【実測】freee公式MCPは `FREEE_SCOPE=read` では読み取り専用にならない──AIに会計の「書き込み」を許す前の線引きTesting reveals that freee's official MCP server does not enforce read-only…

The Model Context Protocol (MCP) has made it practical to wire AI assistants directly into sensitive business systems, and accounting data is now squarely part of that trend. In Japan, freee has shipped an official MCP server that lets users interrogate their books in natural language. But hands-on testing has surfaced an important caveat: setting the environment variable FREEE_SCOPE=read does not, by itself, make the server read-only. Write-capable tools remain exposed to the connected model, which means developers should not treat that single setting as a hard safety boundary before letting an AI touch their accounting records.

The appeal of this integration is easy to understand. Asking an assistant "what were last month's sales?" is a low-risk, high-value query that few people would object to. The calculus changes when the same assistant is told to "go ahead and create that invoice." During 2026, the plumbing that bridges that gap moved quickly from experiment toward production use. freee's release positions it alongside a broader wave in which accounting platforms, in Japan and overseas, are exposing their APIs to large language models through MCP.

To understand the finding, it helps to know how MCP works. An MCP server advertises a set of "tools" that a connected model may invoke, and each tool usually maps to an underlying API operation—retrieving a ledger, listing invoices, or creating a transaction. In principle, a scope such as read should limit the exposed tools to those that only retrieve data. The reported testing indicates that freee's server continues to register and expose write tools even when FREEE_SCOPE=read is configured. In other words, the model can still "see" and attempt to call operations that modify data, regardless of what the variable name implies.

Why does that gap appear? The likely explanation is that the environment variable governs which OAuth scope the server requests when it authenticates, rather than filtering the list of tools handed to the model. freee's public API uses OAuth-based scopes, so practical enforcement of read-only behavior is likely to depend on the permissions actually granted to the access token, not on a client-side environment flag. If a token carries write permission, a write tool call may still succeed even when the server was started with a read setting. This is a distinction between what the interface presents and what the backend ultimately authorizes, and it appears to be the crux of the issue.

The security implications are worth taking seriously. A model that can see write tools may call one—either through a genuine misinterpretation of a user's request or through prompt injection, where malicious text hidden in a document or email nudges the assistant into taking an unintended