MCP server

Secure Flows

io.github.michal-lefler/secure-flows

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp.

Website Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Working at last check

Tools

18

Token cost

About 9,333 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http secure-flows https://www.secure-flows.com/mcp?alias=secure-flows

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.secure-flows]
url = "https://www.secure-flows.com/mcp?alias=secure-flows"

Gemini CLI

{"mcpServers":{"secure-flows":{"httpUrl":"https://www.secure-flows.com/mcp?alias=secure-flows"}}}

Cursor

{"mcpServers":{"secure-flows":{"url":"https://www.secure-flows.com/mcp?alias=secure-flows"}}}

VS Code

{"servers":{"secure-flows":{"type":"http","url":"https://www.secure-flows.com/mcp?alias=secure-flows"}}}

Antigravity

agy mcp add secure-flows https://www.secure-flows.com/mcp?alias=secure-flows

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"secure-flows","server_url":"https://www.secure-flows.com/mcp?alias=secure-flows","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"secure-flows","server_url":"https://www.secure-flows.com/mcp?alias=secure-flows"}

Tools

• auth_session_callback ~948 tokens
  **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_toke
• delete_sessions_delete_key Deletes data · ~350 tokens
  Removes `key` from the session payload and returns `true` if the key existed. Source: DELETE /api/v1/sessions/delete/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dyna
• get_auth_logout ~636 tokens
  Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when third-party co
• get_docs_search ~360 tokens
  Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks from the environment's search index (pgvector). Source: GET /api/v1/docs/search No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generatin
• get_sessions ~339 tokens
  Returns the decrypted session payload for the authenticated internal session token. Response shape is a **flat JSON object**. Empty payload returns `{}`. Source: GET /api/v1/sessions Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appI
• get_sessions_get_key ~369 tokens
  Retrieves the decrypted payload value for `key`. **Important:** `404` means the key was never written (normal first-use case). Do not treat as an error. Source: GET /api/v1/sessions/get/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connec
• get_sessions_identity ~518 tokens
  Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key w
• get_sessions_my ~587 tokens
  Returns a page of sessions for the current user within the current workspace. Self-service dashboard endpoint — requires workspace **`enableSelfService: true`**. Payload is included only for rows whose computed status is active. Sort keys match the admin workspace session list; `pageSize` is clamped
• post_auth_logout ~512 tokens
  Logs out the current session **without revoking** it. **Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com` is not a reliable way to clear hosted-login cookies. For browser apps (especially localhost), prefer the redirect helper `GET /api/v1/auth/l
• post_sessions ~588 tokens
  Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized **`payload`** (defaults to `{}` when omitted), and returns **`sessionToken`** (JWT; subject = internal session id). Default server-side TTL is **1 hour** (implementation detail). If the Firebase token inclu
• post_sessions_get_or_create ~675 tokens
  Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on
• post_sessions_renew_session_token ~606 tokens
  Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tok
• post_sessions_revoke Changes accounts · ~427 tokens
  Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user out and keep their data, use POST /api/v1/auth/logout (or, in a browser, the redirect helper GET /ap
• post_sessions_revoke_session_id Changes accounts · ~403 tokens
  Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. The session ends and its stored data is destroyed permanently; this is not sign-out. Requires workspace **`enableSelfService: true`**. Source: POST /api/v1/sessions/revoke/{sessionId} Requires `auth.use
• post_sessions_set_key ~494 tokens
  Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores `<x>` directly. Source: POST /api/v1/sessions/set/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.w
• secureflows_build_login_url ~588 tokens
  Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phase most secureFlows integration mistakes happen in. Always targets /app/sessions/login (session apps). Never builds the legacy /app/login co
• secureflows_build_logout_url ~427 tokens
  Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns: a redirect_uri pointing at /callback (SPA callback handlers treat the tokenless return as a failed login and loop), and a redirect_uri that itself embeds session_token (silently renew
• secureflows_lint_integration ~506 tokens
  Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden construct

Browse

• GitHub tools
• Email
• GitHub and code hosting

Related MCP servers

• Rokha
  Search a registry of agent skills and MCP servers, then run them for real. No install, traced.
• 0xinsider
  Read-only Polymarket sports and esports data: wallet grades on settled P&L, large trades, markets.
• satoshidata — Bitcoin entity intelligence
  Bitcoin entity and risk-exposure evidence for AI agents; keyless MCP, no risk_check score/verdict.
• Red by Big Red Cloud
  Secure MCP access to Big Red Cloud accounting data, workflows, help and training.
• DalalOS
  Indian NSE/BSE research data and mechanically-computed ratios; read-only market tools.
• f1ow
  Crypto market data & research MCP: price, derivatives, on-chain, sentiment, news, catalysts.
• Elron Club Public Rentals
  Search Elron Club furnished apartments, availability, prices, details, and rental applications.
• Sipflow
  SIP/VoIP/telecom grounding for AI agents: vendor docs, RFCs, STIR/SHAKEN, traces, configs.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.michal-lefler/secure-flows.svg)](https://aptlynx.net/servers/io.github.michal-lefler/secure-flows)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents