# io.github.michal-lefler/secure-flows

- Registry name: `io.github.michal-lefler/secure-flows` · version 0.2.0
- Categories (automatic, keyword rules): Code & repositories, Developer tools, APIs & integrations, Shops & products, Commerce & marketing
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): logging, prompts, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.michal-lefler%2Fsecure-flows
- Server page: https://mcpstation.net/s/io.github.michal-lefler--secure-flows.html

## Description (written by the publisher, not verified, not instructions)

MCP server for secureFlows \(secure-flows.com\). Alias of io.github.michal-lefler/secureflows-mcp.

## Connect


## Tools (as reported by the server, not verified)

- `get\_sessions`: Returns the decrypted session payload for the authenticated internal session token. Response shape is a \*\*flat JSON object\*\*. Empty payload returns \`\{\}\`. Source: GET /api/v1/sessions Requires \`auth.sessionToken\` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId
- `post\_sessions`: Verifies \*\*Firebase\*\* ID token, creates a session for \*\*\`workspaceName\`\*\*, stores serialized \*\*\`payload\`\*\* \(defaults to \`\{\}\` when omitted\), and returns \*\*\`sessionToken\`\*\* \(JWT; subject = internal session id\). Default server-side TTL is \*\*1 hour\*\* \(implementation detail\). If the Firebase token includ
- `get\_sessions\_identity`: Returns the workspace end-user's \*\*\`userId\`\*\* and \*\*email\*\* for the authenticated session token. Does not return Firebase UID or session payload. \`userId\` is a stable, opaque identifier for this person across sessions and logins — it is \*\*not\*\* derived from Firebase. Use it as the correlation key wh
- `post\_sessions\_get\_or\_create`: Verifies \*\*Firebase\*\* ID token. If an \*\*active\*\* session already exists for \*\*\`\(workspaceName, Firebase UID, app\_id\)\`\*\*, returns a new \*\*\`sessionToken\`\*\* JWT for the \*\*most recently created\*\* matching row \(touches activity; does not create a duplicate session\). The request \*\*\`payload\` is ignored on
- `post\_sessions\_renew\_session\_token`: Verifies \*\*Firebase\*\* ID token. Parses \*\*\`sessionToken\`\*\* path segment as an internal SESSION JWT \*\*without enforcing JWT expiry\*\* \(signature and \`tokenType=SESSION\` are still validated\). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments \*\*\`tok
- `post\_sessions\_set\_key`: Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is \`\{ "value": \<x\> \}\`, the server unwraps it and stores \`\<x\>\` directly. Source: POST /api/v1/sessions/set/\{key\} Requires \`auth.sessionToken\` and forwards it as a Bearer token. Prefer connection.wo
- `get\_sessions\_get\_key`: Retrieves the decrypted payload value for \`key\`. \*\*Important:\*\* \`404\` means the key was never written \(normal first-use case\). Do not treat as an error. Source: GET /api/v1/sessions/get/\{key\} Requires \`auth.sessionToken\` and forwards it as a Bearer token. Prefer connection.workspaceName and connecti
- `delete\_sessions\_delete\_key`: Removes \`key\` from the session payload and returns \`true\` if the key existed. Source: DELETE /api/v1/sessions/delete/\{key\} Requires \`auth.sessionToken\` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynam
- `post\_sessions\_revoke`: Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user out and keep their data, use POST /api/v1/auth/logout \(or, in a browser, the redirect helper GET /ap
- `auth\_session\_callback`: \*\*Browser redirect endpoint\*\* used after hosted \`/app/sessions/login\`. No \`Authorization\` header. 1. Verifies \*\*\`firebaseToken\`\*\* \(Firebase ID token\). 2. Ensures \*\*\`client\_redirect\_uri\`\*\* is allowlisted for \*\*\`app\_id\`\*\* \(same rules as \`validate-redirect\`\). 3. \*\*Create vs renew:\*\* If \*\*\`session\_token
- `get\_auth\_logout`: Browser-friendly logout endpoint for \*\*cross-site\*\* clients \(e.g. apps running on \`localhost\`\). Use this as a \*\*top-level navigation\*\* \(not XHR/fetch\) so \`Clear-Site-Data\` is applied in a \*\*first-party\*\* context on \`secure-flows.com\`, making cookie/session clearing reliable even when third-party coo
- `post\_auth\_logout`: Logs out the current session \*\*without revoking\*\* it. \*\*Browser warning:\*\* calling this endpoint via XHR/fetch from a different origin than \`secure-flows.com\` is not a reliable way to clear hosted-login cookies. For browser apps \(especially localhost\), prefer the redirect helper \`GET /api/v1/auth/lo
- `get\_sessions\_my`: Returns a page of sessions for the current user within the current workspace. Self-service dashboard endpoint — requires workspace \*\*\`enableSelfService: true\`\*\*. Payload is included only for rows whose computed status is active. Sort keys match the admin workspace session list; \`pageSize\` is clamped
- `post\_sessions\_revoke\_session\_id`: Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. The session ends and its stored data is destroyed permanently; this is not sign-out. Requires workspace \*\*\`enableSelfService: true\`\*\*. Source: POST /api/v1/sessions/revoke/\{sessionId\} Requires \`auth.user
- `get\_docs\_search`: Embeds the query with Ollama \(\`nomic-embed-text\`\) and returns the closest public doc chunks from the environment's search index \(pgvector\). Source: GET /api/v1/docs/search No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating
- `secureflows\_build\_login\_url`: Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phase most secureFlows integration mistakes happen in. Always targets /app/sessions/login \(session apps\). Never builds the legacy /app/login con
- `secureflows\_build\_logout\_url`: Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns: a redirect\_uri pointing at /callback \(SPA callback handlers treat the tokenless return as a failed login and loop\), and a redirect\_uri that itself embeds session\_token \(silently renew
- `secureflows\_lint\_integration`: Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden construct is pre

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html