artifactflowBLOCK
Open-source, self-hosted, versioned vault for AI-generated HTML, Markdown, Mermaid, and image artifacts, with scoped MCP access and isolated two-origin previews.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Your AI work, in one place.
Open-source, self-hosted, model-agnostic workspace for AI-generated artifacts.
Website · How it works · MCP · Self-hosting
[](LICENSE) [](COMMERCIAL.md) [](#status)
Useful AI work gets scattered across chats, downloads, repositories, and people. ArtifactFlow gives your team and authorized AI clients one shared place to keep, find, share, and continue working on the outputs worth retaining.
Screenshots show the fictional Northstar Labs team and sample content.
What you can do
- Keep and organize: save artifacts in personal or shared workspaces with owners, categories, tags, and page hierarchy.
- Find and share: search content and metadata, apply workspace roles and page permissions, or create narrow revocable expiring or one-time page links.
- Get back to work: use private favorites and recently opened pages, jump to a page with Cmd/Ctrl+K, or browse the paginated Library.
- Continue the work: append versions, compare source, and restore retained content. History follows configurable retention limits; stale writes are rejected.
- Reuse with AI: MCP-compatible clients can search, read, create, update, and organize the same library. Tokens have explicit operation and workspace scopes, capped at Editor authority.
System Admins can configure MCP token lifetime limits up to 365 days in Administration > Storage and limits. See MCP setup for defaults, issuanc
83a52fab80dcOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add artifactflow-xlsx-viewer-spike --env ARTIFACTFLOW_MCP_TOKEN=${ARTIFACTFLOW_MCP_TOKEN} --env AUTH_HEADER=${AUTH_HEADER} --env NODE_TLS_REJECT_UNAUTHORIZED=${NODE_TLS_REJECT_UNAUTHORIZED} --env REVERB_APP_KEY=${REVERB_APP_KEY} -- npx -y [email protected]{
"mcpServers": {
"artifactflow-xlsx-viewer-spike": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ARTIFACTFLOW_MCP_TOKEN": "${ARTIFACTFLOW_MCP_TOKEN}",
"AUTH_HEADER": "${AUTH_HEADER}",
"NODE_TLS_REJECT_UNAUTHORIZED": "${NODE_TLS_REJECT_UNAUTHORIZED}",
"REVERB_APP_KEY": "${REVERB_APP_KEY}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
read | read | Read fixture |
Trust audit
BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (19 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
assert_prompt_finding("-----BEGIN PRIVATE KEY-----\nabc", "private_key")ContentScanRule::pattern(ContentFindingSeverity::Warning, 'eval', 'Dynamic code execution using eval() was found.', '/\beval\s*\(/i'),
ContentScanRule::pattern(ContentFindingSeverity::Warning, 'new_function', 'Dynamic code execution using new Function() was found.', '/\bnew\s+Function\s*\(/i'),
$(PDF_PROCESSOR_SPIKE_IMAGE) -ec 'for target in http://127.0.0.1:9 http://169.254.169.254 http://example.com; do if wget -q -T 2 -O /dev/null "$$target"; then echo "network probe unexpectedly succeede
foreach ([[getenv("CALLBACK_TARGET"), 8000], ["169.254.169.254", 80]] as [$host, $port]) {const targets = [[process.env.CALLBACK_TARGET, 8000], ["169.254.169.254", 80]];
foreach ([[getenv("CALLBACK_TARGET"), 8000], ["169.254.169.254", 80]] as [$host, $port]) {ARTIFACT_URL=http://127.0.0.1:18081
E2E_ARTIFACT_URL ?= http://127.0.0.1:$(E2E_ARTIFACT_HOST_PORT)
$(PDF_PROCESSOR_SPIKE_IMAGE) -ec 'for target in http://127.0.0.1:9 http://169.254.169.254 http://example.com; do if wget -q -T 2 -O /dev/null "$$target"; then echo "network probe unexpectedly succeede
--header 'X-Forwarded-For: 127.0.0.1' "http://127.0.0.1:$$host_port/health")"; \
'artifact_url' => env('ARTIFACT_URL', 'http://127.0.0.1:18081'),password: 'a-strong-password-123',
private const string SECRET = 'test-docx-processor-shared-secret-00001';
xlsxValues: ['Initial workbook', 'password: "correct-horse-battery-staple"'],
docxTexts: ['Initial Word text', 'password: "correct-horse-battery-staple"'],
'password: "correct-horse-battery-staple"',
yield 'github classic token' => ['ghp_1234567890abcdefghijklmnopqrstuvwxyzABCD', 'github_token'];
yield 'github fine grained token' => ['github_pat_1234567890ABCDEFGHIJ_abcdefghijklmnopqrstuvwxyz', 'github_token'];
yield 'private key' => ['-----BEGIN PRIVATE KEY-----', 'private_key'];
yield 'generic api key assignment' => ['api_key = "sk_live_1234567890abcdef"', 'credential_assignment'];
'api_key<!-- split -->= sk_live_1234567890abcdef',
app-artifact-live-1200.avif
app-artifact-live-1600.avif
app-artifact-live-800.avif
Gates applied: critical_finding, no_behavioural_pass.
83a52fab80dcfull audit observations/trust-audit/mcp-server/gadsotek__artifactflow.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 83a52fab80dc | BLOCK | F | 44 | first audit |
Questions
What is the artifactflow MCP server?
Open-source, self-hosted, versioned vault for AI-generated HTML, Markdown, Mermaid, and image artifacts, with scoped MCP access and isolated two-origin previews.
What tools does artifactflow expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is artifactflow safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (44/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does artifactflow need?
It reads ARTIFACTFLOW_MCP_TOKEN, AUTH_HEADER, NODE_TLS_REJECT_UNAUTHORIZED, REVERB_APP_KEY and XLSX_PROCESSOR_SHARED_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does artifactflow run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as artifactflow-xlsx-viewer-spike at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (83a52fab80dc), read on 2026-10-11. The repository is watched and re-audited when it changes.