Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "flowgraf": {
      "type": "http",
      "url": "https://flowgraf.in/api/mcp"
    }
  }
}

claude mcp add --transport http flowgraf https://flowgraf.in/api/mcp

[mcp_servers.flowgraf]
url = "https://flowgraf.in/api/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "flowgraf": {
      "type": "remote",
      "url": "https://flowgraf.in/api/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "flowgraf": {
      "type": "http",
      "url": "https://flowgraf.in/api/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=flowgraf&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZmxvd2dyYWYuaW4vYXBpL21jcCJ9"
}

{
  "servers": {
    "flowgraf": {
      "type": "http",
      "url": "https://flowgraf.in/api/mcp"
    }
  }
}

{
  "mcpServers": {
    "flowgraf": {
      "httpUrl": "https://flowgraf.in/api/mcp"
    }
  }
}

extensions:
  "flowgraf":
    enabled: true
    name: "flowgraf"
    type: streamable_http
    uri: "https://flowgraf.in/api/mcp"
    timeout: 300

Quality 74 / 100needs work

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene64 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length2 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: create_diagram (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); edit_diagram (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_diagram (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)
pass
tools.token_costabout 4,145 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependencies67 · weight 15

pass
deps.known_vulnsno known advisory in 98 resolved packages
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 1.26.0 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
pass
deps.resolvable[email protected] resolved: 98 packages

3 tools, about 4,145 tokens to load them all · tool set e54afe592b52 · checked 2026-10-20 11:40 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 43 / 100

no-repository

provenance45

liveness0

freshness65

hygiene80

+dns-namespace -unreachable(10 failures) ~updated-103d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

[email protected] npm97 dependencies, resolved · MCP SDK @modelcontextprotocol/sdk 1.26.0 · advisories checked 2026-10-19

advisory	severity	package	fixed in
GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server	high	`@modelcontextprotocol/[email protected]`MCP SDK, direct	fixed in `1.31.0`

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://flowgraf.in/api/mcp` streamable-http	none	no (10 failures)	76%	900 ms	2025-11-25	2026-09-28

package	registry	version	runtime	secrets
`flowgraf-mcp`	npm	0.1.2	–

Tools (3)

`create_diagram`	Create a NEW architecture diagram from a graph that YOU author, and get back a shareable, editable canvas URL plus a rendered SVG and Mermaid. You produce only the SEMANTICS — nodes, the groups (VPC/cluster/...) they live in, and the directed edges between them. You do NOT lay anything out: never send x/y/position/pinned. A deterministic layout engine computes all geometry and an icon layer picks the pictures from each node's kind. kind.catalog is one of aws \| gcp \| azure \| k8s \| saas \| generic, each with rich per-catalog kind.types (e.g. aws:lambda, gcp:bigquery, azure:cosmos_db, k8s:deployment, saas:kafka): - "aws" (api_gateway, lambda, s3, rds, dynamodb, sqs, bedrock, kinesis, fargate, eventbridge, aurora, ...). - "gcp" (compute_engine, gke, cloud_run, cloud_sql, spanner, firestore, bigquery, pubsub, dataflow, vertex_ai, ...). - "azure" (virtual_machine, aks, app_service, functions, blob_storage, sql_database, cosmos_db, service_bus, event_hubs, key_vault, ...). - "k8s" (pod, deployment, statefulset, daemonset, job, cronjob, service, ingress, configmap, secret, hpa, ...). - "saas" for hosted third-parties (redis, postgresql, mysql, mongodb, kafka, stripe, twilio, auth0, github, cloudflare, ...). - "generic" primitive when nothing branded fits: service, database, cache, queue, user, external_system, storage, gateway, function, note. - "generic" FLOWCHART kinds for processes/flowcharts: process, decision, terminator, data, document, subprocess. edge.kind is one of: request, response, async_event, data_flow, dependency, network, generic. WORKED EXAMPLE — a user hitting an API in a VPC that talks to Postgres: { "title": "Web API", "domain": "cloud_architecture", "graph": { "groups": [{ "id": "g_vpc", "label": "VPC", "type": "vpc" }], "nodes": [ { "id": "n_user", "label": "User", "kind": { "catalog": "generic", "type": "user" } }, { "id": "n_api", "label": "API", "kind": { "catalog": "aws", "type": "api_gateway" }, "parentId": "g_vpc" }, { "id": "n_db", "label": "Postgres", "kind": { "catalog": "aws", "type": "rds" }, "parentId": "g_vpc" } ], "edges": [ { "id": "e1", "source": "n_user", "target": "n_api", "kind": "request" }, { "id": "e2", "source": "n_api", "target": "n_db", "kind": "data_flow" } ] } } Returns { diagramId, url, svg, mermaid, version }. Give the user the url — opening it shows the same diagram on an editable canvas (anonymous; it's theirs to claim by signing in). To change the diagram afterwards, use get_diagram then edit_diagram.
`edit_diagram`	Apply a list of operations to an EXISTING diagram. The ops re-use this tool's op vocabulary; you author them, we validate + apply + re-layout + re-render. ALWAYS call get_diagram(diagramId) first: it returns the current ids and the `version`. Pass that version as `baseVersion`. If the diagram changed since you fetched it, you get a STALE_VERSION error telling you the current version — refetch with get_diagram, recompute your ops, and retry. The operations (each element of `ops`): - add_node { op, node:{ id, label, kind, parentId? } } - remove_node { op, id } (also drops edges touching the node) - update_node { op, id, patch:{ label?, kind?, parentId?, metadata? } } - add_edge { op, edge:{ id, source, target, kind, label?, directed? } } - remove_edge { op, id } - update_edge { op, id, patch:{ source?, target?, label?, kind?, directed? } } - add_group { op, group:{ id, label, type, parentId? } } - remove_group{ op, id } - move_to_group { op, nodeId, groupId } (groupId null un-nests the node) - set_layout { op, patch:{ direction?, spacing? } } - insert_between { op, newNode:{ id, label, kind, parentId? }, sourceId, targetId, inKind?, outKind? } insert_between IS THE KEY OP for "add X between A and B" requests. It splices newNode onto the existing A→B edge: removes that edge, adds the node, and wires A→newNode→B so the connection re-routes through it automatically. WORKED EXAMPLE — "add a Redis cache between the API and the DB" on the diagram above: 1) get_diagram(diagramId) → shows nodes n_api, n_db and version 1. 2) edit_diagram({ diagramId, baseVersion: 1, ops: [ { "op": "insert_between", "sourceId": "n_api", "targetId": "n_db", "newNode": { "id": "n_redis", "label": "Redis", "kind": { "catalog": "saas", "type": "redis" }, "parentId": "g_vpc" }, "inKind": "request", "outKind": "data_flow" } ] }) The API→DB edge is gone and now flows API→Redis→DB. Never send x/y/position — geometry is computed for you. Node kinds: catalog ∈ {aws, gcp, azure, k8s, saas, generic} with rich per-catalog types (e.g. aws:lambda, gcp:bigquery, azure:cosmos_db, k8s:deployment, saas:kafka), plus generic flowchart kinds (process, decision, terminator, data, document, subprocess). Returns { url, svg, mermaid, appliedOps, version }.
`get_diagram`	Fetch a diagram's raw IR (nodes, groups, edges with their real ids) and its current `version`. Call this before edit_diagram so your ops reference ids that actually exist and you pass the correct baseVersion. Returns { diagram, version }.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "in.flowgraf/flowgraf",
  "title": "Flowgraf",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://flowgraf.in/api/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.1.2",
  "packages": [
    {
      "version": "0.1.2",
      "transport": {
        "type": "stdio"
      },
      "identifier": "flowgraf-mcp",
      "registryType": "npm"
    }
  ],
  "description": "Create and edit architecture diagrams from your AI agent; get an SVG and a live editable canvas."
}