Servidor MCP
secure-flows
io.github.michal-lefler/secure-flows
Qué hace este MCP
Provides secureFlows authentication and session operations, documentation search, hosted login/logout URL builders, and static linting for integration errors.
Capacidades
Herramientas
18
herramientas
auth_session_callback
Session login callback (redirect)
**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.
1. Verifies **`firebaseToken`** (Firebase ID token).
2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`).
3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for
**`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional
**`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** â ignored when
reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired),
**renews** that session; **`payload`** must **not** be sent on the same request. Optional
**`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60â604800**). When the
Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace
end-user row (audit display only).
4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`**
and, if provided, **`state`**.
If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not**
redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON
**`{"status", "error"}`** body and do **not** redirect.
Source: GET /api/v1/auth/callback
No Authorization header is required.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'query'], 'properties': {'auth': {'type': 'object', 'properties': {}}, 'body': {}, 'query': {'type': 'object', 'required': ['firebaseToken', 'client_redirect_uri', 'workspace_name', 'app_id'], 'properties': {'state': {'type': 'string'}, 'app_id': {'type': 'string'}, 'payload': {'type': 'string', 'description': 'JSON object as a string (e.g. `{"a":1}`), URL-encoded. Must parse to a JSON object (not an array or primitive).\nDefault when omitted is `{}`. Must not be combined with `session_token` on the same request.\n'}, 'ttl_seconds': {'type': 'integer', 'maximum': 604800, 'minimum': 0, 'description': 'Session lifetime in seconds (default 0 = unlimited; allowed values: 0 or 60â\x80\x93604800)'}, 'firebaseToken': {'type': 'string'}, 'session_token': {'type': 'string', 'description': 'Previous session JWT (may be expired); signature must validate. When present, the server renews this\nsession instead of creating a new one. Must not be combined with `payload` on the same request.\nURL-encode the value; very long URLs may exceed browser or proxy limits.\n'}, 'workspace_name': {'type': 'string'}, 'client_redirect_uri': {'type': 'string', 'format': 'uri'}}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
delete_sessions_delete_key
Delete a key from the session payload
Removes `key` from the session payload and returns `true` if the key existed.
Source: DELETE /api/v1/sessions/delete/{key}
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'params'], 'properties': {'auth': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'secureFlows session token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'required': ['key'], 'properties': {'key': {'type': 'string', 'description': 'Payload key to delete'}}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
get_auth_logout
Log out (browser redirect helper; first-party cookie clearing)
Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).
Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a
**first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when
third-party cookies are blocked.
**Critical client rules:**
- Clear your in-app `sessionToken` state **before** navigating.
- **Never** include `session_token` inside `redirect_uri` (that would silently renew and defeat logout).
This endpoint (best-effort / idempotent for browser UX):
- Invalidates the provided `session_token` by incrementing `tokenRevision` when the token still
matches an **active** session (no new token is issued).
- If the session is already expired/revoked or the revision was superseded by renew, still
completes logout UX (does **not** return 401 solely for that reason).
- Revokes Firebase refresh tokens for the sessionâs stored Firebase UID when known.
- Sets `Clear-Site-Data: "cookies"`.
- Redirects the browser to `redirect_uri`.
Source: GET /api/v1/auth/logout
No Authorization header is required.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'query'], 'properties': {'auth': {'type': 'object', 'properties': {}}, 'body': {}, 'query': {'type': 'object', 'required': ['session_token', 'redirect_uri'], 'properties': {'redirect_uri': {'type': 'string', 'format': 'uri', 'description': 'Where to redirect after logout completes'}, 'session_token': {'type': 'string', 'description': 'SESSION JWT to invalidate (URL-encoded)'}}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
get_docs_search
Semantic documentation search
Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks
from the environment's search index (pgvector).
Source: GET /api/v1/docs/search
No Authorization header is required.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'query'], 'properties': {'auth': {'type': 'object', 'properties': {}}, 'body': {}, 'query': {'type': 'object', 'required': ['q'], 'properties': {'q': {'type': 'string', 'description': 'Natural-language question or keywords'}, 'limit': {'type': 'integer', 'maximum': 20, 'minimum': 1, 'description': 'Maximum hits to return (server caps at 20)'}}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
get_sessions
Get the current session payload
Returns the decrypted session payload for the authenticated internal session token.
Response shape is a **flat JSON object**. Empty payload returns `{}`.
Source: GET /api/v1/sessions
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection'], 'properties': {'auth': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'secureFlows session token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
get_sessions_get_key
Get a single value from the session payload
Retrieves the decrypted payload value for `key`.
**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.
Source: GET /api/v1/sessions/get/{key}
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'params'], 'properties': {'auth': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'secureFlows session token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'required': ['key'], 'properties': {'key': {'type': 'string', 'description': 'Payload key to read'}}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
get_sessions_identity
Get signed-in user's stable id and email (app UI, backend correlation)
Returns the workspace end-user's **`userId`** and **email** for the authenticated session
token. Does not return Firebase UID or session payload.
`userId` is a stable, opaque identifier for this person across sessions and logins â it is
**not** derived from Firebase. Use it as the correlation key when your own backend needs to
link an external event (e.g. a billing provider webhook you receive and verify yourself)
back to this user. Do not use the session token or session id for this â sessions expire and
rotate, `userId` does not.
Email is best-effort from hosted login (Firebase `email` claim persisted on the user row).
When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (⥠0.1.15 for `userId`).
Source: GET /api/v1/sessions/identity
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection'], 'properties': {'auth': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'secureFlows session token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
get_sessions_my
List my sessions (paged, sortable, filterable)
Returns a page of sessions for the current user within the current workspace.
Self-service dashboard endpoint â requires workspace **`enableSelfService: true`**.
Payload is included only for rows whose computed status is active.
Sort keys match the admin workspace session list; `pageSize` is clamped to 1â200 (default 20).
Source: GET /api/v1/sessions/my
Requires `auth.userToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'query'], 'properties': {'auth': {'type': 'object', 'required': ['userToken'], 'properties': {'userToken': {'type': 'string', 'description': 'secureFlows USER token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {'q': {'type': 'string', 'description': 'Search by session id, app id, or user identifier (own uid)'}, 'dir': {'enum': ['asc', 'desc'], 'type': 'string'}, 'page': {'type': 'integer', 'maximum': 9007199254740991, 'minimum': 0}, 'sort': {'enum': ['id', 'user', 'app', 'created', 'expires', 'status', 'lastActivity', 'updated'], 'type': 'string'}, 'app_id': {'type': 'string', 'description': 'Filter by client app id, or `all`.'}, 'status': {'enum': ['all', 'active', 'expired', 'revoked'], 'type': 'string', 'description': 'Computed session lifecycle filter (`all` or same values as admin session list).'}, 'pageSize': {'type': 'integer', 'maximum': 200, 'minimum': 1, 'description': 'Page size (server clamps to 1â\x80\x93200; 0 or invalid uses default 20).'}}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
post_auth_logout
Log out (invalidate sessionToken + revoke Firebase refresh tokens)
Logs out the current session **without revoking** it.
**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`
is not a reliable way to clear hosted-login cookies. For browser apps (especially localhost), prefer the
redirect helper `GET /api/v1/auth/logout?session_token=...&redirect_uri=...`.
Behavior:
- **Invalidates** the current `sessionToken` by incrementing `tokenRevision` (no new token is issued).
- Calls Firebase `revokeRefreshTokens(firebaseUid)` using the sessionâs stored Firebase UID.
- Sets `Clear-Site-Data: "cookies"` to clear browser cookies (including Firebase session cookie).
Session payload and session row are **not** deleted or modified (other than `tokenRevision`).
Source: POST /api/v1/auth/logout
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection'], 'properties': {'auth': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'secureFlows session token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
post_sessions
Create a new session
Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized
**`payload`** (defaults to `{}` when omitted), and returns **`sessionToken`** (JWT; subject = internal session id).
Default server-side TTL is **1 hour** (implementation detail).
If the Firebase token includes **`email`**, the server best-effort persists it on the workspace
end-user row (for audit display). Prefer **`POST /sessions/get-or-create`** for hosted-login-style
flows that should reuse an active session.
Source: POST /api/v1/sessions
Requires `auth.firebaseToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'body'], 'properties': {'auth': {'type': 'object', 'required': ['firebaseToken'], 'properties': {'firebaseToken': {'type': 'string', 'description': 'Firebase ID token'}}}, 'body': {'type': 'object', 'required': ['workspaceName'], 'properties': {'app_id': {'anyOf': [{'type': 'string', 'description': 'Optional app id (must belong to the workspace). Used for per-app session policy and auditing.'}, {'type': 'null'}]}, 'payload': {'type': 'object', 'description': 'Arbitrary payload object stored in the session. Optional; omitted or null is stored as `{}`.', 'propertyNames': {'type': 'string'}, 'additionalProperties': {}}, 'workspaceName': {'type': 'string', 'description': 'Workspace name to scope the session'}}}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
post_sessions_get_or_create
Reuse active session or create one
Verifies **Firebase** ID token. If an **active** session already exists for
**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most
recently created** matching row (touches activity; does not create a duplicate session). The request
**`payload` is ignored on reuse** â it is applied only when a new session row is created. Prefer a
dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload.
Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL).
If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the
workspace end-user row (including when reusing an existing session). Intended for integrators that
mirror hosted login session reuse.
Source: POST /api/v1/sessions/get-or-create
Requires `auth.firebaseToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'body'], 'properties': {'auth': {'type': 'object', 'required': ['firebaseToken'], 'properties': {'firebaseToken': {'type': 'string', 'description': 'Firebase ID token'}}}, 'body': {'type': 'object', 'required': ['workspaceName'], 'properties': {'app_id': {'anyOf': [{'type': 'string', 'description': 'Optional app id (must belong to the workspace). Used for per-app session policy and auditing.'}, {'type': 'null'}]}, 'payload': {'type': 'object', 'description': 'Arbitrary payload object stored in the session. Optional; omitted or null is stored as `{}`.', 'propertyNames': {'type': 'string'}, 'additionalProperties': {}}, 'workspaceName': {'type': 'string', 'description': 'Workspace name to scope the session'}}}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
post_sessions_renew_session_token
Renew session JWT (replace expired token)
Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without
enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the
session by id from the token subject; the Firebase UID must match the session owner.
Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id,
older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`.
Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted
**payload**; extends server-side session expiry by **1 hour**.
If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner
when the user row has no email yet (audit display only).
Use the path form `POST /api/v1/sessions/renew/{sessionToken}` â **URL-encode** the JWT (e.g. `encodeURIComponent` in JS).
Source: POST /api/v1/sessions/renew/{sessionToken}
Requires `auth.firebaseToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'params'], 'properties': {'auth': {'type': 'object', 'required': ['firebaseToken'], 'properties': {'firebaseToken': {'type': 'string', 'description': 'Firebase ID token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'Previous SESSION JWT (may be expired); URL-encoded in the path'}}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
post_sessions_revoke
Revoke the current session and destroy its data (by session token) - not sign-out
Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user out and keep their data, use POST /api/v1/auth/logout (or, in a browser, the redirect helper GET /api/v1/auth/logout). Call revoke only when the user or an admin deliberately wants the session and its data deleted, for example on account deletion.
Source: POST /api/v1/sessions/revoke
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection'], 'properties': {'auth': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'secureFlows session token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'properties': {}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
post_sessions_revoke_session_id
Revoke a session owned by the current user
Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.
The session ends and its stored data is destroyed permanently; this is not sign-out.
Requires workspace **`enableSelfService: true`**.
Source: POST /api/v1/sessions/revoke/{sessionId}
Requires `auth.userToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'params'], 'properties': {'auth': {'type': 'object', 'required': ['userToken'], 'properties': {'userToken': {'type': 'string', 'description': 'secureFlows USER token'}}}, 'body': {}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'required': ['sessionId'], 'properties': {'sessionId': {'type': 'integer', 'maximum': 9007199254740991, 'minimum': -9007199254740991}}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
post_sessions_set_key
Set a value inside the session payload
Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores `<x>` directly.
Source: POST /api/v1/sessions/set/{key}
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['connection', 'params', 'body'], 'properties': {'auth': {'type': 'object', 'required': ['sessionToken'], 'properties': {'sessionToken': {'type': 'string', 'description': 'secureFlows session token'}}}, 'body': {'anyOf': [{'type': 'object', 'required': ['value'], 'properties': {'value': {}}}, {'type': 'string'}, {'type': 'number'}, {'type': 'integer', 'maximum': 9007199254740991, 'minimum': -9007199254740991}, {'type': 'boolean'}, {'type': 'array', 'items': {}}, {'type': 'object', 'propertyNames': {'type': 'string'}, 'additionalProperties': {}}, {}], 'description': 'JSON body can be either `{ "value": <x> }` (preferred) or a raw JSON value.\n'}, 'query': {'type': 'object', 'properties': {}}, 'params': {'type': 'object', 'required': ['key'], 'properties': {'key': {'type': 'string', 'description': 'Payload key to set'}}}, 'connection': {'type': 'object', 'required': ['host'], 'properties': {'host': {'type': 'string', 'format': 'uri', 'description': 'secureFlows base URL, for example https://api.example.com'}, 'appId': {'type': 'string', 'description': 'Optional secureFlows app id used as a default for hosted login tools'}, 'workspaceName': {'type': 'string', 'description': 'Optional workspace name used as a default for tools that need it'}}}}}
secureflows_build_login_url
Build secureFlows hosted login URL
Builds a correct hosted-login redirect URL. Needs no secureFlows token â safe to call at app-scaffolding time,
before any user session exists, which is the phase most secureFlows integration mistakes happen in.
Always targets /app/sessions/login (session apps). Never builds the legacy /app/login console URL,
which returns a firebaseToken your SecureFlowsCallback handler cannot consume and causes an infinite redirect loop.
Use this instead of hand-building the URL with URLSearchParams â hand-built login URLs are the #1 source of the
login-loop and stale-renewal bugs documented in SKILL.md.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['workspaceName', 'appId', 'redirectUri'], 'properties': {'appId': {'type': 'string', 'description': 'App id from the human prompt ("appId = ...")'}, 'intent': {'enum': ['fresh_login', 'renew_expired_token'], 'type': 'string', 'default': 'fresh_login', 'description': 'fresh_login: normal sign-in, or app-load restore with no prior token (default â\x80\x94 almost always correct, including after an explicit sign-out). renew_expired_token: ONLY when resuming the SAME still-intended user after a soft token expiry (401/410) while staying logged in â\x80\x94 never after Sign out.'}, 'origin': {'type': 'string', 'format': 'uri', 'default': 'https://www.secure-flows.com', 'description': 'secureFlows origin â\x80\x94 always https://www.secure-flows.com in production'}, 'redirectUri': {'type': 'string', 'format': 'uri', 'description': "The app's unguarded /callback URL, built from the published/allowlisted app origin â\x80\x94 never from an iframe or editor chrome origin."}, 'expiredToken': {'type': 'string', 'description': 'The old sessionToken to renew. Only read when intent=renew_expired_token. Setting this after an explicit sign-out is the "send a dead JWT into hosted login" anti-pattern â\x80\x94 it breaks renewal when the underlying identity changed.'}, 'workspaceName': {'type': 'string', 'description': 'Workspace name from the human prompt ("workspace = ...")'}}}
secureflows_build_logout_url
Build secureFlows redirect-logout URL
Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:
a redirect_uri pointing at /callback (SPA callback handlers treat the tokenless return as a failed login and loop),
and a redirect_uri that itself embeds session_token (silently renews the old session instead of signing out).
The result always instructs top-level navigation, never fetch/XHR â cross-site fetch() to this endpoint gets a 200 but
browsers silently ignore its Clear-Site-Data header on cross-site responses, so the hosted-login cookie survives and the
user silently re-authenticates on the next login redirect. This tool never builds a revoke request: revoke permanently
destroys the user's data and must only run on an explicit "delete my account" action, never on ordinary sign-out.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['sessionToken', 'postLogoutRedirectUri'], 'properties': {'origin': {'type': 'string', 'format': 'uri', 'default': 'https://www.secure-flows.com', 'description': 'secureFlows origin â\x80\x94 always https://www.secure-flows.com in production'}, 'sessionToken': {'type': 'string', 'description': 'The current sessionToken to invalidate.'}, 'postLogoutRedirectUri': {'type': 'string', 'format': 'uri', 'description': 'Where the browser lands after logout completes â\x80\x94 allowlisted, must NOT be /callback, and must NOT itself contain session_token.'}}}
secureflows_lint_integration
Static-scan generated code for secureFlows anti-patterns
Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at
scaffolding time. Pass every auth/session-related file in one call â some checks are evaluated across the whole set.
Two kinds of findings:
⢠scope "file" â a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout,
client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), reported at an exact file:line.
⢠scope "project" â REQUIRED handling is missing everywhere you passed in: detecting 401/410 but never clearing the
token, never handling 403, or handling 403 without the BILLING_GRACE_LOCK carve-out. These are the defects that
actually dominate real generated apps, and no "forbidden pattern" check can see them, because the bug is an absence.
Heuristic text analysis, not a parser or a type checker. It can miss things it has no rule for, and a project check can
be satisfied by the right keyword in the wrong place. It is a fast first pass â not a substitute for the Agent
implementation checklist in SKILL.md, and specifically not for the checks that need a running app (auth-guard mount
races, the fresh-reload check). Fix every "error" before calling an integration done; treat "needs_review" as a lead.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['files'], 'properties': {'files': {'type': 'object', 'description': 'Map of relative file path -> full file source to scan, e.g. { "src/lib/secureflows.js": "..." }', 'propertyNames': {'type': 'string'}, 'additionalProperties': {'type': 'string'}}}}
Historial
Cambios recientes en herramientas
Modificado
post_sessions_revoke_session_id
1 de October de 2026 a las 02:47
Modificado
post_sessions_revoke
1 de October de 2026 a las 02:47
Añadido
secureflows_lint_integration
17 de September de 2026 a las 12:45
Añadido
secureflows_build_logout_url
17 de September de 2026 a las 12:45
Añadido
secureflows_build_login_url
17 de September de 2026 a las 12:45
Añadido
get_docs_search
17 de September de 2026 a las 12:45
Añadido
post_sessions_revoke_session_id
17 de September de 2026 a las 12:45
Añadido
get_sessions_my
17 de September de 2026 a las 12:45
Añadido
post_auth_logout
17 de September de 2026 a las 12:45
Añadido
get_auth_logout
17 de September de 2026 a las 12:45
Añadido
auth_session_callback
17 de September de 2026 a las 12:45
Añadido
post_sessions_revoke
17 de September de 2026 a las 12:45
Añadido
delete_sessions_delete_key
17 de September de 2026 a las 12:45
Añadido
get_sessions_get_key
17 de September de 2026 a las 12:45
Añadido
post_sessions_set_key
17 de September de 2026 a las 12:45
Añadido
post_sessions_renew_session_token
17 de September de 2026 a las 12:45
Añadido
post_sessions_get_or_create
17 de September de 2026 a las 12:45
Añadido
get_sessions_identity
17 de September de 2026 a las 12:45
Añadido
post_sessions
17 de September de 2026 a las 12:45
Añadido
get_sessions
17 de September de 2026 a las 12:45
Descubrir
Servidores MCP similares
hyperion
com.thetempleofdoom.hyperion/hyperion
Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…
Vee3
io.github.Vee3io/vee3
Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…
IA-QA — 130+ QA & Dev Tools for AI Agents
io.github.JcJamet/ia-qa-toolbox
Provides deterministic QA, evaluation, testing, code analysis, prompt and RAG checks, model comparison, and web security diagnost…
validoria-mcp
com.validoria/validoria-mcp
Runs continuous website, API, and webshop tests covering security, SEO, performance, accessibility, browser journeys, and inciden…
HubVibe: Pay-per-Call Tools for AI Agents: Web Search, Email Verify, KYC, Stocks, Crypto, News, Data
io.github.Its-fortunatefolly/hubvibe
Offers paid utilities for web audits, HTTP fetching and extraction, BigQuery analysis, LLM processing, code execution, blockchain…
developer-tools
net.programmes/developer-tools
Provides general-purpose developer utilities for encoding, hashing, encryption, JSON, HTML, CSS, networking, and related data tra…
Qiniso
io.github.qinisolabs/qiniso
Provides deterministic formatting, parsing, holiday and tax lookups, address handling, and checksum or structure validation for i…
ContrastAPI
com.contrastcyber/api
Provides security research and assessment tools covering CVEs, IOCs, dependencies, secrets, injection risks, HTTP headers, domain…