MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
| Endpoint | https://www.secure-flows.com/mcp (streamable-http) |
|---|---|
| Registry version | 0.2.0 |
| Now | 18 tools · grade F (38) · pin ts_579e131c39e620ba181d1a04457138ef · protocol 2025-06-18 |
| First / last listed | 2026-11-11 01:30 UTC / 2026-11-11 01:30 UTC |
| Grade over time | 2026-11-11: F (38), 18 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: get_sessions post_sessions get_sessions_identity post_sessions_get_or_create post_sessions_renew_session_token post_sessions_set_key get_sessions_get_key delete_sessions_delete_key post_sessions_revoke auth_session_callback get_auth_logout post_auth_logout get_sessions_my post_sessions_revoke_session_id get_docs_search secureflows_build_login_url secureflows_build_logout_url secureflows_lint_integration
get_sessions | Returns the decrypted session payload for the authenticated internal session token.
Response shape is a **flat JSON object**. Empty payload returns `{}`.
Source: GET /api/v1/sessions
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically. params: connection*, auth, params, query, body |
post_sessions | Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized
**`payload`** (defaults to `{}` when omitted), and returns **`sessionToken`** (JWT; subject = internal session id).
Default server-side TTL is **1 hour** (implementation detail).
If the Firebase token includes **`email`**, the server best-effort persists it on the workspace
end-user row (for audit display params: connection*, auth, params, query, body* |
get_sessions_identity | Returns the workspace end-user's **`userId`** and **email** for the authenticated session
token. Does not return Firebase UID or session payload.
`userId` is a stable, opaque identifier for this person across sessions and logins — it is
**not** derived from Firebase. Use it as the correlation key when your own backend needs to
link an external event (e.g. a billing provider webhook you receive an params: connection*, auth, params, query, body |
post_sessions_get_or_create | Verifies **Firebase** ID token. If an **active** session already exists for
**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most
recently created** matching row (touches activity; does not create a duplicate session). The request
**`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a
dedicated `app_id` per inte params: connection*, auth, params, query, body* |
post_sessions_renew_session_token | Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without
enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the
session by id from the token subject; the Firebase UID must match the session owner.
Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id,
older revision) are no lo params: connection*, auth, params*, query, body |
post_sessions_set_key | Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores `<x>` directly.
Source: POST /api/v1/sessions/set/{key}
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically params: connection*, auth, params*, query, body* |
get_sessions_get_key | Retrieves the decrypted payload value for `key`.
**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.
Source: GET /api/v1/sessions/get/{key}
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically. params: connection*, auth, params*, query, body |
delete_sessions_delete_key | Removes `key` from the session payload and returns `true` if the key existed.
Source: DELETE /api/v1/sessions/delete/{key}
Requires `auth.sessionToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically. params: connection*, auth, params*, query, body |
post_sessions_revoke | Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user out and keep their data, use POST /api/v1/auth/logout (or, in a browser, the redirect helper GET /api/v1/auth/logout). Call revoke only when the user or an admin deliberately wants the session and its params: connection*, auth, params, query, body |
auth_session_callback | **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.
1. Verifies **`firebaseToken`** (Firebase ID token).
2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`).
3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for
**`(workspace_name, Firebase UID, app_id params: connection*, auth, params, query*, body |
get_auth_logout | Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).
Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a
**first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when
third-party cookies are blocked.
**Critical client rules:**
- Clear your in-app `sessionToken` state **before** n params: connection*, auth, params, query*, body |
post_auth_logout | Logs out the current session **without revoking** it.
**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`
is not a reliable way to clear hosted-login cookies. For browser apps (especially localhost), prefer the
redirect helper `GET /api/v1/auth/logout?session_token=...&redirect_uri=...`.
Behavior:
- **Invalidates** the current `sessionToken` b params: connection*, auth, params, query, body |
get_sessions_my | Returns a page of sessions for the current user within the current workspace.
Self-service dashboard endpoint — requires workspace **`enableSelfService: true`**.
Payload is included only for rows whose computed status is active.
Sort keys match the admin workspace session list; `pageSize` is clamped to 1–200 (default 20).
Source: GET /api/v1/sessions/my
Requires `auth.userToken` and forwards it a params: connection*, auth, params, query*, body |
post_sessions_revoke_session_id | Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.
The session ends and its stored data is destroyed permanently; this is not sign-out.
Requires workspace **`enableSelfService: true`**.
Source: POST /api/v1/sessions/revoke/{sessionId}
Requires `auth.userToken` and forwards it as a Bearer token.
Prefer connection.workspaceName and connection.appId as s params: connection*, auth, params*, query, body |
get_docs_search | Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks
from the environment's search index (pgvector).
Source: GET /api/v1/docs/search
No Authorization header is required.
Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically. params: connection*, auth, params, query*, body |
secureflows_build_login_url | Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time,
before any user session exists, which is the phase most secureFlows integration mistakes happen in.
Always targets /app/sessions/login (session apps). Never builds the legacy /app/login console URL,
which returns a firebaseToken your SecureFlowsCallback handler cannot consume and causes params: origin, workspaceName*, appId*, redirectUri*, intent, expiredToken |
secureflows_build_logout_url | Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns:
a redirect_uri pointing at /callback (SPA callback handlers treat the tokenless return as a failed login and loop),
and a redirect_uri that itself embeds session_token (silently renews the old session instead of signing out).
The result always instructs top-level navigation, never params: origin, sessionToken*, postLogoutRedirectUri* |
secureflows_lint_integration | Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at
scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set.
Two kinds of findings:
• scope "file" — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout,
client-side JWT decode, e params: files* |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.