Back to search
100
MCP live MCP 2025-11-25 streamable-http

io.github.michal-lefler/secure-flows

io.github.michal-lefler/secureflows-mcp-server

MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp.

Watch this dependency Share evidence report
Uptime
100.0%
5 direct probes · 30d
Response
1243ms
last probe
Tools
18
callable
Resources
0
readable
Prompts
1
available
Primary URL
https://www.secure-flows.com/mcp?alias=secure-flows
Score: 100/100
Handshake verified by our own probe.
pass Answers the MCP handshake 50/50
The handshake and the list calls succeeded on the primary URL.
pass Lists tools, resources or prompts 30/30
18 tools, 0 resources, 1 prompts returned.
pass 3 or more catalogue items 10/10
19 items in total; 3 or more earns these points.
pass Describes itself 10/10
96 characters; more than 30 earns these points.

Tools · 18

get_sessions

Returns the decrypted session payload for the authenticated internal session token. Response shape is a **flat JSON object**. Empty payload returns `{}`. Source: GET /api/v1/sessions Requires `auth.…

post_sessions

Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized **`payload`** (defaults to `{}` when omitted), and returns **`sessionToken`** (JWT; subject = internal sess…

get_sessions_identity

Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this pers…

post_sessions_get_or_create

Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching…

post_sessions_renew_session_token

Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the se…

post_sessions_set_key

Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores `<x>` directly. Source: POST /api/v1/se…

get_sessions_get_key

Retrieves the decrypted payload value for `key`. **Important:** `404` means the key was never written (normal first-use case). Do not treat as an error. Source: GET /api/v1/sessions/get/{key} Requir…

delete_sessions_delete_key

Removes `key` from the session payload and returns `true` if the key existed. Source: DELETE /api/v1/sessions/delete/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer conne…

post_sessions_revoke

Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user …

auth_session_callback

**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlis…

get_auth_logout

Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-par…

post_auth_logout

Logs out the current session **without revoking** it. **Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com` is not a reliable way to clear hosted-lo…

get_sessions_my

Returns a page of sessions for the current user within the current workspace. Self-service dashboard endpoint — requires workspace **`enableSelfService: true`**. Payload is included only for rows whos…

post_sessions_revoke_session_id

Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. The session ends and its stored data is destroyed permanently; this is not sign-out. Requires workspace…

get_docs_search

Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks from the environment's search index (pgvector). Source: GET /api/v1/docs/search No Authorization header is …

secureflows_build_login_url

Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phase most secureFlows integration mistakes …

secureflows_build_logout_url

Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns: a redirect_uri pointing at /callback (SPA callback handlers treat the tokenless ret…

secureflows_lint_integration

Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are …

Prompts · 1

security-review

Read-only review of how this project manages user accounts: lists the security gaps, grades each against secureFlows (Yes / Partly / No / Unconfirmed), and writes a migration plan. Saves two Markdown …

How to use

Claude Desktop or claude.ai: add a custom connector (Customize → Connectors; on Team and Enterprise plans an owner adds it under Organization settings → Connectors) with this server URL: https://www.secure-flows.com/mcp?alias=secure-flows

Cursor or Cline: add to your MCP config:

{
  "mcpServers": {
    "io.github.michal-lefler/secure-flows": {
      "url": "https://www.secure-flows.com/mcp?alias=secure-flows",
      "transport": "streamable-http"
    }
  }
}