order — it gets spliced into a real AT element so the mentioned user receives a… |
| chat_id | string | yes | Target chat ID. Numeric (from create_p2p_chat / search) preferred; oc_xxx is auto-resolved via getChatInfo + cookie search since v1.3.7 (C1.4). |
| parent_id | string | – | Parent message ID (for nested reply, optional) |
| root_id | string | – | Thread root message ID (for reply, optional) |
| text | string | yes | Message text. If `ats` is provided, include the display marker for each @ in this text (default marker is `@<name>`). |
No output schema declared.
No examples provided.
send_card_as_user ~170
[v1.3.9+: bot-only] Send an interactive Feishu card to a chat via bot identity (Official API). User-identity cookie protobuf path is server-side disabled at the auth tier — confirmed by exhaustive brute-force in v1.3.9, see scripts/explore-card-protobuf.js. The "as_user" suffix is historical naming kept for backward compat; the tool always routes through bot. Pass `card` as a JSON object (Feishu card schema, see https://open.feishu.cn/cardkit).
| Name | Type | Req | Description |
|---|---|---|---|
| card | – | yes | Feishu card JSON. See https://open.feishu.cn/cardkit for the schema; build cards visually then paste the resulting JSON here. |
| chat_id | string | yes | Target chat_id (oc_xxx) or open_id |
No output schema declared.
No examples provided.
send_file_as_user ~103
[User Identity] Send a file as the logged-in user. Requires file_key (upload via Official API first).
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Target chat ID. Numeric preferred; oc_xxx is auto-resolved (v1.3.7 C1.4). |
| file_key | string | yes | File key from upload |
| file_name | string | yes | Display file name |
| root_id | string | – | Thread root message ID (optional) |
No output schema declared.
No examples provided.
send_image_as_user ~248
[User Identity, v1.3.9] Send an image as the logged-in user (NOT bot). Requires image_key from a prior upload_image call. Cookie-protobuf wire format requires both imageKey + thumbnailKey — when no separate thumbnail is provided, plugin defaults thumbnailKey to imageKey (Feishu accepts this for messenger-uploaded images). Width/height/mime/size are optional metadata; Feishu auto-derives display sizing on its side.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Target chat ID. Numeric preferred; oc_xxx is auto-resolved (v1.3.7 C1.4). |
| height | number | – | Optional image height in pixels. |
| image_key | string | yes | Image key from upload (img_v2_xxx or img_v3_xxx) |
| mime | string | – | Optional MIME type (e.g. "image/png"). |
| root_id | string | – | Thread root message ID (optional) |
| size | number | – | Optional file size in bytes. |
| thumbnail_key | string | – | Optional separate thumbnail image key. Defaults to image_key when omitted. |
| width | number | – | Optional image width in pixels. |
No output schema declared.
No examples provided.
send_message_as_bot ~171
[Official API] Send a message as the bot to any chat. Supports text, post, interactive, etc. This is the reliable path for @-mentions: include `<at user_id="ou_xxx">Name</at>` inline in text content and Feishu resolves it to a real @-notification.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Target chat_id (oc_xxx) or open_id |
| content | – | yes | Message content (string or object, auto-serialized). Plain text: {"text":"hello"}. Text with @-mention: {"text":"<at user_id=\"ou_xxx\">Alice</at> hi"} — the inline tag becomes a real @-notification. |
| msg_type | string | yes | Message type: text, post, image, interactive, etc. |
No output schema declared.
No examples provided.
send_post_as_user ~173
[User Identity] Send a rich text (POST) message with title and formatted paragraphs. Supports real @-mentions that trigger notifications.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Target chat ID. Numeric preferred; oc_xxx is auto-resolved (v1.3.7 C1.4). |
| paragraphs | array | yes | Array of paragraphs. Each paragraph is an array of elements: • {tag:"text",text:"..."} — plain text • {tag:"a",href:"https://...",text:"display"} — hyperlink • {tag:"at",userId:"ou_xxx",name:"Display… |
| root_id | string | – | Thread root message ID (optional) |
| title | string | – | Post title (optional) |
No output schema declared.
No examples provided.
send_to_group ~84
[User Identity] Search group by name → send text message. All in one step.
| Name | Type | Req | Description |
|---|---|---|---|
| ats | array | – | Optional @-mentions that trigger real notifications. Each entry: {userId, name}. Text must contain `@<name>` marker for each entry. |
| group_name | string | yes | Group chat name |
| text | string | yes | Message text |
No output schema declared.
No examples provided.
send_to_user ~97
[User Identity] Search user by name → create P2P chat → send text message. All in one step.
| Name | Type | Req | Description |
|---|---|---|---|
| ats | array | – | Optional @-mentions. Same format as send_as_user.ats: [{userId, name}]. Text must contain the `@<name>` marker for each entry. |
| text | string | yes | Message text |
| user_name | string | yes | Recipient name (Chinese or English) |
No output schema declared.
No examples provided.
switch_profile ~149
[Plugin v1.3.9] Switch the active identity profile. Atomically writes credentials.json::active; cached clients in this process are invalidated; cross-process MCPs (Codex / another Claude Code) auto-sync via dispatcher mtime check on next tool call (~10μs). To add a new profile, run `npx feishu-user-plugin setup --profile <name> --app-id ... --app-secret ... --cookie ...` then `npx feishu-user-plugin oauth --profile <name>` for UAT.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Profile name. Use "default" for the primary profile; other names come from credentials.json or LARK_PROFILES_JSON. |
No output schema declared.
No examples provided.
update_calendar_event ~239
[Official API + UAT, v1.3.7] Patch fields on an existing calendar event. Pass only the fields you want to change. Requires `calendar:calendar.event:update` scope.
| Name | Type | Req | Description |
|---|---|---|---|
| attendee_ability | string | – | – |
| calendar_id | string | yes | Calendar ID |
| description | string | – | New description (optional) |
| end_time | object | – | A time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events. |
| event_id | string | yes | Event ID |
| free_busy_status | string | – | – |
| location | object | – | New location object (optional) |
| need_notification | boolean | – | Whether to notify attendees of the update |
| recurrence | string | – | RRULE string |
| reminders | array | – | – |
| start_time | object | – | A time object: {timestamp:"<unix-seconds>", timezone?:"Asia/Shanghai"} OR {date:"YYYY-MM-DD"} for all-day events. |
| summary | string | – | New title (optional) |
| visibility | string | – | – |
No output schema declared.
No examples provided.
update_group ~56
[Official API] Update group chat name or description.
| Name | Type | Req | Description |
|---|---|---|---|
| chat_id | string | yes | Chat ID (oc_xxx) |
| description | string | – | New description (optional) |
| name | string | – | New group name (optional) |
No output schema declared.
No examples provided.
update_message ~122
[Official API] Edit a sent message (bot can only edit its own messages). Feishu supports edit only for `text` and `interactive` (card) messages — other types (post, image, file, etc.) are rejected by the API.
| Name | Type | Req | Description |
|---|---|---|---|
| content | – | yes | New content. For text: {"text":"updated text"}. For interactive: full card JSON. |
| message_id | string | yes | Message ID (om_xxx) |
| msg_type | string | yes | Message type: text or interactive. Other types are not editable per Feishu API. |
No output schema declared.
No examples provided.
update_task ~143
[Official API + UAT, v1.3.7] Patch a task. **update_fields** is required by Feishu — list which fields to update (e.g. ["summary","due","completed_at"]).
| Name | Type | Req | Description |
|---|---|---|---|
| task | object | yes | Field values. E.g. {summary:"new title", due:{timestamp:"1717939200000"}}. |
| task_guid | string | yes | Task GUID |
| update_fields | array | yes | Required. Names of fields to update. E.g. ["summary","description","due","completed_at","start","extra","repeat_rule"]. Feishu only patches fields listed here, ignoring other keys in `task`. |
No output schema declared.
No examples provided.
update_wiki_node ~82
[Official API] Rename a Wiki node (only `title` is updatable via the wiki API; the underlying resource content is edited via docx/bitable/sheet tools).
| Name | Type | Req | Description |
|---|---|---|---|
| node_token | string | yes | Wiki node token (wikcnXXX) |
| space_id | string | yes | Wiki space ID |
| title | string | yes | New title |
No output schema declared.
No examples provided.
upload_bitable_attachment ~141
[Official API] Upload a file as a Bitable attachment (drive/v1/medias/upload_all with parent_type=bitable_image or bitable_file). Returns file_token suitable for writing into a Bitable Attachment-type field via batch_create/update_bitable_records (the field value should be [{file_token}]).
| Name | Type | Req | Description |
|---|---|---|---|
| app_token | string | yes | Bitable app token (the bascn... or basc... id) |
| file_path | string | yes | Absolute path to the file on disk |
| kind | string | – | Whether the attachment is an image (bitable_image) or a generic file (bitable_file). Default: file. |
No output schema declared.
No examples provided.
upload_drive_file ~168
[Official API] Upload a file from disk to a Feishu Drive folder (drive/v1/files/upload_all, parent_type=explorer). Returns file_token + url. If wiki_space_id is provided, the uploaded file is then attached to that Wiki space via move_docs_to_wiki (obj_type=file). UAT-first with app fallback.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the file on disk |
| folder_token | string | yes | Destination folder token. Use list_files to find one, or pass the user "我的空间" root token. |
| wiki_parent_node_token | string | – | Optional. Parent node under which to attach in the Wiki space. |
| wiki_space_id | string | – | Optional. If set, also attach the uploaded file to this Wiki space. |
No output schema declared.
No examples provided.
upload_file ~79
[Official API] Upload a file to Feishu. Returns file_key for use with send_file_as_user.
| Name | Type | Req | Description |
|---|---|---|---|
| file_name | string | – | Display file name (optional, defaults to basename) |
| file_path | string | yes | Absolute path to the file on disk |
| file_type | string | – | File type (default: stream for generic files) |
No output schema declared.
No examples provided.
upload_image ~62
[Official API] Upload an image file to Feishu. Returns image_key for use with send_image_as_user.
| Name | Type | Req | Description |
|---|---|---|---|
| image_path | string | yes | Absolute path to the image file on disk |
| image_type | string | – | Image usage type (default: message) |
No output schema declared.
No examples provided.
What is the io.github.zhuzhen-team/feishu-user-plugin MCP server?
io.github.zhuzhen-team/feishu-user-plugin is an MCP server listed in the public MCP registry as io.github.zhuzhen-team/feishu-user-plugin. Feishu/Lark MCP server + CLI tool. 85 tools, 3 auth layers. Send as user via cookie+protobuf. This page covers its npm package (feishu-user-plugin).
Is the io.github.zhuzhen-team/feishu-user-plugin MCP server safe to use?
io.github.zhuzhen-team/feishu-user-plugin scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.zhuzhen-team/feishu-user-plugin MCP server expose?
io.github.zhuzhen-team/feishu-user-plugin exposes 85 tools: manage_bitable_app, manage_bitable_table, manage_bitable_field, manage_bitable_view, manage_bitable_record, and 80 more. Their descriptions and schemas cost roughly 12,575 tokens of context every time the server is loaded.
Is the io.github.zhuzhen-team/feishu-user-plugin MCP server still maintained?
io.github.zhuzhen-team/feishu-user-plugin is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.zhuzhen-team/feishu-user-plugin MCP server under?
io.github.zhuzhen-team/feishu-user-plugin declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.