{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_yhabvqvt47as","handle":"secure-flows","url":"https://wellknown.network/agents/secure-flows","links":{"self":"https://wellknown.network/agents/secure-flows/record.json","html":"https://wellknown.network/agents/secure-flows","markdown":"https://wellknown.network/agents/secure-flows/record.md","api":"https://wellknown.network/api/v1/agents/secure-flows","status":"https://wellknown.network/api/v1/agents/secure-flows/status","claim":"https://wellknown.network/agents/secure-flows/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/secure-flows/claim.json","badge":"https://wellknown.network/agents/secure-flows/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air:www.secure-flows.com:server:secure-flows","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"secure-flows","summary":"MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp.","description":"MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp.","publisher":{"name":"michal-lefler","url":null},"homepage":"https://www.secure-flows.com","repository":"https://github.com/michal-lefler/secure-flows","version":"0.2.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://www.secure-flows.com/mcp?alias=secure-flows","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-08-25T10:50:01.37715Z","publishedAt":"2026-08-25T10:50:01.37715Z","registryName":"io.github.michal-lefler/secure-flows"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"derived"},{"slug":"analytics.reporting","name":"Reporting & Dashboards","confidence":0.54,"provenance":"derived"},{"slug":"infra.browser-automation","name":"Browser Automation","confidence":0.51,"provenance":"derived"}],"categories":["analytics","infra","security"]},"observed":{"status":"live","statusReason":"Responded 55m ago.","lastOkAt":"2026-09-08T08:24:43.066Z","lastProbedAt":"2026-09-08T08:24:43.066Z","statusComputedAt":"2026-09-08T08:28:27.167Z","reliability30d":{"probes":5,"successRate":1,"p50Ms":339},"latestObservations":[{"at":"2026-09-08T08:24:43.066Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":226,"error":null,"detail":{"tools":[{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSour"},{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessi"},{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a"},{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo"},{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SES"},{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores "},{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSourc"},{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and for"},{"name":"post_sessions_revoke","description":"Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r"},{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensur"},{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clea"},{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\n"},{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**"},{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST"},{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1"},{"name":"secureflows_build_login_url","description":"Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,\nbefore any user session exists, which is the phas"},{"name":"secureflows_build_logout_url","description":"Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:\na redirect_uri pointing at /callback (SPA c"},{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-rel"}],"toolCount":18,"serverName":"secureflows","capabilities":["logging","tools"],"serverVersion":"0.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-08T01:19:49.732Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":647,"error":null,"detail":{"tools":[{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSour"},{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessi"},{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a"},{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo"},{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SES"},{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores "},{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSourc"},{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and for"},{"name":"post_sessions_revoke","description":"Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r"},{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensur"},{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clea"},{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\n"},{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**"},{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST"},{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1"},{"name":"secureflows_build_login_url","description":"Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,\nbefore any user session exists, which is the phas"},{"name":"secureflows_build_logout_url","description":"Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:\na redirect_uri pointing at /callback (SPA c"},{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-rel"}],"toolCount":18,"serverName":"secureflows","capabilities":["logging","tools"],"serverVersion":"0.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-07T18:21:45.367Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":251,"error":null,"detail":{"tools":[{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSour"},{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessi"},{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a"},{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo"},{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SES"},{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores "},{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSourc"},{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and for"},{"name":"post_sessions_revoke","description":"Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r"},{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensur"},{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clea"},{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\n"},{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**"},{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST"},{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1"},{"name":"secureflows_build_login_url","description":"Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,\nbefore any user session exists, which is the phas"},{"name":"secureflows_build_logout_url","description":"Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:\na redirect_uri pointing at /callback (SPA c"},{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-rel"}],"toolCount":18,"serverName":"secureflows","capabilities":["logging","tools"],"serverVersion":"0.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-07T11:26:19.033Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":241,"error":null,"detail":{"tools":[{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSour"},{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessi"},{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a"},{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo"},{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SES"},{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores "},{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSourc"},{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and for"},{"name":"post_sessions_revoke","description":"Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r"},{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensur"},{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clea"},{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\n"},{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**"},{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST"},{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1"},{"name":"secureflows_build_login_url","description":"Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,\nbefore any user session exists, which is the phas"},{"name":"secureflows_build_logout_url","description":"Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:\na redirect_uri pointing at /callback (SPA c"},{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-rel"}],"toolCount":18,"serverName":"secureflows","capabilities":["logging","tools"],"serverVersion":"0.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-07T04:27:01.576Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":221,"error":null,"detail":{"tools":[{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSour"},{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessi"},{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a"},{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo"},{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SES"},{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores "},{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSourc"},{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and for"},{"name":"post_sessions_revoke","description":"Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r"},{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensur"},{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clea"},{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\n"},{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**"},{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST"},{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1"},{"name":"secureflows_build_login_url","description":"Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,\nbefore any user session exists, which is the phas"},{"name":"secureflows_build_logout_url","description":"Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:\na redirect_uri pointing at /callback (SPA c"},{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-rel"}],"toolCount":18,"serverName":"secureflows","capabilities":["logging","tools"],"serverVersion":"0.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-06T21:26:19.800Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":213,"error":null,"detail":{"tools":[{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSour"},{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessi"},{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a"},{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo"},{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SES"},{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores "},{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSourc"},{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and for"},{"name":"post_sessions_revoke","description":"Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r"},{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensur"},{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clea"},{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\n"},{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**"},{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST"},{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1"},{"name":"secureflows_build_login_url","description":"Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,\nbefore any user session exists, which is the phas"},{"name":"secureflows_build_logout_url","description":"Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:\na redirect_uri pointing at /callback (SPA c"},{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-rel"}],"toolCount":18,"serverName":"secureflows","capabilities":["logging","tools"],"serverVersion":"0.2.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSour"},{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessi"},{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a"},{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo"},{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SES"},{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores "},{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSourc"},{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and for"},{"name":"post_sessions_revoke","description":"Revokes the session referenced by the internal SESSION Bearer token. This endpoint is useful for automation clients that only hold a session token and want to r"},{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensur"},{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clea"},{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\n"},{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**"},{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST"},{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1"},{"name":"secureflows_build_login_url","description":"Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,\nbefore any user session exists, which is the phas"},{"name":"secureflows_build_logout_url","description":"Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:\na redirect_uri pointing at /callback (SPA c"},{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-rel"}],"package":null},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"io.github.michal-lefler/secure-flows","url":"https://registry.modelcontextprotocol.io/v0/servers/io.github.michal-lefler%2Fsecure-flows","firstSeenAt":"2026-09-06T20:21:46.965Z","fetchedAt":"2026-09-06T20:21:46.965Z","normalizedAt":"2026-09-06T20:21:46.965Z"}]},"firstSeenAt":"2026-09-06T20:21:46.965Z","updatedAt":"2026-09-08T08:28:55.896Z"}