Pipefy ToolkitBLOCK
MCP server, CLI, and agent skills for Pipefy.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
<img src="docs/images/pipefy-developers-banner.png" alt="Pipefy Developers — AI Toolkit (MCP Server, Pipefy CLI, GraphQL SDK, Agent Skills)" width="100%" />
Overview • Installation • Repository layout • MCP server • CLI • Agent skills • Documentation • Development • Contributing • Legal
Overview
b66076a1a7fdOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add pipefy-workspace --env PIPEFY_TOKEN=${PIPEFY_TOKEN} -- uvx pipefy-workspace{
"mcpServers": {
"pipefy-workspace": {
"command": "uvx",
"args": [
"pipefy-workspace"
],
"env": {
"PIPEFY_TOKEN": "${PIPEFY_TOKEN}"
}
}
}
}Exposed tools (9)
8 read · 0 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
boom | read | raise RuntimeError( |
delete_probe | destructive | return { |
denied | read | return |
echo | read | return f |
failed_request | read | return tool_error(message, code= |
failing | read | return tool_error(message, code=code, details=details) |
foreign_mcp_tool | read | Pre-existing tool; the lifespan must not touch the tool table. |
foreign_probe | read | return |
probe | read | return { |
Trust audit
BLOCKgrade F · trust 59/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
TOKEN=$(curl -s -X POST https://app.pipefy.com/oauth/token \
- **Service account must be a pipe member.** When a flow runs under a service account, that account must be a member of the target pipe, or pipe-scoped calls under its identity fail with a permission
1. **Get the service account's email.** Either create one with `create_service_account(organization_uuid, name, role)` — which returns the account's email plus its OAuth2 client secret and token endpo
> **Header values are secrets.** `get_webhooks` returns each webhook's `headers` unmasked, and they usually hold authorization tokens or API keys. In a reply, name only the header keys (for example `A
data = yaml.load("\n".join(lines[1:end]), Loader=UniqueKeyLoader)SECRET = "sk-SUPER-SECRET-TOKEN"
delete_probe
.pre-commit-config.yaml
packages/mcp/CLAUDE.md
(socket.AF_INET, socket.SOCK_STREAM, 0, "", ("169.254.169.254", 0)),"::ffff:169.254.169.254", # AWS IMDS (link-local)
"::ffff:169.254.169.254",
monkeypatch.setenv("PIPEFY_BASE_URL", "https://169.254.169.254")location="http://169.254.169.254/latest/meta-data/",
jwks = "http://127.0.0.1:8080/certs"
settings = JwtValidationSettings(issuer_url="http://127.0.0.1:8080/realms/x")
assert settings.issuer_url == "http://127.0.0.1:8080/realms/x"
jwks_uri="https://127.0.0.1/certs",
jwks_uri="http://127.0.0.1/certs",
- **Clean-gate contract.** The probe can return a success that still carries a `problem` — when the API returns partial data alongside GraphQL errors, it surfaces the classified error rather than disc
- **Clean-gate contract.** The probe can return a success that still carries a `problem` — when the API returns partial data alongside GraphQL errors, the probe surfaces the classified error rather th
- **Keychain read failed and nothing was deleted** — presence could not be established, so the command claims neither removal nor a clean machine: stderr `Could not read the keychain to check for a st
`pipefy` and `pipefy-auth` read an optional TOML file in addition to environment variables. The file lets operators pin defaults (base URLs, org IDs, service-account credentials, ...) per host without
- The secret is returned to the caller because it is needed to authenticate the account (mint access tokens via the OAuth2 client-credentials grant against the token endpoint). It is never logged.
`pipefy-cli` and `pipefy-mcp-server` both depend on this package and read the same keychain entry, so a single `pipefy auth login` serves both binaries.
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
b66076a1a7fdfull audit observations/trust-audit/mcp-server/pipefy__pipefy-toolkit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | b66076a1a7fd | BLOCK | F | 59 | first audit |
Questions
What is the Pipefy Toolkit MCP server?
MCP server, CLI, and agent skills for Pipefy.
What tools does Pipefy Toolkit expose?
9 in total: 8 read-only, 0 that write, and 1 that can delete or overwrite (delete_probe). Every one is listed on this page with its risk.
Is Pipefy Toolkit safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (59/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Pipefy Toolkit need?
It reads PIPEFY_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Pipefy Toolkit run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as pipefy-workspace.
How current is this page?
The grade is for one exact copy of the source (b66076a1a7fd), read on 2026-10-08. The repository is watched and re-audited when it changes.