secure-flows

Name: secure-flows
Author: michal-lefler

MCP serverMCP

MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp.

by michal-leflerrepository ↗homepage ↗v0.2.0

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"secure-flows","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability5/5 checks ok

30 days ago

Tools observed via MCP handshake

get_sessions — Returns the decrypted session payload for the authenticated internal session token. Response shape is a **flat JSON object**. Empty payload returns `{}`. Sour
post_sessions — Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized **`payload`** (defaults to `{}` when omitted), and returns **`sessi
get_sessions_identity — Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a
post_sessions_get_or_create — Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo
post_sessions_renew_session_token — Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SES
post_sessions_set_key — Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores
get_sessions_get_key — Retrieves the decrypted payload value for `key`. **Important:** `404` means the key was never written (normal first-use case). Do not treat as an error. Sourc
delete_sessions_delete_key — Removes `key` from the session payload and returns `true` if the key existed. Source: DELETE /api/v1/sessions/delete/{key} Requires `auth.sessionToken` and for
post_sessions_revoke — Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r
auth_session_callback — **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensur
get_auth_logout — Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clea
post_auth_logout — Logs out the current session **without revoking** it. **Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`
get_sessions_my — Returns a page of sessions for the current user within the current workspace. Self-service dashboard endpoint — requires workspace **`enableSelfService: true`**
post_sessions_revoke_session_id — Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. Requires workspace **`enableSelfService: true`**. Source: POST
get_docs_search — Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks from the environment's search index (pgvector). Source: GET /api/v1
secureflows_build_login_url — Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phas
secureflows_build_logout_url — Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns: a redirect_uri pointing at /callback (SPA c
secureflows_lint_integration — Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-rel

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registryio.github.michal-lefler/secure-flows

first seen 2 d ago · fetched 2 d agoopen ↗

Field history (7 recent events)

2 d ago · declared · summary → "MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp."
2 d ago · declared · description → "MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp."
2 d ago · declared · publisherName → "michal-lefler"
2 d ago · declared · homepageUrl → "https://www.secure-flows.com"
2 d ago · declared · repoUrl → "https://github.com/michal-lefler/secure-flows"
2 d ago · declared · version → "0.2.0"
2 d ago · declared · protocols → ["mcp"]

when	check	result	http	latency	detail
5 min ago	mcp initialize	ok	200	226 ms	server secureflows 0.2.0 · protocol 2025-06-18 · 18 tools
7 h ago	mcp initialize	ok	200	647 ms	server secureflows 0.2.0 · protocol 2025-06-18 · 18 tools
14 h ago	mcp initialize	ok	200	251 ms	server secureflows 0.2.0 · protocol 2025-06-18 · 18 tools
21 h ago	mcp initialize	ok	200	241 ms	server secureflows 0.2.0 · protocol 2025-06-18 · 18 tools
28 h ago	mcp initialize	ok	200	221 ms	server secureflows 0.2.0 · protocol 2025-06-18 · 18 tools
35 h ago	mcp initialize	ok	200	213 ms	server secureflows 0.2.0 · protocol 2025-06-18 · 18 tools

secure-flows

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from