io.github.michal-lefler/secure-flows

up checked 2026-11-11T07:37:55.166Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided description

MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp.

Summary by lookupd

Manages authenticated user sessions: create, renew, read or set payload keys, revoke, and build login/logout redirect URLs and lint…

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http secure-flows 'https://www.secure-flows.com/mcp?alias=secure-flows'

Codex, remote (streamable-http)

codex mcp add secure-flows --url 'https://www.secure-flows.com/mcp?alias=secure-flows'

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "secure-flows": {
      "url": "https://www.secure-flows.com/mcp?alias=secure-flows"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (18 tools)

Publisher-provided text

• get_sessions Returns the decrypted session payload for the authenticated internal session token. Response shape is a **flat JSON object**. Empty payload returns `{}`. Sour
• post_sessions Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized **`payload`** (defaults to `{}` when omitted), and returns **`sessi
• get_sessions_identity Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a
• post_sessions_get_or_create Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT fo
• post_sessions_renew_session_token Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SES
• post_sessions_set_key Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores
• get_sessions_get_key Retrieves the decrypted payload value for `key`. **Important:** `404` means the key was never written (normal first-use case). Do not treat as an error. Sourc
• delete_sessions_delete_key Removes `key` from the session payload and returns `true` if the key existed. Source: DELETE /api/v1/sessions/delete/{key} Requires `auth.sessionToken` and for
• post_sessions_revoke Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restore
• auth_session_callback **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensur
• get_auth_logout Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clea
• post_auth_logout Logs out the current session **without revoking** it. **Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`
• get_sessions_my Returns a page of sessions for the current user within the current workspace. Self-service dashboard endpoint — requires workspace **`enableSelfService: true`**
• post_sessions_revoke_session_id Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. The session ends and its stored data is destroyed permanently;
• get_docs_search Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks from the environment's search index (pgvector). Source: GET /api/v1
• secureflows_build_login_url Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phas
• secureflows_build_logout_url Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns: a redirect_uri pointing at /callback (SPA c
• secureflows_lint_integration Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-rel

Details

• Version: 0.2.0
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 872 ms
• First indexed: 2026-11-01T09:40:48.781Z
• Last seen in registry: 2026-11-01T09:40:48.781Z
• Repository: https://github.com/michal-lefler/secure-flows
• Website: https://www.secure-flows.com

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.michal-lefler/secure-flows.svg)](https://lookupd.com/servers/io.github.michal-lefler/secure-flows)

• 62033 servers
• Last crawl: 2026-11-11T15:38:39.561Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp