io.github.michal-lefler/secure-flows (MCP)

This MCP server provides access for secureFlows (secure-flows.com). It is an alias using the name io.github.michal-lefler/secure-flows, described as a hyphenated form intended to be discoverable in both GitHub and the MCP Registry.

🛠️ Key Features

Implements a Model Context Protocol (MCP) server
Tool set count: 18
Topics: ai-agents, authentication, mcp, mcp-server, model-context-protocol, secureflows, vibe-coding

🚀 Use Cases

Making the secureFlows MCP server findable under an alternate listing name for secure-flows
Registering a second MCP Registry listing that resolves a different search term

⚡ Developer Benefits

“Same live server, distinct listing” supports multiple registry search strings
Listing name alignment for secure-flows.com vs the primary secureflows-mcp listing

⚠️ Limitations

Repository exists primarily for discoverability; the readme excerpt focuses on registry/GitHub listing behavior rather than additional functionality

secure-flows

This repo exists so secure-flows — the hyphenated form matching the product domain (secure-flows.com) — is findable both on GitHub and in the MCP Registry, alongside the primary io.github.michal-lefler/secureflows-mcp listing (registry search does a literal substring match against the listing name only, and secure-flows is not a substring of secureflows-mcp, so a second listing was the only way to make both search terms resolve).

Same live server, distinct listing. The MCP Registry rejects a second listing whose remotes[].url string exactly matches an existing one — it does not check whether the URL actually resolves to the same backend. This listing's remotes[].url is https://www.secure-flows.com/mcp?alias=secure-flows: a harmless query string appended to the real endpoint. nginx's routing ignores it, so it reaches the exact same running MCP server — this is not a fork, a proxy, or separate infrastructure, just a distinct URL string to satisfy the registry's uniqueness check.

This is not a separate server or a separate codebase. For the actual MCP server source, tests, and npm package, see michal-lefler/secureflows-mcp (npm: secureflows).

Configure your AI agent

json

{
  "mcpServers": {
    "secureflows": {
      "url": "https://www.secure-flows.com/mcp"
    }
  }
}

Product: www.secure-flows.com

connection	object	required
auth	object	optional
params	object	optional
query	object	optional
body	any	optional

connection	object	required
auth	object	optional
params	object	optional
query	object	optional
body	object	required

connection	object	required
auth	object	optional
params	object	optional
query	object	optional
body	any	optional

connection	object	required
auth	object	optional
params	object	optional
query	object	optional
body	object	required

connection	object	required
auth	object	optional
params	object	required
query	object	optional
body	any	optional

io.github.michal-lefler/secure-flows

io.github.michal-lefler/secure-flows (MCP)

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

get_sessions

post_sessions

get_sessions_identity

post_sessions_get_or_create

post_sessions_renew_session_token

post_sessions_set_key

get_sessions_get_key

delete_sessions_delete_key

post_sessions_revoke

auth_session_callback

get_auth_logout

post_auth_logout

get_sessions_my

post_sessions_revoke_session_id

get_docs_search

secureflows_build_login_url

secureflows_build_logout_url

secureflows_lint_integration

secure-flows

Configure your AI agent

Install

Remote endpoint

Related servers

origin	string	optional	secureFlows origin — always https://www.secure-flows.com in production
workspaceName	string	required	Workspace name from the human prompt ("workspace = ...")
appId	string	required	App id from the human prompt ("appId = ...")
redirectUri	string	required	The app's unguarded /callback URL, built from the published/allowlisted app origin — never from an iframe or editor chrome origin.
intent	string	optional	fresh_login: normal sign-in, or app-load restore with no prior token (default — almost always correct, including after an explicit sign-out). renew_expired_token: ONLY when resuming the SAME still-intended user after a soft token expiry (401/410) while staying logged in — never after Sign out.
expiredToken	string	optional	The old sessionToken to renew. Only read when intent=renew_expired_token. Setting this after an explicit sign-out is the "send a dead JWT into hosted login" anti-pattern — it breaks renewal when the underlying identity changed.