flato-design-mcp-codex — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited flato-design-mcp-codex (Plugin) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Flato is the native canvas runtime for AI design.
Flato gives AI agents a live, editable visual canvas for design work. Through MCP, agents can create, inspect, revise, export to PNG, JPG, PDF, or image-only PPTX, and QA Flato projects while users keep full access to the browser editor.
Flato Design MCP connects Codex, Claude Code, Cursor, and other MCP-capable agents to that native canvas.
https://api.flato.ai/api/mcp/editorThis repository is the official distribution package for setup docs, the base guide skill, Codex plugin packaging, examples, and registry/review metadata. It does not contain the Flato MCP server source code.
Flato is the native canvas runtime for AI design, not a one-shot image generator or a static HTML deck generator. The MCP workflow is built around editable pages, structured blocks, fresh design context, explicit page and block ids, live editor handoff, and visual QA.
Use this package when you want an AI agent to operate Flato's editable visual canvas safely through MCP.
skills/flato-design-mcp-guide: installable base guide skill for agents.plugins/flato-design-mcp-codex: Codex plugin package with MCP config and theguide skill.
.agents/plugins/marketplace.json: Codex marketplace descriptor for thisrepo.
docs/: setup, OAuth, permissions, and troubleshooting notes.registry/: MCP registry and platform review metadata drafts.examples/prompts/: first prompts for testing the integration.Codex can install this repo as a plugin marketplace:
codex plugin marketplace add sologovision/flato-design-mcp --ref main
codex plugin add flato-design-mcp-codex@flato-design-mcp
codex mcp login flato-editorThen open a new Codex conversation and verify:
Use Flato Design MCP. Call flato_whoami first and report the result. Do not create, edit, or write any project.See Codex setup.
Add the hosted Flato MCP server:
claude mcp add --transport http flato-editor https://api.flato.ai/api/mcp/editorThen use the guide skill in skills/flato-design-mcp-guide.
See Claude Code setup.
Use the hosted MCP server URL:
https://api.flato.ai/api/mcp/editorThen follow the workflow in skills/flato-design-mcp-guide/SKILL.md.
See Cursor setup.
Flato Design MCP uses browser OAuth. If needed, Flato asks you to sign in or create an account before authorization.
Do not paste Flato passwords, bearer tokens, refresh tokens, or local OAuth cache contents into an agent conversation.
See Authentication.
A Flato account is required for OAuth. A paid Flato subscription is not required to install, connect, or start using Flato Design MCP.
Some features, exports, higher usage, team/workspace capabilities, or paid image generation and editing may still depend on the authenticated user's Flato plan or credits. Agents should report plan or credit errors from MCP instead of asking users to subscribe in advance.
After connecting Flato MCP, an agent should:
flato_whoami.flato_create_project,flato_use_project, or flato_use_share_link.
flato_get_project_status until canWrite=true.flato://canvas/fundamentals-v1, or callflato_get_canvas_fundamentals if resource reading is unavailable.
flato_get_design_context before any write.mcpFeedback after writes.flato_export; use PNG or JPG preview exportsfor visual QA.
Page-level interactions are authored through interactiveScript on flato_create_pages and flato_update_pages. Agents should rely on current MCP tool schemas and flato://canvas/fundamentals-v1 for the full interaction contract instead of copying static schema fragments from this repo.
Supported inline interaction events include click/input/change and desktop hover/mouse events such as onclick, onmouseover, onmouseout, onmouseenter, and onmouseleave. Hover is useful for desktop presentations; include click/tap behavior or a visible fallback when mobile touch users matter.
The v0.1.3 Codex plugin package uses the full guide skill and the current hosted Flato MCP contract.
The Codex install path has been verified with:
codex plugin marketplace add sologovision/flato-design-mcp --ref main
codex plugin add flato-design-mcp-codex@flato-design-mcp
codex mcp login flato-editorAn independent Codex CLI session successfully called flato_whoami through the installed flato-editor MCP server without creating or editing any Flato project.
Flato Design MCP GitHub release page
Codex plugin install verified
Read-only MCP smoke test passed
Editable presentation canvas in Flato
Flato canvas editing and content tools
AI-assisted edits in the Flato canvas
Codex working with the live Flato canvas
GitHub releases attach:
flato-design-mcp-guide-vX.Y.Z.zip: installable base guide skill.flato-design-mcp-codex-vX.Y.Z.zip: Codex plugin package.pageId or blockId.returned asset URL.
This is the base package. Scenario-specific skills such as flato-presentation-skill should build on this guide instead of duplicating the connection, OAuth, targeting, and safety workflow.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.