FreeAgent MCP Server (WavingCatApps/freeagent-mcp-vercel) is an MCP server listed on the M8ven Trust Index. It scores 72 out of 100, grade C. It declares 50 tools. No publisher has claimed this listing.

C
Caution
72/100

FreeAgent MCP Server

A Model Context Protocol server for the FreeAgent accounting API, enabling LLMs to manage contacts, invoices, estimates, bills, expenses, timeslips, projects, tasks, bank accounts, and more.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

WavingCatApps

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
4 flows detected: FREEAGENT_CLIENT_SECRET. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: FREEAGENT_ACCESS_TOKEN, FREEAGENT_CLIENT_SECRET, JWT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes50 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

freeagent_list_contacts

List all contacts in your FreeAgent account with pagination support.

freeagent_get_contact

Retrieve detailed information about a specific contact by ID.

freeagent_create_contact

Create a new contact in FreeAgent.

freeagent_list_invoices

List invoices in your FreeAgent account with filtering and pagination.

freeagent_get_invoice

Retrieve detailed information about a specific invoice.

freeagent_create_invoice

Create a new invoice in FreeAgent.

freeagent_transition_invoice

Move a FreeAgent invoice between lifecycle states: mark as sent, cancelled, draft, scheduled, or convert to a credit note. Use after freeagent_invoice_from_timeslips or freeagent_create_invoice to take a draft through to sent.

freeagent_list_estimates

List estimates (quotes) with filtering and pagination.

freeagent_get_estimate

Retrieve detailed information about a specific estimate by ID.

freeagent_create_estimate

Draft a new estimate (quote) for a contact.

freeagent_transition_estimate

Move an estimate through its lifecycle: mark as sent, approved, rejected, cancelled, back to draft, or convert to an invoice.

freeagent_list_recurring_invoices

List recurring invoice templates with filtering and pagination.

freeagent_get_recurring_invoice

Retrieve a specific recurring invoice template by ID.

freeagent_list_price_list_items

List price list (catalog) items available to use as invoice/estimate line items.

freeagent_get_price_list_item

Retrieve a specific price list item by ID.

freeagent_create_price_list_item

Create a new catalog item that can be reused on invoices and estimates.

freeagent_invoice_from_timeslips

Draft an invoice from a contact's unbilled timeslips in one call. Resolves the contact by name/ID/URL, finds active projects, collects unbilled timeslips in the given date range (defaults: first day of previous month → today), groups by task using the task or project billing rate, and posts a draft

freeagent_list_expenses

List expenses in your FreeAgent account with filtering and pagination.

freeagent_get_expense

Retrieve detailed information about a specific expense by ID.

freeagent_create_expense

Create a new expense in FreeAgent, including regular expenses or mileage claims.

freeagent_update_expense

Update an existing expense in FreeAgent. Only provide the fields you want to change.

freeagent_list_bills

List supplier bills with filtering and pagination.

freeagent_get_bill

Retrieve detailed information about a specific supplier bill by ID.

freeagent_create_bill

Create a new supplier bill in FreeAgent. Used to record money owed to suppliers.

freeagent_log_expense

Log a regular expense in one call. Takes a POSITIVE amount plus `kind` ('expense' or 'refund') — the tool applies the correct sign, so you never send a negative value. Accepts a category name, nominal code, or URL; accepts a user email, ID, or URL (defaults to the sole user on the account). Use free

freeagent_list_timeslips

List timeslips in your FreeAgent account with filtering and pagination.

freeagent_get_timeslip

Retrieve detailed information about a specific timeslip by ID.

freeagent_create_timeslip

Create a new timeslip (time tracking entry) in FreeAgent.

freeagent_update_timeslip

Update an existing timeslip. Supports setting `billed_on_invoice` to link the timeslip to an invoice, though FreeAgent may reject external writes to that field.

freeagent_list_bank_accounts

List all bank accounts in your FreeAgent account.

freeagent_get_bank_account

Retrieve detailed information about a specific bank account by ID.

freeagent_list_bank_transactions

List bank transactions for a specific bank account with pagination and filtering.

freeagent_get_bank_transaction

Get detailed information about a specific bank transaction including amount, description, and explanation status.

freeagent_list_bank_transaction_explanations

List bank transaction explanations showing how transactions were categorized or linked to invoices, bills, or transfers.

freeagent_get_bank_transaction_explanation

Get detailed information about a specific bank transaction explanation including categorization, tax info, and linked entities.

freeagent_create_bank_transaction_explanation

Create an explanation for a bank transaction by linking it to invoices, bills, or categories.

freeagent_update_bank_transaction_explanation

Update an existing bank transaction explanation. Only provide the fields you want to change.

freeagent_reconcile_bank_transaction

Explain a bank transaction in one call. Accepts a human-friendly hint (category name like 'Travel', nominal code like '285', or invoice reference like 'INV-001') and resolves it to the correct FreeAgent URL server-side. Auto-fills date and amount from the transaction, so you do not need to call get_

freeagent_list_projects

List all projects in your FreeAgent account with filtering and pagination.

freeagent_get_project

Retrieve detailed information about a specific project by ID.

freeagent_create_project

Create a new project in FreeAgent.

freeagent_list_tasks

List tasks in your FreeAgent account with filtering and pagination.

freeagent_get_task

Retrieve detailed information about a specific task by ID.

freeagent_create_task

Create a new task within a project in FreeAgent.

freeagent_list_categories

List all categories in your FreeAgent account for expenses, invoices, and transactions.

freeagent_get_category

Retrieve detailed information about a specific category by nominal code.

freeagent_get_company

Retrieve information about your FreeAgent company account.

freeagent_list_users

List all users in your FreeAgent account.

freeagent_search_tools

Search the FreeAgent tool catalog and return JSONSchema definitions for matching tools. Use this to discover which tool to call before invoking freeagent_call_tool. Supports 'select:name1,name2' for direct name lookup, '+required optional' to require specific keywords, or plain keywords for a ranked

freeagent_call_tool

Invoke a FreeAgent catalog tool by name with the given arguments. Pair with freeagent_search_tools to discover tool names and input schemas — this meta-tool validates arguments against the target tool's Zod schema before dispatching.

// known CVEs in dependencies2 high1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.15.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.15.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

mediumaxios@1.15.0GHSA-42h9-826w-cgv3

Axios: Excessive recursion in formDataToJSON can cause denial of service

lowaxios@1.15.0GHSA-3w6x-2g7m-8v23

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

unknownaxios@1.15.0GHSA-445q-vr5w-6q77
Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configBASE_URL
🔐 secretFREEAGENT_ACCESS_TOKENexport ="your_access_token"
configFREEAGENT_CLIENT_IDRequired env vars: , FREEAGENT_CLIENT_SECRET, JWT_SECRET (stable secret required on Vercel so OAuth JWTs verify across serverless instances)
🔐 secretFREEAGENT_CLIENT_SECRETRequired env vars: FREEAGENT_CLIENT_ID, , JWT_SECRET (stable secret required on Vercel so OAuth JWTs verify across serverless instances)
configFREEAGENT_TOOL_SEARCHexport =true
configFREEAGENT_USE_SANDBOXexport ="true" # optional
🔐 secretJWT_SECRETRequired env vars: FREEAGENT_CLIENT_ID, FREEAGENT_CLIENT_SECRET, (stable secret required on Vercel so OAuth JWTs verify across serverless instances)
configMCP_REFRESH_TOKEN_EXPIRY
configMCP_TOKEN_EXPIRY_SECONDS
configPRODUCTION_URLSet (or rely on VERCEL_PROJECT_PRODUCTION_URL) for stable production OAuth callback URLs. Preview OAuth uses the request host (or VERCEL_URL) so short per-deploy hosts match FreeAgent wildcards.
configVERCEL
// quality suggestions

Tool test coverage

Only 9/50 tools referenced in tests (18%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

3 secret values sent to console.log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 2 high severity in production deps — axios@1.15.0 (high), axios@1.15.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/wavingcatapps/freeagent-mcp-vercel?variant=verified)](https://m8ven.ai/mcp/wavingcatapps/freeagent-mcp-vercel)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 1b7389e0e1c34307dad046416853ca172a456e34
code hash: e43f7d8d15126ac3e4c094e7f76d6d90cdd0bd265546d1905b55c380794e94fb
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client