flow-codeblock-mcpSAFE
Flow Codeblock stdio MCP Server and Codex Plugin
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Local stdio MCP server and Codex Skill for Flow Codeblock. The MCP server calls the Flow Codeblock Rust REST API; it never executes user JavaScript on the user's computer. User code runs in the server's pinned Bun Supervisor.
Installation
The deployed Flow Codeblock service runs Bun 1.4.3. The local MCP server requires Bun 1.4.0 or newer:
bunx --bun [email protected]
Required environment:
FLOW_CODEBLOCK_BASE_URL=https://qingcode.oalite.com FLOW_CODEBLOCK_TOKEN=flow_xxx # Optional default owner email for ownership operations [email protected] # Optional default owner name for first lock/claim FLOW_CODEBLOCK_OWNER_NAME=Default Owner
FLOW_CODEBLOCK_BASE_URL is the deployed Flow Codeblock Rust API base URL and the base for returned call URLs. Non-script tools return ${FLOW_CODEBLOCK_BASE_URL}/flow/codeblock as execution_url; script create, update, and execution tools return ${FLOW_CODEBLOCK_BASE_URL}/flow/codeblock/{script_id} as script_url. Other management tools do not return a call URL. Use https://qingcode.oalite.com for the public service, or the matching localhost URL for a local Rust deployment. Store the token in the client's environment or secret manager; never put it in prompts, tool arguments, or public files.
When FLOW_CODEBLOCK_OWNER_EMAIL is configured, current-owner email arguments for challenge, lock, unlock, release, and transfer authorization may be omitted. Explicit arguments win. The new owner email in a transfer confirmation is always required. When FLOW_CODEBLOCK_OWNER_NAME is configured, flow_lock_script.owner_name may be omitted; new_owner_name in transfers is always required.
Generic stdio configuration
{
"mcpServers": {
"flow-codeblock": {
"command": "bunx",
"args": ["--bun", "[email protected]"],
"env": {
"FLOW_CODEBLOCK_BASE_URL": "https://qingcode.oalite.com",
"FLOW_CODEBLbee6b8ef014eOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add flow-codeblock-mcp --env FLOW_CODEBLOCK_TOKEN=${FLOW_CODEBLOCK_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"flow-codeblock-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"FLOW_CODEBLOCK_TOKEN": "${FLOW_CODEBLOCK_TOKEN}"
}
}
}
}Exposed tools (18)
12 read · 6 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
flow_apply_script_change | write | |
flow_confirm_ownership_transfer | write | |
flow_execute_code | write | |
flow_execute_script | write | |
flow_get_script | read | |
flow_get_script_documentation | read | |
flow_get_script_documentation_version | read | |
flow_get_script_version | read | |
flow_list_scripts | read | |
flow_lock_script | read | |
flow_preview_script_change | read | |
flow_release_script_ownership | read | |
flow_request_script_owner_challenge | read | |
flow_script_stats | read | |
flow_start_ownership_transfer | write | |
flow_token_info | read | |
flow_unlock_script | read | |
flow_write_code | write |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (12)
token: "flow_token_secret_5678",
const referencesDirectory = new URL("../../skills/flow-codeblock/references/", import.meta.url);const referencesDirectory = new URL("../../skills/flow-codeblock/references/", import.meta.url);const referencesDirectory = new URL("../../skills/flow-codeblock/references/", import.meta.url);FLOW_CODEBLOCK_BASE_URL: "http://127.0.0.1:1",
FLOW_CODEBLOCK_BASE_URL: "http://127.0.0.1:1",
FLOW_CODEBLOCK_BASE_URL: "http://127.0.0.1:1",
expect(nonScriptPayload.execution_url).toBe("http://127.0.0.1:1/flow/codeblock");The endpoint is `GET|POST /flow/codeblock/{scriptId}`. The server builds global `input` as an HTTP envelope with `query`, `header`, `body`, and `cookies`.- `GET /flow/token/self`: Token authentication; returns `data={count,tokens:[TokenInfo]}` with full access tokens to the authenticated client.- Third-party API keys are business inputs supplied through the documented body, query, or business headers. User code must not read `process.env`; `FLOW_CODEBLOCK_TOKEN` is platform authentication on
All user data comes from global `input`, never from environment variables, persistent globals, or other external state. In user code `process` is `undefined`; never read `process.env` or assume busine
Gates applied: no_behavioural_pass.
bee6b8ef014efull audit observations/trust-audit/mcp-server/renoelis__flow-codeblock-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | bee6b8ef014e | SAFE | B | 89 | first audit |
Questions
What is the flow-codeblock-mcp MCP server?
Flow Codeblock stdio MCP Server and Codex Plugin
What tools does flow-codeblock-mcp expose?
18 in total: 12 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is flow-codeblock-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does flow-codeblock-mcp need?
It reads FLOW_CODEBLOCK_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does flow-codeblock-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as flow-codeblock-mcp at 0.3.18.
How current is this page?
The grade is for one exact copy of the source (bee6b8ef014e), read on 2026-10-12. The repository is watched and re-audited when it changes.