.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/workflows-mcp-server</h1> <p><b>Store, query, and create YAML workflow playbooks for LLM agents via MCP. STDIO or Streamable HTTP.</b> <div>4 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
Four tools covering the full workflow library lifecycle — discovery, retrieval, and creation for both permanent and temporary workflows:
| Tool | Description |
|---|---|
workflow_list | List all permanent workflows in the index, with optional category and tag filters. |
workflow_get | Retrieve a complete workflow definition by name, with global instructions prepended. |
workflow_create | Write a new permanent workflow YAML to the library. |
workflow_create_temp | Write a temporary one-shot workflow, indexed but excluded from list results. |
workflow_listList permanent workflows from the in-memory index.
includeTools: true to surface the unique server/tool pairs used across each workflow's stepsworkflow_getRetrieve a complete workflow by name, including the global instructions document.
version to get the highest available match; specify a version for an exact lookupglobal_instructions.md content as globalInstructions — apply these when executing the workflow; null when the file is absentworkflow_list{{input.foo}}, {{steps.X.output.Y}}) are returned verbatim — the server never interpolates themworkflow_createWrite a new permanent workflow to the library.
categories/<slugified-category>/<slugified-name>-workflow.yamlname@version already exists — bump the version to create a new revisioncreated_date and last_updated_date automaticallyworkflow_create_tempWrite a throwaway workflow to the temp/ directory.
workflow_get but excluded from workflow_list resultsBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Workflow library:
name@version, built at startup from workflows-yaml/categories/ recursivelyfs.watch recursive) rebuilds the index on any add/change/remove; debounced to avoid thrash_index.json snapshot written on every rebuild for external tooling and debuggingWORKFLOWS_DIR, GLOBAL_INSTRUCTIONS_PATH, and debounce intervalAgent-friendly output:
workflow_get always includes globalInstructions alongside the workflow — no second call neededsource field (permanent | temp) on every workflow_get responsereason codes (not_found, version_not_found, already_exists, index_unavailable) so callers can branch on error type rather than parsing messagesworkflow_list with includeTools: true surfaces all MCP server/tool dependencies at a glanceNo API keys required. The server reads from a local workflows-yaml/ directory by default.
Add the following to your MCP client configuration file:
{
"mcpServers": {
"workflows-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/workflows-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"WORKFLOWS_DIR": "/absolute/path/to/your/workflows-yaml"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"workflows-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/workflows-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"WORKFLOWS_DIR": "/absolute/path/to/your/workflows-yaml"
}
}
}
}Or with Docker:
{
"mcpServers": {
"workflows-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-v", "/absolute/path/to/your/workflows-yaml:/workflows-yaml",
"-e", "WORKFLOWS_DIR=/workflows-yaml",
"ghcr.io/cyanheads/workflows-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpThe repository ships a workflows-yaml/ directory with example workflows organized under categories/. These are ready to use as a starting point. The workflows-yaml/global_instructions.md file contains instructions the server prepends to every workflow_get response — edit it to set global guidance for your agent.
workflows-yaml/ seed).git clone https://github.com/cyanheads/workflows-mcp-server.gitcd workflows-mcp-serverbun installcp .env.example .env
# edit .env if needed — most settings have defaults| Variable | Description | Default |
|---|---|---|
WORKFLOWS_DIR | Absolute or relative path to the workflows root directory. | ./workflows-yaml |
GLOBAL_INSTRUCTIONS_PATH | Path to the global instructions markdown file. Derives from WORKFLOWS_DIR when not set. | <WORKFLOWS_DIR>/global_instructions.md |
WATCHER_DEBOUNCE_MS | Milliseconds to debounce filesystem change events before rebuilding the index. | 500 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t workflows-mcp-server .
docker run --rm \
-v /path/to/workflows-yaml:/workflows-yaml \
-e WORKFLOWS_DIR=/workflows-yaml \
-p 3010:3010 \
workflows-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/workflows-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and inits the workflow index service. |
src/config/ | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools/ | Tool definitions (*.tool.ts). |
src/services/workflow-index/ | WorkflowIndexService — YAML parsing, index build, watcher, semver lookup, write helpers. |
tests/ | Unit and integration tests mirroring src/. |
workflows-yaml/ | Seed workflow library — categories/ for permanent workflows, temp/ for throwaway ones, global_instructions.md for agent-global guidance. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped loggingsrc/mcp-server/tools/definitions/index.tsWorkflowIndexService, not directly in tool handlersIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.