flow-codeblock-rust-mcpCAUTION
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Local stdio MCP server and Codex Skill for Flow Codeblock. The MCP server calls the Flow Codeblock Rust REST API; it never executes user JavaScript on the user's computer. User code runs in the server's pinned Bun Supervisor.
Installation
Requires Bun 1.4.2 or newer:
bunx --bun [email protected]
Required environment:
FLOW_CODEBLOCK_BASE_URL=https://qingcode.oalite.com FLOW_CODEBLOCK_TOKEN=flow_xxx # Optional default owner name for lock/unlock operations FLOW_CODEBLOCK_OWNER_NAME=Default Owner
FLOW_CODEBLOCK_BASE_URL is the deployed Flow Codeblock Rust API base URL and the base for returned call URLs. Non-script tools return ${FLOW_CODEBLOCK_BASE_URL}/flow/codeblock as execution_url; script create, update, and execution tools return ${FLOW_CODEBLOCK_BASE_URL}/flow/codeblock/{script_id} as script_url. Other management tools do not return a call URL. Use https://qingcode.oalite.com for the public service, or the matching localhost URL for a local Rust deployment. Store the token in the client's environment or secret manager; never put it in prompts, tool arguments, or public files.
The deployed Bun Supervisor exposes only a frozen, read-only Bun facade configured by the administrator. High-risk Bun. APIs may be unavailable, and bun:* modules may be blocked independently; code must not assume either is present. Configuring bun disables the entire Bun facade and all bun:* modules. The package includes the default moduleblacklist.json, and `flowwrite_code` returns its complete parsed contents for each code-writing request.
When FLOW_CODEBLOCK_OWNER_NAME is configured, owner_name may be omitted from flow_lock_script and flow_unlock_script; explicit arguments win. Both tools call the Rust API directly with owner_name and lock_password. The current API has no ownership challenge, release, or transfer rou
c3de3c3cd99aOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add flow-codeblock-rust-mcp --env FLOW_CODEBLOCK_TOKEN=${FLOW_CODEBLOCK_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"flow-codeblock-rust-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"FLOW_CODEBLOCK_TOKEN": "${FLOW_CODEBLOCK_TOKEN}"
}
}
}
}Exposed tools (13)
9 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
flow_apply_script_change | write | |
flow_execute_code | write | |
flow_execute_script | write | |
flow_get_script | read | |
flow_get_script_documentation | read | |
flow_get_script_documentation_version | read | |
flow_get_script_version | read | |
flow_list_scripts | read | |
flow_lock_script | read | |
flow_preview_script_change | read | |
flow_script_stats | read | |
flow_unlock_script | read | |
flow_write_code | write |
Trust audit
CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (11)
- Do not use JavaScript Unicode escapes in identifiers or property names (for example, `requ\u0069re` or `constr\u0075ctor`); the runtime rejects escaped names and they cannot be used to bypass the sa
nested: { token: "flow_token_secret_5678" },const referencesDirectory = new URL("../../skills/flow-codeblock/references/", import.meta.url);const referencesDirectory = new URL("../../skills/flow-codeblock/references/", import.meta.url);const referencesDirectory = new URL("../../skills/flow-codeblock/references/", import.meta.url);FLOW_CODEBLOCK_BASE_URL: "http://127.0.0.1:1",
FLOW_CODEBLOCK_BASE_URL: "http://127.0.0.1:1",
expect(nonScriptPayload.execution_url).toBe("http://127.0.0.1:1/flow/codeblock");The endpoint is `GET|POST /flow/codeblock/{scriptId}`. The server builds global `input` as an HTTP envelope with `query`, `header`, `body`, and `cookies`.- Third-party API keys are business inputs supplied through the documented body, query, or business headers. User code must not read `process.env`; `FLOW_CODEBLOCK_TOKEN` is platform authentication on
All user data comes from global `input`, never from environment variables, persistent globals, or other external state. In user code `process` is `undefined`; never read `process.env` or assume busine
Gates applied: instruction_override, no_behavioural_pass.
c3de3c3cd99afull audit observations/trust-audit/mcp-server/renoelis__flow-codeblock-rust-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | c3de3c3cd99a | CAUTION | C | 79 | first audit |
Questions
What tools does flow-codeblock-rust-mcp expose?
13 in total: 9 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is flow-codeblock-rust-mcp safe to connect to an agent?
With care. The audit graded it C (79/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does flow-codeblock-rust-mcp need?
It reads FLOW_CODEBLOCK_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does flow-codeblock-rust-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as flow-codeblock-rust-mcp at 2.0.8.
How current is this page?
The grade is for one exact copy of the source (c3de3c3cd99a), read on 2026-10-11. The repository is watched and re-audited when it changes.