Front MCP

io.github.wearehoust由 GitHub 帳號 wearehoust 發布v1.0.1更新於 Oct 24, 2026

MCP server for Front: conversations, contacts, messages, tags, and inbox workflows.

已驗證STDIO僅桌面效率與工作流溝通與協作商業與電商

概覽

AI 產生的概覽

讓助理透過 26 個工具、172 個動作處理 Front 的客戶對話、聯絡人、訊息、標籤與收件匣工作流程。

可以做什麼
將 MCP 用戶端連接到 Front API，讓助理可以搜尋與讀取對話、檢視訊息、列出並管理聯絡人、標籤、收件匣、團隊成員與知識庫，並建立草稿或發送回覆。動作依工具分組，例如 conversations、contacts、messages、tags、drafts 與 analytics。政策引擎會把每個動作分類為讀取、寫入或破壞性：寫入動作需要兩步驟確認，破壞性動作預設會被拒絕。
適用情境
適合已使用 Front 共用收件匣與客服流程的團隊，希望助理不必離開聊天用戶端就能查找對話、摘要討論串、管理聯絡人與標籤，或草擬回覆。它面向客服與營運工作流程，而非一般網頁或檔案任務。
執行需求
透過 npm 套件 @houst-com/front-mcp 以 stdio 在本機執行，需要 Node.js 與 npx。需要 Front 帳號，可用 FRONT_API_TOKEN 的 API 權杖驗證，或以 FRONT_MCP_AUTH_METHOD 與 FRONT_MCP_OAUTH_SECRET 走 OAuth，並在 Front 中設定 OAuth 應用程式與重新導向 URI。Front 權限（Read、Write、Delete、Send）必須與使用的動作相符。僅支援桌面端，沒有 HTTP 或 SSE 傳輸。
安裝前請注意
此伺服器持有可存取真實客戶對話的憑證：FRONT_API_TOKEN 或 FRONT_MCP_OAUTH_SECRET，權杖以加密方式儲存在本機。寫入動作會建立、更新、指派或發送訊息，需要確認；刪除、移除等破壞性動作預設被拒絕，但可透過自訂政策檔案放行。發送回覆與匯入訊息會作用於真實的 Front 資料，對話內容會傳給模型供應商。此版本不支援附件。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Front MCP，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Front MCP

[CI] [npm] [License: MIT] [Node] [TypeScript] [MCP] [Front API]

Use Front from MCP clients that support local stdio servers. Search conversations, manage contacts, send messages, tag, assign, and automate inbox workflows — 26 tools, 172 actions.

Quick Start

  1. Get a Front API token from Settings > Developers > API tokens.

  2. Add this server to the top-level mcpServers object in your Claude Code user configuration (~/.claude.json), preserving any existing settings and servers. For a shared project configuration, use .mcp.json instead. See Claude Code's MCP configuration guide.

json
{  "mcpServers": {    "front": {      "command": "npx",      "args": ["-y", "@houst-com/front-mcp"],      "env": {        "FRONT_API_TOKEN": "your-front-api-token"      }    }  }}
  1. Start Claude Code. The Front tools are now available.

Node.js 20 or newer is required. The server runs locally using your own Front credentials; no Houst-hosted service is required. Keep API tokens out of version control; shared .mcp.json files should use "FRONT_API_TOKEN": "${FRONT_API_TOKEN}" and set that variable in the environment that launches Claude Code.

Example Workflows

Search for a conversation:

"Search Front conversations about billing issues"

Inspect a thread:

"Get the messages in conversation cnv_abc123"

Manage contacts:

"List contacts and find the one with email [email protected]"

Tag and assign:

"Tag conversation cnv_abc123 with 'urgent' and assign it to teammate tea_xyz"

Draft a reply:

"Create a draft reply to conversation cnv_abc123 saying we'll follow up tomorrow"

OAuth Setup (Recommended)

OAuth provides automatic token refresh and better security than API tokens.

  1. Create a Front app at Settings > Developers > OAuth apps.
  2. Set the redirect URI to https://localhost:9876/callback.
  3. Enable the resource permissions your MCP server needs (Read, Write, Delete, Send).
  4. Save the app — copy the Client ID from the OAuth feature (not the App secret from Settings).
  5. Create ~/.front-mcp/config.json:
json
{  "auth": {    "method": "oauth",    "oauth": {      "client_id": "your-client-id",      "client_secret_env": "FRONT_MCP_OAUTH_SECRET",      "redirect_port": 9876,      "scopes": []    }  }}
  1. Configure Claude Code:
json
{  "mcpServers": {    "front": {      "command": "npx",      "args": ["-y", "@houst-com/front-mcp"],      "env": {        "FRONT_MCP_AUTH_METHOD": "oauth",        "FRONT_MCP_OAUTH_SECRET": "your-oauth-client-secret"      }    }  }}
  1. Run npx @houst-com/front-mcp auth to authenticate (opens browser).
  2. Tokens are encrypted and stored locally (AES-256-GCM, 0600 permissions).

Auth CLI

bash
front-mcp auth            # Start OAuth flowfront-mcp auth --status   # Check auth state (no token values shown)front-mcp auth --clear    # Remove stored tokensfront-mcp --version       # Show versionfront-mcp --help          # Show usage

Front Permissions

The MCP server needs Front API permissions matching the actions you want to use:

PermissionRequired for
ReadAll list/get/search actions
Writecreate, update, assign, add, merge, reply
Deletedelete, remove actions
Sendmessages.create, messages.reply

For OAuth, configure these in your Front app under Features > OAuth > Resource permissions. For API tokens, permissions are set when creating the token.

Tools Reference

ToolActions
accountslist, get, create, update, delete, list_contacts, add_contact, remove_contact
analyticscreate_export, get_export, create_report, get_report
channelslist, get, update, validate, create, list_for_teammate, list_for_team
commentslist, get, create, update, list_mentions, reply
contact_groupslist, create, delete, list_contacts, add_contacts, remove_contacts
contact_listslist, create, delete, list_contacts, add_contacts, remove_contacts
contact_noteslist, create
contactslist, get, create, update, delete, merge, list_conversations, add_handle, remove_handle
conversationslist, get, search, create, update, delete, assign, list_events, list_followers, add_followers, remove_followers, list_inboxes, add_link, remove_links, list_messages, update_reminders, add_tag, remove_tag
custom_fieldslist_for_accounts, list_for_contacts, list_for_conversations, list_for_inboxes, list_for_links, list_for_teammates
draftslist, create, create_reply, update, delete
eventslist, get
inboxeslist, get, create, list_channels, list_conversations, list_access, grant_access, revoke_access
knowledge_baseslist, get, create, update, list_categories, list_articles, get_article, create_article, update_article, delete_article, get_category, create_category, update_category, delete_category
linkslist, get, create, update, list_conversations
message_template_folderslist, get, create, update, delete, list_children, create_child
message_templateslist, get, create, update, delete
messagesget, create, reply, import, receive_custom, get_seen_status, mark_seen
ruleslist, get, list_for_teammate, list_for_team
shiftslist, get, create, update, list_teammates, add_teammates, remove_teammates
signatureslist, get, update, delete, create_for_teammate, create_for_team
tagslist, get, create, update, delete, list_children, create_child, list_conversations
teammate_groupslist, get, create, update, delete, list_inboxes, add_inboxes, remove_inboxes, list_teammates, add_teammates, remove_teammates, list_teams, add_teams, remove_teams
teammateslist, get, update, list_conversations, list_inboxes
teamslist, get, add_teammates, remove_teammates
token_identityget

See docs/TOOL_REFERENCE.md for the complete reference with policy tiers per action.

Policy Engine

Every action is classified into a tier with a default decision:

TierDefaultExamples
readallowlist, get, search
writeconfirmcreate, update, assign
destructivedenydelete, remove

Write actions require a two-step confirmation: the first call returns a prompt, the second call with confirm: true executes. Destructive actions are denied by default.

Custom Policy

Create ~/.front-mcp/policy.json:

json
{  "defaults": {    "read": "allow",    "write": "allow",    "destructive": "confirm"  },  "overrides": [    { "tool": "conversations", "action": "delete", "decision": "deny" },    { "tool": "tags", "action": "*", "decision": "allow" }  ]}

Override precedence: specific action > tool wildcard > tier default.

Security Model

  • HTTPS enforced — no HTTP fallback, ever
  • Token encryption — AES-256-GCM with PBKDF2 key derivation
  • File permissions — token file is 0600 (owner read/write only)
  • Output sanitization — configurable field redaction before LLM sees data
  • Log redaction — sensitive fields redacted from all log output
  • Policy engine — destructive actions denied by default, write actions require confirmation
  • No secrets in stdout — stdout is reserved for MCP protocol only
  • Minimal dependencies — native fetch, Node.js crypto, pinned exact versions

Environment Variables

VariableRequiredDescription
FRONT_API_TOKENYes (unless OAuth)Front API token
FRONT_MCP_AUTH_METHODNooauth or api_token (default: api_token)
FRONT_MCP_OAUTH_SECRETYes (if OAuth)OAuth client secret
FRONT_MCP_LOG_LEVELNoerror, warn, info, debug (default: info)
FRONT_MCP_POLICY_FILENoPath to custom policy JSON file

Limitations

  • stdio transport only — no HTTP/SSE transport in v1 (planned for future)
  • Single Front account — one account per server instance
  • No webhook support — outbound API calls only, no inbound event processing
  • No caching — every request hits the Front API (relies on Front's freshness)
  • Attachments — file upload/download not supported in v1
  • Application channels — channel-specific message sync endpoints not supported

Development

bash
git clone https://github.com/wearehoust/front-mcp.gitcd front-mcpnpm installnpm test          # 519 testsnpm run lint      # ESLint strictnpm run type-check # TypeScript strictnpm run build     # Compile to dist/

Testing

bash
npm test              # Unit + integration testsnpm run test:watch    # Watch modenpm run test:coverage # Coverage reportnpm run smoke         # Smoke test (builds, starts, verifies 26 tools)

The project includes 519 unit/integration tests and a 172-action live API test script (scripts/live-test-full.js).

Release Process

  1. Update package.json and package-lock.json with npm version X.Y.Z --no-git-tag-version. Update both version fields in server.json, the server version in src/server.ts, and CHANGELOG.md.
  2. Confirm npm trusted publishing is configured for wearehoust/front-mcp and the release.yml workflow. The release workflow uses GitHub OIDC for npm and the MCP Registry.
  3. Run npm ci, lint, type-check, tests, build, and smoke. Check the packed npm artifact and its MCP handshake version.
  4. Commit as chore: release vX.Y.Z, open a PR, and merge after CI and review pass.
  5. Fetch main and create an annotated vX.Y.Z tag on the verified release commit. Push only that tag with git push origin refs/tags/vX.Y.Z.
  6. GitHub Actions verifies version metadata, runs the checks, publishes the npm package, and then publishes server.json to the MCP Registry in a separate job. Registration retries briefly when the registry cannot yet see the new npm version.
  7. Verify both registries report the new version and smoke-test the published npm package.

If npm publication succeeds but registry registration fails, use Re-run failed jobs to retry only the registry job. For recovery of an older release (including workflows that used a single publish job), open Actions → Release → Run workflow on main and enter the existing tag, such as v1.1.1. This manual action only registers the tagged server.json; it never republishes npm or changes the tag. The recovery workflow must first be merged into main.

Security

See SECURITY.md for vulnerability reporting.

Contributing

See CONTRIBUTING.md for setup, code standards, and PR process.

License

MIT

來源：README.md，提交 0151928

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v1.0.1最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分