bots.st/secure-flows
secure-flows
Session login verification and payload encryption
174 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 18
- Answered
- 4 of the last 4 calls
How to reach it
- MCP, HTTP
https://www.secure-flows.com/mcp?alias=secure-flows
What it can do
| Tool | What it says it does |
|---|---|
auth_session_callback | **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If… |
delete_sessions_delete_key | Removes `key` from the session payload and returns `true` if the key existed. Source: DELETE /api/v1/sessions/delete/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields… |
get_auth_logout | Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when third-party… |
get_docs_search | Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks from the environment's search index (pgvector). Source: GET /api/v1/docs/search No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of… |
get_sessions | Returns the decrypted session payload for the authenticated internal session token. Response shape is a **flat JSON object**. Empty payload returns `{}`. Source: GET /api/v1/sessions Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and… |
get_sessions_get_key | Retrieves the decrypted payload value for `key`. **Important:** `404` means the key was never written (normal first-use case). Do not treat as an error. Source: GET /api/v1/sessions/get/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and… |
get_sessions_identity | Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key… |
get_sessions_my | Returns a page of sessions for the current user within the current workspace. Self-service dashboard endpoint — requires workspace **`enableSelfService: true`**. Payload is included only for rows whose computed status is active. Sort keys match the admin workspace session list; `pageSize` is… |
post_auth_logout | Logs out the current session **without revoking** it. **Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com` is not a reliable way to clear hosted-login cookies. For browser apps (especially localhost), prefer the redirect helper `GET… |
post_sessions | Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized **`payload`** (defaults to `{}` when omitted), and returns **`sessionToken`** (JWT; subject = internal session id). Default server-side TTL is **1 hour** (implementation detail). If the Firebase token… |
post_sessions_get_or_create | Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored… |
post_sessions_renew_session_token | Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments… |
post_sessions_revoke | Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user out and keep their data, use POST /api/v1/auth/logout (or, in a browser, the redirect helper GET… |
post_sessions_revoke_session_id | Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. The session ends and its stored data is destroyed permanently; this is not sign-out. Requires workspace **`enableSelfService: true`**. Source: POST /api/v1/sessions/revoke/{sessionId} Requires… |
post_sessions_set_key | Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ "value": <x> }`, the server unwraps it and stores `<x>` directly. Source: POST /api/v1/sessions/set/{key} Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer… |
secureflows_build_login_url | Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phase most secureFlows integration mistakes happen in. Always targets /app/sessions/login (session apps). Never builds the legacy /app/login… |
secureflows_build_logout_url | Builds a correct redirect-logout URL and refuses to build one that violates the two documented logout anti-patterns: a redirect_uri pointing at /callback (SPA callback handlers treat the tokenless return as a failed login and loop), and a redirect_uri that itself embeds session_token (silently… |
secureflows_lint_integration | Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden… |
In its maker's words
MCP server for secureFlows (secure-flows.com). Alias of io.github.michal-lefler/secureflows-mcp.
- Website
- www.secure-flows.com
- Source
- github.com/michal-lefler/secure-flows
- Publisher
- michal-lefler (2 listings in the registry)
- Listed from
- the official MCP Registry as
io.github.michal-lefler/secure-flows - Version
- 0.2.0, updated 25 Aug 2026
- Kinds of work
- Security and trust, Browser and automation, Documents and files
The domain it lives on
- secure-flows.com
- registered 14 Apr 2026 (7 months ago), at Cloudflare, Inc., its home page is a working site
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 174 ms | |
| Answered | 114 ms | |
| Answered | 85 ms | |
| Answered | 85 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.