Koskamo

secure-flows MCP

An MCP server for secureFlows that provides authentication and AI agent capabilities. It serves as a registry listing pointer to the canonical secureflows-mcp server, allowing agents to connect via the secure-flows.com domain endpoint.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

secure-flows MCP logo, by michal-leflerCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-06Published by michal-lefler
MCP endpoint (Streamable HTTP)
https://www.secure-flows.com/mcp?alias=secure-flows
Vendor documentation

What its tools do

18 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Not annotated (18)

18 of 18 have a description · 0 of 18 declare behavior hints · 3 of 18 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

  • Passed Endpoint answered the live check ·
  • Availability 1 of 1 checks passed in 30 days

What you can do with it

  • Enable AI agents with authentication
  • Connect to secureFlows services
  • Support vibe-coding workflows

Source and maintenance

Community listingRegistry 0.2.0
mcp-registry: io.github.michal-lefler/secure-flows@0.2.0Source repositoryProject website
Maintenance checked

Protocol and capabilities

Server
secureflows 0.2.0
MCP protocol negotiated in check
2025-11-25
Tools
18 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
1 advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": true
  },
  "logging": {},
  "prompts": {
    "listChanged": true
  }
}

Tools

18 advertised

get_sessions — Get the current session payload
Advertised by the server during the last successful anonymous check.

Returns the decrypted session payload for the authenticated internal session token. Response shape is a **flat JSON object**. Empty payload returns `{}`. Source: GET /api/v1/sessions Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

get_sessions input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "secureFlows session token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
post_sessions — Create a new session
Advertised by the server during the last successful anonymous check.

Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized **`payload`** (defaults to `{}` when omitted), and returns **`sessionToken`** (JWT; subject = internal session id). Default server-side TTL is **1 hour** (implementation detail). If the Firebase token includes **`email`**, the server best-effort persists it on the workspace end-user row (for audit display). Prefer **`POST /sessions/get-or-create`** for hosted-login-style flows that should reuse an active session. Source: POST /api/v1/sessions Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

post_sessions input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "body"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "firebaseToken"
      ],
      "properties": {
        "firebaseToken": {
          "type": "string",
          "description": "Firebase ID token"
        }
      }
    },
    "body": {
      "type": "object",
      "required": [
        "workspaceName"
      ],
      "properties": {
        "app_id": {
          "anyOf": [
            {
              "type": "string",
              "description": "Optional app id (must belong to the workspace). Used for per-app session policy and auditing."
            },
            {
              "type": "null"
            }
          ]
        },
        "payload": {
          "type": "object",
          "description": "Arbitrary payload object stored in the session. Optional; omitted or null is stored as `{}`.",
          "propertyNames": {
            "type": "string"
          },
          "additionalProperties": {}
        },
        "workspaceName": {
          "type": "string",
          "description": "Workspace name to scope the session"
        }
      }
    },
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
get_sessions_identity — Get signed-in user's stable id and email (app UI, backend correlation)
Advertised by the server during the last successful anonymous check.

Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key when your own backend needs to link an external event (e.g. a billing provider webhook you receive and verify yourself) back to this user. Do not use the session token or session id for this — sessions expire and rotate, `userId` does not. Email is best-effort from hosted login (Firebase `email` claim persisted on the user row). When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (≥ 0.1.15 for `userId`). Source: GET /api/v1/sessions/identity Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

get_sessions_identity input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "secureFlows session token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
post_sessions_get_or_create — Reuse active session or create one
Advertised by the server during the last successful anonymous check.

Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload. Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL). If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (including when reusing an existing session). Intended for integrators that mirror hosted login session reuse. Source: POST /api/v1/sessions/get-or-create Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

post_sessions_get_or_create input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "body"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "firebaseToken"
      ],
      "properties": {
        "firebaseToken": {
          "type": "string",
          "description": "Firebase ID token"
        }
      }
    },
    "body": {
      "type": "object",
      "required": [
        "workspaceName"
      ],
      "properties": {
        "app_id": {
          "anyOf": [
            {
              "type": "string",
              "description": "Optional app id (must belong to the workspace). Used for per-app session policy and auditing."
            },
            {
              "type": "null"
            }
          ]
        },
        "payload": {
          "type": "object",
          "description": "Arbitrary payload object stored in the session. Optional; omitted or null is stored as `{}`.",
          "propertyNames": {
            "type": "string"
          },
          "additionalProperties": {}
        },
        "workspaceName": {
          "type": "string",
          "description": "Workspace name to scope the session"
        }
      }
    },
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
post_sessions_renew_session_token — Renew session JWT (replace expired token)
Advertised by the server during the last successful anonymous check.

Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id, older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`. Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted **payload**; extends server-side session expiry by **1 hour**. If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner when the user row has no email yet (audit display only). Use the path form `POST /api/v1/sessions/renew/{sessionToken}` — **URL-encode** the JWT (e.g. `encodeURIComponent` in JS). Source: POST /api/v1/sessions/renew/{sessionToken} Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

post_sessions_renew_session_token input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "params"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "firebaseToken"
      ],
      "properties": {
        "firebaseToken": {
          "type": "string",
          "description": "Firebase ID token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "Previous SESSION JWT (may be expired); URL-encoded in the path"
        }
      }
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
post_sessions_set_key — Set a value inside the session payload
Advertised by the server during the last successful anonymous check.

Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores `<x>` directly. Source: POST /api/v1/sessions/set/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

post_sessions_set_key input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "params",
    "body"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "secureFlows session token"
        }
      }
    },
    "body": {
      "anyOf": [
        {
          "type": "object",
          "required": [
            "value"
          ],
          "properties": {
            "value": {}
          }
        },
        {
          "type": "string"
        },
        {
          "type": "number"
        },
        {
          "type": "integer",
          "maximum": 9007199254740991,
          "minimum": -9007199254740991
        },
        {
          "type": "boolean"
        },
        {
          "type": "array",
          "items": {}
        },
        {
          "type": "object",
          "propertyNames": {
            "type": "string"
          },
          "additionalProperties": {}
        },
        {}
      ],
      "description": "JSON body can be either `{ \"value\": <x> }` (preferred) or a raw JSON value.\n"
    },
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "required": [
        "key"
      ],
      "properties": {
        "key": {
          "type": "string",
          "description": "Payload key to set"
        }
      }
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
get_sessions_get_key — Get a single value from the session payload
Advertised by the server during the last successful anonymous check.

Retrieves the decrypted payload value for `key`. **Important:** `404` means the key was never written (normal first-use case). Do not treat as an error. Source: GET /api/v1/sessions/get/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

get_sessions_get_key input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "params"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "secureFlows session token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "required": [
        "key"
      ],
      "properties": {
        "key": {
          "type": "string",
          "description": "Payload key to read"
        }
      }
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
delete_sessions_delete_key — Delete a key from the session payload
Advertised by the server during the last successful anonymous check.

Removes `key` from the session payload and returns `true` if the key existed. Source: DELETE /api/v1/sessions/delete/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

delete_sessions_delete_key input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "params"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "secureFlows session token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "required": [
        "key"
      ],
      "properties": {
        "key": {
          "type": "string",
          "description": "Payload key to delete"
        }
      }
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
post_sessions_revoke — Revoke the current session and destroy its data (by session token) - not sign-out
Advertised by the server during the last successful anonymous check.

Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user out and keep their data, use POST /api/v1/auth/logout (or, in a browser, the redirect helper GET /api/v1/auth/logout). Call revoke only when the user or an admin deliberately wants the session and its data deleted, for example on account deletion. Source: POST /api/v1/sessions/revoke Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

post_sessions_revoke input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "secureFlows session token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
auth_session_callback — Session login callback (redirect)
Advertised by the server during the last successful anonymous check.

**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional **`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** — ignored when reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired), **renews** that session; **`payload`** must **not** be sent on the same request. Optional **`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60–604800**). When the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (audit display only). 4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`** and, if provided, **`state`**. If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not** redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON **`{"status", "error"}`** body and do **not** redirect. Source: GET /api/v1/auth/callback No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

auth_session_callback input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "query"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "properties": {}
    },
    "body": {},
    "query": {
      "type": "object",
      "required": [
        "firebaseToken",
        "client_redirect_uri",
        "workspace_name",
        "app_id"
      ],
      "properties": {
        "state": {
          "type": "string"
        },
        "app_id": {
          "type": "string"
        },
        "payload": {
          "type": "string",
          "description": "JSON object as a string (e.g. `{\"a\":1}`), URL-encoded. Must parse to a JSON object (not an array or primitive).\nDefault when omitted is `{}`. Must not be combined with `session_token` on the same request.\n"
        },
        "ttl_seconds": {
          "type": "integer",
          "maximum": 604800,
          "minimum": 0,
          "description": "Session lifetime in seconds (default 0 = unlimited; allowed values: 0 or 60–604800)"
        },
        "firebaseToken": {
          "type": "string"
        },
        "session_token": {
          "type": "string",
          "description": "Previous session JWT (may be expired); signature must validate. When present, the server renews this\nsession instead of creating a new one. Must not be combined with `payload` on the same request.\nURL-encode the value; very long URLs may exceed browser or proxy limits.\n"
        },
        "workspace_name": {
          "type": "string"
        },
        "client_redirect_uri": {
          "type": "string",
          "format": "uri"
        }
      }
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
get_auth_logout — Log out (browser redirect helper; first-party cookie clearing)
Advertised by the server during the last successful anonymous check.

Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when third-party cookies are blocked. **Critical client rules:** - Clear your in-app `sessionToken` state **before** navigating. - **Never** include `session_token` inside `redirect_uri` (that would silently renew and defeat logout). This endpoint (best-effort / idempotent for browser UX): - Invalidates the provided `session_token` by incrementing `tokenRevision` when the token still matches an **active** session (no new token is issued). - If the session is already expired/revoked or the revision was superseded by renew, still completes logout UX (does **not** return 401 solely for that reason). - Revokes Firebase refresh tokens for the session’s stored Firebase UID when known. - Sets `Clear-Site-Data: "cookies"`. - Redirects the browser to `redirect_uri`. Source: GET /api/v1/auth/logout No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

get_auth_logout input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "query"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "properties": {}
    },
    "body": {},
    "query": {
      "type": "object",
      "required": [
        "session_token",
        "redirect_uri"
      ],
      "properties": {
        "redirect_uri": {
          "type": "string",
          "format": "uri",
          "description": "Where to redirect after logout completes"
        },
        "session_token": {
          "type": "string",
          "description": "SESSION JWT to invalidate (URL-encoded)"
        }
      }
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
post_auth_logout — Log out (invalidate sessionToken + revoke Firebase refresh tokens)
Advertised by the server during the last successful anonymous check.

Logs out the current session **without revoking** it. **Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com` is not a reliable way to clear hosted-login cookies. For browser apps (especially localhost), prefer the redirect helper `GET /api/v1/auth/logout?session_token=...&redirect_uri=...`. Behavior: - **Invalidates** the current `sessionToken` by incrementing `tokenRevision` (no new token is issued). - Calls Firebase `revokeRefreshTokens(firebaseUid)` using the session’s stored Firebase UID. - Sets `Clear-Site-Data: "cookies"` to clear browser cookies (including Firebase session cookie). Session payload and session row are **not** deleted or modified (other than `tokenRevision`). Source: POST /api/v1/auth/logout Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

post_auth_logout input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "sessionToken"
      ],
      "properties": {
        "sessionToken": {
          "type": "string",
          "description": "secureFlows session token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
get_sessions_my — List my sessions (paged, sortable, filterable)
Advertised by the server during the last successful anonymous check.

Returns a page of sessions for the current user within the current workspace. Self-service dashboard endpoint — requires workspace **`enableSelfService: true`**. Payload is included only for rows whose computed status is active. Sort keys match the admin workspace session list; `pageSize` is clamped to 1–200 (default 20). Source: GET /api/v1/sessions/my Requires `auth.userToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

get_sessions_my input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "query"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "userToken"
      ],
      "properties": {
        "userToken": {
          "type": "string",
          "description": "secureFlows USER token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {
        "q": {
          "type": "string",
          "description": "Search by session id, app id, or user identifier (own uid)"
        },
        "dir": {
          "enum": [
            "asc",
            "desc"
          ],
          "type": "string"
        },
        "page": {
          "type": "integer",
          "maximum": 9007199254740991,
          "minimum": 0
        },
        "sort": {
          "enum": [
            "id",
            "user",
            "app",
            "created",
            "expires",
            "status",
            "lastActivity",
            "updated"
          ],
          "type": "string"
        },
        "app_id": {
          "type": "string",
          "description": "Filter by client app id, or `all`."
        },
        "status": {
          "enum": [
            "all",
            "active",
            "expired",
            "revoked"
          ],
          "type": "string",
          "description": "Computed session lifecycle filter (`all` or same values as admin session list)."
        },
        "pageSize": {
          "type": "integer",
          "maximum": 200,
          "minimum": 1,
          "description": "Page size (server clamps to 1–200; 0 or invalid uses default 20)."
        }
      }
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
post_sessions_revoke_session_id — Revoke a session owned by the current user
Advertised by the server during the last successful anonymous check.

Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. The session ends and its stored data is destroyed permanently; this is not sign-out. Requires workspace **`enableSelfService: true`**. Source: POST /api/v1/sessions/revoke/{sessionId} Requires `auth.userToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

post_sessions_revoke_session_id input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "params"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "required": [
        "userToken"
      ],
      "properties": {
        "userToken": {
          "type": "string",
          "description": "secureFlows USER token"
        }
      }
    },
    "body": {},
    "query": {
      "type": "object",
      "properties": {}
    },
    "params": {
      "type": "object",
      "required": [
        "sessionId"
      ],
      "properties": {
        "sessionId": {
          "type": "integer",
          "maximum": 9007199254740991,
          "minimum": -9007199254740991
        }
      }
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
get_docs_search — Semantic documentation search
Advertised by the server during the last successful anonymous check.

Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks from the environment's search index (pgvector). Source: GET /api/v1/docs/search No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

get_docs_search input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "connection",
    "query"
  ],
  "properties": {
    "auth": {
      "type": "object",
      "properties": {}
    },
    "body": {},
    "query": {
      "type": "object",
      "required": [
        "q"
      ],
      "properties": {
        "q": {
          "type": "string",
          "description": "Natural-language question or keywords"
        },
        "limit": {
          "type": "integer",
          "maximum": 20,
          "minimum": 1,
          "description": "Maximum hits to return (server caps at 20)"
        }
      }
    },
    "params": {
      "type": "object",
      "properties": {}
    },
    "connection": {
      "type": "object",
      "required": [
        "host"
      ],
      "properties": {
        "host": {
          "type": "string",
          "format": "uri",
          "description": "secureFlows base URL, for example https://api.example.com"
        },
        "appId": {
          "type": "string",
          "description": "Optional secureFlows app id used as a default for hosted login tools"
        },
        "workspaceName": {
          "type": "string",
          "description": "Optional workspace name used as a default for tools that need it"
        }
      }
    }
  }
}
secureflows_build_login_url — Build secureFlows hosted login URL
Advertised by the server during the last successful anonymous check.

Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phase most secureFlows integration mistakes happen in. Always targets /app/sessions/login (session apps). Never builds the legacy /app/login console URL, which returns a firebaseToken your SecureFlowsCallback handler cannot consume and causes an infinite redirect loop. Use this instead of hand-building the URL with URLSearchParams — hand-built login URLs are the #1 source of the login-loop and stale-renewal bugs documented in SKILL.md.

secureflows_build_login_url input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "workspaceName",
    "appId",
    "redirectUri"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "App id from the human prompt (\"appId = ...\")"
    },
    "intent": {
      "enum": [
        "fresh_login",
        "renew_expired_token"
      ],
      "type": "string",
      "default": "fresh_login",
      "description": "fresh_login: normal sign-in, or app-load restore with no prior token (default — almost always correct, including after an explicit sign-out). renew_expired_token: ONLY when resuming the SAME still-intended user after a soft token expiry (401/410) while staying logged in — never after Sign out."
    },
    "origin": {
      "type": "string",
      "format": "uri",
      "default": "https://www.secure-flows.com",
      "description": "secureFlows origin — always https://www.secure-flows.com in production"
    },
    "redirectUri": {
      "type": "string",
      "format": "uri",
      "description": "The app's unguarded /callback URL, built from the published/allowlisted app origin — never from an iframe or editor chrome origin."
    },
    "expiredToken": {
      "type": "string",
      "description": "The old sessionToken to renew. Only read when intent=renew_expired_token. Setting this after an explicit sign-out is the \"send a dead JWT into hosted login\" anti-pattern — it breaks renewal when the underlying identity changed."
    },
    "workspaceName": {
      "type": "string",
      "description": "Workspace name from the human prompt (\"workspace = ...\")"
    }
  }
}
secureflows_build_logout_url — Build secureFlows redirect-logout URL
Advertised by the server during the last successful anonymous check.

Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns: a redirect_uri pointing at /callback (SPA callback handlers treat the tokenless return as a failed login and loop), and a redirect_uri that itself embeds session_token (silently renews the old session instead of signing out). The result always instructs top-level navigation, never fetch/XHR — cross-site fetch() to this endpoint gets a 200 but browsers silently ignore its Clear-Site-Data header on cross-site responses, so the hosted-login cookie survives and the user silently re-authenticates on the next login redirect. This tool never builds a revoke request: revoke permanently destroys the user's data and must only run on an explicit "delete my account" action, never on ordinary sign-out.

secureflows_build_logout_url input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "sessionToken",
    "postLogoutRedirectUri"
  ],
  "properties": {
    "origin": {
      "type": "string",
      "format": "uri",
      "default": "https://www.secure-flows.com",
      "description": "secureFlows origin — always https://www.secure-flows.com in production"
    },
    "sessionToken": {
      "type": "string",
      "description": "The current sessionToken to invalidate."
    },
    "postLogoutRedirectUri": {
      "type": "string",
      "format": "uri",
      "description": "Where the browser lands after logout completes — allowlisted, must NOT be /callback, and must NOT itself contain session_token."
    }
  }
}
secureflows_lint_integration — Static-scan generated code for secureFlows anti-patterns
Advertised by the server during the last successful anonymous check.

Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout, client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), reported at an exact file:line. • scope "project" — REQUIRED handling is missing everywhere you passed in: detecting 401/410 but never clearing the token, never handling 403, or handling 403 without the BILLING_GRACE_LOCK carve-out. These are the defects that actually dominate real generated apps, and no "forbidden pattern" check can see them, because the bug is an absence. Heuristic text analysis, not a parser or a type checker. It can miss things it has no rule for, and a project check can be satisfied by the right keyword in the wrong place. It is a fast first pass — not a substitute for the Agent implementation checklist in SKILL.md, and specifically not for the checks that need a running app (auth-guard mount races, the fresh-reload check). Fix every "error" before calling an integration done; treat "needs_review" as a lead.

secureflows_lint_integration input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "files"
  ],
  "properties": {
    "files": {
      "type": "object",
      "description": "Map of relative file path -> full file source to scan, e.g. { \"src/lib/secureflows.js\": \"...\" }",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {
        "type": "string"
      }
    }
  }
}

Prompts

1 advertised

security-review — Security review of user management

Advertised by the server during the last successful anonymous check.

Read-only review of how this project manages user accounts: lists the security gaps, grades each against secureFlows (Yes / Partly / No / Unconfirmed), and writes a migration plan. Saves two Markdown files; changes no code.

No arguments advertised.

Resources

Not advertised

No resource definitions available.

90-day uptime

A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.

Too few checks for a percentage yet (2 of 2 answered).

  1. 2026-11-06: 1 of 1 checks answered
  2. 2026-11-07: 1 of 1 checks answered

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
1194 ms
95th percentile latency
1194 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 1194 ms · metadata changed · 18 tool(s), 1 prompt(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http secure-flows-mcp https://www.secure-flows.com/mcp?alias=secure-flows

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add secure-flows-mcp --url https://www.secure-flows.com/mcp?alias=secure-flows

Cursor

Merge this server into .cursor/mcp.json in your project, then enable secure-flows-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "secure-flows-mcp": {
      "url": "https://www.secure-flows.com/mcp?alias=secure-flows"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "secure-flows-mcp": {
      "type": "streamableHttp",
      "url": "https://www.secure-flows.com/mcp?alias=secure-flows",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start secure-flows-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "secure-flows-mcp": {
      "type": "http",
      "url": "https://www.secure-flows.com/mcp?alias=secure-flows"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http secure-flows-mcp https://www.secure-flows.com/mcp?alias=secure-flows

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.
Claude Desktop configuration
https://www.secure-flows.com/mcp?alias=secure-flows

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "secure-flows-mcp": {
      "serverUrl": "https://www.secure-flows.com/mcp?alias=secure-flows"
    }
  }
}

Let your agent find its tools

Find servers like secure-flows MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 5,159