flowviantBLOCK
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. This daemon holds your sessions, keeps a worktree per tab, and ships branches on your word. The daemon does not send your Claude, Codex or GitHub logins to Flowviant; it shells out to CLIs you signed in yourself.
curl -fsSL https://api.flowviant.com/install.sh | sh flowviant # approve the code in Flowviant → connected
Login keeps going straight into the daemon — there is no second command to run.
What it does
A Flowviant project has ONE machine, and this is it: one box, running one Claude (or Codex, or Antigravity) account, serving the whole team's sessions so nobody has to set up their own. Solo and team are the same architecture at N=1 and N>1.
You work in the Workbench, where your sessions are TABS — each one a held context plus a persistent git worktree on its own session/ branch. The browser is a terminal projected onto this machine, so you reach the same session from any device. When you say ship, the tab merges its own branch into base with --no-ff — no squash, so the commit shas the work reported still exist on main.
Because it drives the CLIs you're already logged into, the cost is yours (your Claude subscription, your GitHub) and the daemon does not send your logins — it shells out to tools you authenticated yourself, and reads Claude Code's credential file only for its expiry and plan type. What a turn prints is relayed as printed, after redaction (see Security posture).
Requirements
On the machine that runs the daemon:
- at least one coding CLI installed and signed in — Claude Code (
claude), Codex (codex) or Antigravity (agy) - git (Node 20+ is needed only for a Node-based install)
- [GitHub CLI](https://cli.github.com) (
gh) — optional; the daemon o
e1add7bc5f86OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add flowviant --env CF_API_TOKEN=${CF_API_TOKEN} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env FLOWVIANT_MACHINE_TOKEN=${FLOWVIANT_MACHINE_TOKEN} --env FLOWVIANT_MCP_TOKEN=${FLOWVIANT_MCP_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"flowviant": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CF_API_TOKEN": "${CF_API_TOKEN}",
"CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
"FLOWVIANT_MACHINE_TOKEN": "${FLOWVIANT_MACHINE_TOKEN}",
"FLOWVIANT_MCP_TOKEN": "${FLOWVIANT_MCP_TOKEN}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
stage_card | read | Stage a card. |
Trust audit
BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
* KEY="-----BEGIN RSA PRIVATE KEY-----
exec(bin, ['--version'], { stdio: 'ignore', timeout });const out = String(exec(shell, ['-ilc', `printf '\\n${MARK}%s\\n' "$PATH"`], {url: `http://127.0.0.1:${port}${path}`,const src = String(text).replace(/^/, '');
'WITH_EQUALS=postgres://u:p@h/db?a=1&b=2',
'DATABASE_URL=postgres://user:pw@host/db',
'postgres://user:pw@host/db',
{ name: 'DATABASE_URL', value: 'postgres://app:[email protected]:5432/x-Secret_tail' },const SECRET = 'Straddle-Deploy_Secret-9f8e7d6c5b4a';
const SECRET = 'Straddle-Secret_9x8y7z6w5v';
const SECRET = 'Audit-Straddle_secret-77aa88bb';
const SECRET = 'diff-Learned_secret-0a1b2c3d';
'-----BEGIN RSA PRIVATE KEY-----',
!scan.values.some((v) => v.value.includes('-----BEGIN RSA PRIVATE KEY-----')),const narration = 'the CLI printed -----BEGIN RSA PRIVATE KEY----- while reading the fixture';
'KEY="-----BEGIN RSA PRIVATE KEY-----',
const VALUE = 'sk_live_abcdefghijklmnop';
const dir = checkout({ '.dev.vars': 'K=sk_live_abcdefghijklmnop\n' });assert.deepEqual(env.readEnvFileValues(join(dir, '.dev.vars')), [{ name: 'K', value: 'sk_live_abcdefghijklmnop' }]);const NESTED = 'sk_live_nestedDevVars0123';
const mine = 'ssh -i ~/.ssh/deploy_key';
'git diff /home/x/.ssh/id /dev/null',
'git diff ~/.ssh/id_rsa /dev/null',
assert.match(readGuardRefusal('git diff /home/x/.ssh/id /dev/null'), /a path off the checkout/);Gates applied: critical_finding, no_behavioural_pass.
e1add7bc5f86full audit observations/trust-audit/mcp-server/flowviant__cli.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | e1add7bc5f86 | BLOCK | F | 47 | first audit |
Questions
What tools does flowviant expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is flowviant safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (47/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does flowviant need?
It reads CF_API_TOKEN, CLOUDFLARE_API_TOKEN, FLOWVIANT_MACHINE_TOKEN, FLOWVIANT_MCP_TOKEN, GATEWAY_KEY, SOME_FUTURE_VENDOR_TOKEN, SOME_OTHER_VENDOR_TOKEN and VERCEL_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does flowviant run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as flowviant at 0.117.0.
How current is this page?
The grade is for one exact copy of the source (e1add7bc5f86), read on 2026-10-12. The repository is watched and re-audited when it changes.