Flowapi Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Flowapi Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Model Context Protocol (MCP) server for integration with FlowAPI system operations.
This MCP server provides system-level access to FlowAPI endpoints through Claude Code integration, enabling automated operations with sys_key authentication only. The server focuses on read operations and system queries that work reliably with system-level authentication.
list_arts - Get list of arts with filters and paginationget_art - Get detailed art information by IDget_recommended_arts - Get recommended arts for discoverylist_art_collections - List art collections with optional filtersget_art_collection - Get collection details by IDsearch_users - Search users with filters and paginationget_user - Get user information by various IDs (user_id, webapp_user_id, telegram_user_id, discord_user_id, camunda_user_id)get_user_wallets - Retrieve user wallet informationget_invited_wallets - Get invited wallet addresses for blockchain integrationget_invited_wallets_by_token - Get invited wallets for specific tokenlist_external_workers - List external worker configurationsget_external_worker - Get external worker detailslist_strategies - List available strategiesget_strategy - Get strategy detailshealth_check - Check API health and statusget_available_tools - List all available MCP toolsnpm install
npm run buildCopy the example configuration:
cp .env.example .envEdit .env with your FlowAPI configuration:
# FlowAPI Configuration
FLOW_API_URL=https://your-flowapi-instance.com/api
FLOW_API_SYS_KEY=your-system-key-here
# Environment
NODE_ENV=production
# Logging
LOG_LEVEL=info
# MCP Server Configuration
MCP_SERVER_NAME=flowapi-server
MCP_SERVER_VERSION=1.0.0npm run devnpm run build
npm start# Test all available endpoints
node dist/test-final.jsAdd to your Claude Code MCP configuration (~/.claude/mcp_servers.json):
{
"mcpServers": {
"flowapi": {
"command": "node",
"args": ["/path/to/flowapi-mcp-server/dist/index.js"],
"env": {
"FLOW_API_URL": "https://your-flowapi-instance.com/api",
"FLOW_API_SYS_KEY": "your-system-key-here",
"NODE_ENV": "production"
}
}
}
}This server exclusively uses system key authentication (X-SYS-KEY header) for all operations. JWT-dependent endpoints have been removed to ensure reliability and consistency.
// Get the first 10 arts
await client.getArts(10, 0, '{"active": true}');// Search for premium users
await client.searchUsers({
is_premium: true,
page: 1,
page_size: 10
});// Get user by different ID types
await client.getUserBy({ user_id: "uuid-here" });
await client.getUserBy({ camunda_user_id: "camunda-id" });
await client.getUserBy({ webapp_user_id: "webapp-uuid" });The following endpoints were removed due to JWT authentication requirements:
create_art - Requires user context via JWTupdate_art - Requires user ownership validationcreate_art_collection - Requires user authenticationget_next_arts - Requires user personalizationget_arts_history - Requires user contextFlowApiClienthandle functionnpm testMIT License - see LICENSE file for details.
For issues and questions, please use the GitHub Issues page.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.