{"serverId":"mcp-registry/io.github.michal-lefler/secureflows-mcp-server","tools":[{"name":"auth_session_callback","fixed":{"name":"auth_session_callback","description":"**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`).\n3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for\n   **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional\n   **`payload`** (URL-encoded JSON **object**, d","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","query"],"properties":{"auth":{"type":"object","properties":{}},"body":{"type":"string"},"query":{"type":"object","required":["firebaseToken","client_redirect_uri","workspace_name","app_id"],"properties":{"state":{"type":"string"},"app_id":{"type":"string"},"payload":{"type":"string","description":"JSON object as a string (e.g. `{\"a\":1}`), URL-encoded. Must parse to a JSON object (not an array or primitive).\nDefault when omitted is `{}`. Must not be combined with `session_token` on the same request.\n"},"ttl_seconds":{"type":"integer","maximum":604800,"minimum":0,"description":"Session lifetime in seconds (default 0 = unlimited; allowed values: 0 or 60–604800)"},"firebaseToken":{"type":"string"},"session_token":{"type":"string","description":"Previous session JWT (may be expired); signature must validate. When present, the server renews this\nsession instead of creating a new one. Must not be combined with `payload` on the same request.\nURL-encode the value; very long URLs may exceed browser or proxy limits.\n"},"workspace_name":{"type":"string"},"client_redirect_uri":{"type":"string","format":"uri"}}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"title":"Session login callback (redirect)"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true}],"tokensBefore":618,"tokensAfter":622},{"name":"delete_sessions_delete_key","fixed":{"name":"delete_sessions_delete_key","description":"Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and forwards it as a Bearer token.\nPrefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","params"],"properties":{"auth":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"secureFlows session token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","required":["key"],"properties":{"key":{"type":"string","description":"Payload key to delete"}}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true},"title":"Delete a key from the session payload"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: true, idempotentHint: true (inferred from the name).","verify":true}],"tokensBefore":340,"tokensAfter":345},{"name":"get_auth_logout","fixed":{"name":"get_auth_logout","description":"Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a\n**first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when\nthird-party cookies are blocked.\n\n**Critical client rules:**\n- Clear your in-app `sessionToken` state **before** navigating.\n- **Never** include `session_token` inside `redirect_uri` (that would silently renew and ","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","query"],"properties":{"auth":{"type":"object","properties":{}},"body":{"type":"string"},"query":{"type":"object","required":["session_token","redirect_uri"],"properties":{"redirect_uri":{"type":"string","format":"uri","description":"Where to redirect after logout completes"},"session_token":{"type":"string","description":"SESSION JWT to invalidate (URL-encoded)"}}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":true},"title":"Log out (browser redirect helper; first-party cookie clearing)"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":407,"tokensAfter":411},{"name":"get_docs_search","fixed":{"name":"get_docs_search","description":"Embeds the query with Ollama (`nomic-embed-text`) and returns the closest public doc chunks\nfrom the environment's search index (pgvector).\n\nSource: GET /api/v1/docs/search\nNo Authorization header is required.\nPrefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","query"],"properties":{"auth":{"type":"object","properties":{}},"body":{"type":"string"},"query":{"type":"object","required":["q"],"properties":{"q":{"type":"string","description":"Natural-language question or keywords"},"limit":{"type":"integer","maximum":20,"minimum":1,"description":"Maximum hits to return (server caps at 20)"}}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":true},"title":"Semantic documentation search"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":349,"tokensAfter":354},{"name":"get_sessions","fixed":{"name":"get_sessions","description":"Returns the decrypted session payload for the authenticated internal session token.\n\nResponse shape is a **flat JSON object**. Empty payload returns `{}`.\n\nSource: GET /api/v1/sessions\nRequires `auth.sessionToken` and forwards it as a Bearer token.\nPrefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection"],"properties":{"auth":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"secureFlows session token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":true},"title":"Get the current session payload"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":329,"tokensAfter":334},{"name":"get_sessions_get_key","fixed":{"name":"get_sessions_get_key","description":"Retrieves the decrypted payload value for `key`.\n\n**Important:** `404` means the key was never written (normal first-use case). Do not treat as an error.\n\nSource: GET /api/v1/sessions/get/{key}\nRequires `auth.sessionToken` and forwards it as a Bearer token.\nPrefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","params"],"properties":{"auth":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"secureFlows session token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","required":["key"],"properties":{"key":{"type":"string","description":"Payload key to read"}}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":true},"title":"Get a single value from the session payload"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":358,"tokensAfter":362},{"name":"get_sessions_identity","fixed":{"name":"get_sessions_identity","description":"Returns the workspace end-user's **`userId`** and **email** for the authenticated session\ntoken. Does not return Firebase UID or session payload.\n\n`userId` is a stable, opaque identifier for this person across sessions and logins — it is\n**not** derived from Firebase. Use it as the correlation key when your own backend needs to\nlink an external event (e.g. a billing provider webhook you receive and verify yourself)\nback to this user. Do not use the session token or session id for this — sessions","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection"],"properties":{"auth":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"secureFlows session token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":true},"title":"Get signed-in user's stable id and email (app UI, backend correlation)"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":368,"tokensAfter":372},{"name":"get_sessions_my","fixed":{"name":"get_sessions_my","description":"Returns a page of sessions for the current user within the current workspace.\nSelf-service dashboard endpoint — requires workspace **`enableSelfService: true`**.\nPayload is included only for rows whose computed status is active.\nSort keys match the admin workspace session list; `pageSize` is clamped to 1–200 (default 20).\n\nSource: GET /api/v1/sessions/my\nRequires `auth.userToken` and forwards it as a Bearer token.\nPrefer connection.workspaceName and connection.appId as stable config instead of g","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","query"],"properties":{"auth":{"type":"object","required":["userToken"],"properties":{"userToken":{"type":"string","description":"secureFlows USER token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{"q":{"type":"string","description":"Search by session id, app id, or user identifier (own uid)"},"dir":{"enum":["asc","desc"],"type":"string"},"page":{"type":"integer","maximum":9007199254740991,"minimum":0},"sort":{"enum":["id","user","app","created","expires","status","lastActivity","updated"],"type":"string"},"app_id":{"type":"string","description":"Filter by client app id, or `all`."},"status":{"enum":["all","active","expired","revoked"],"type":"string","description":"Computed session lifecycle filter (`all` or same values as admin session list)."},"pageSize":{"type":"integer","maximum":200,"minimum":1,"description":"Page size (server clamps to 1–200; 0 or invalid uses default 20)."}}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":true},"title":"List my sessions (paged, sortable, filterable)"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":560,"tokensAfter":564},{"name":"post_auth_logout","fixed":{"name":"post_auth_logout","description":"Logs out the current session **without revoking** it.\n\n**Browser warning:** calling this endpoint via XHR/fetch from a different origin than `secure-flows.com`\nis not a reliable way to clear hosted-login cookies. For browser apps (especially localhost), prefer the\nredirect helper `GET /api/v1/auth/logout?session_token=...&redirect_uri=...`.\n\nBehavior:\n- **Invalidates** the current `sessionToken` by incrementing `tokenRevision` (no new token is issued).\n- Calls Firebase `revokeRefreshTokens(fireb","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection"],"properties":{"auth":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"secureFlows session token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false},"title":"Log out (invalidate sessionToken + revoke Firebase refresh tokens)"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: true, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":367,"tokensAfter":372},{"name":"post_sessions","fixed":{"name":"post_sessions","description":"Verifies **Firebase** ID token, creates a session for **`workspaceName`**, stores serialized\n**`payload`** (defaults to `{}` when omitted), and returns **`sessionToken`** (JWT; subject = internal session id).\nDefault server-side TTL is **1 hour** (implementation detail).\n\nIf the Firebase token includes **`email`**, the server best-effort persists it on the workspace\nend-user row (for audit display). Prefer **`POST /sessions/get-or-create`** for hosted-login-style\nflows that should reuse an activ","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","body"],"properties":{"auth":{"type":"object","required":["firebaseToken"],"properties":{"firebaseToken":{"type":"string","description":"Firebase ID token"}}},"body":{"type":"object","required":["workspaceName"],"properties":{"app_id":{"anyOf":[{"type":"string","description":"Optional app id (must belong to the workspace). Used for per-app session policy and auditing."},{"type":"null"}]},"payload":{"type":"object","description":"Arbitrary payload object stored in the session. Optional; omitted or null is stored as `{}`.","propertyNames":{"type":"string"},"additionalProperties":{}},"workspaceName":{"type":"string","description":"Workspace name to scope the session"}}},"query":{"type":"object","properties":{}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false},"title":"Create a new session"},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: false, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":507,"tokensAfter":507},{"name":"post_sessions_get_or_create","fixed":{"name":"post_sessions_get_or_create","description":"Verifies **Firebase** ID token. If an **active** session already exists for\n**`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most\nrecently created** matching row (touches activity; does not create a duplicate session). The request\n**`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a\ndedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload.\n\nOtherwise behaves like **`POS","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","body"],"properties":{"auth":{"type":"object","required":["firebaseToken"],"properties":{"firebaseToken":{"type":"string","description":"Firebase ID token"}}},"body":{"type":"object","required":["workspaceName"],"properties":{"app_id":{"anyOf":[{"type":"string","description":"Optional app id (must belong to the workspace). Used for per-app session policy and auditing."},{"type":"null"}]},"payload":{"type":"object","description":"Arbitrary payload object stored in the session. Optional; omitted or null is stored as `{}`.","propertyNames":{"type":"string"},"additionalProperties":{}},"workspaceName":{"type":"string","description":"Workspace name to scope the session"}}},"query":{"type":"object","properties":{}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false},"title":"Reuse active session or create one"},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: false, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":511,"tokensAfter":511},{"name":"post_sessions_renew_session_token","fixed":{"name":"post_sessions_renew_session_token","description":"Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without\nenforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the\nsession by id from the token subject; the Firebase UID must match the session owner.\nIncrements **`tokenRevision`** on the server so **previous session JWTs** (same session id,\nolder revision) are no longer accepted for `GET/POST/DELETE /sessions/...`.\nReturns a **new `sessionToken`** (with the new `t","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","params"],"properties":{"auth":{"type":"object","required":["firebaseToken"],"properties":{"firebaseToken":{"type":"string","description":"Firebase ID token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"Previous SESSION JWT (may be expired); URL-encoded in the path"}}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false},"title":"Renew session JWT (replace expired token)"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: false, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":411,"tokensAfter":415},{"name":"post_sessions_revoke","fixed":{"name":"post_sessions_revoke","description":"Permanently revokes the session referenced by the internal SESSION Bearer token. The session ends and everything stored in it is destroyed and cannot be restored. This is NOT sign-out: to sign a user out and keep their data, use POST /api/v1/auth/logout (or, in a browser, the redirect helper GET /api/v1/auth/logout). Call revoke only when the user or an admin deliberately wants the session and its data deleted, for example on account deletion.\n\nSource: POST /api/v1/sessions/revoke\nRequires `auth","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection"],"properties":{"auth":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"secureFlows session token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","properties":{}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false},"title":"Revoke the current session and destroy its data (by session token) - not sign-out"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: true, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":367,"tokensAfter":371},{"name":"post_sessions_revoke_session_id","fixed":{"name":"post_sessions_revoke_session_id","description":"Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace.\nThe session ends and its stored data is destroyed permanently; this is not sign-out.\nRequires workspace **`enableSelfService: true`**.\n\nSource: POST /api/v1/sessions/revoke/{sessionId}\nRequires `auth.userToken` and forwards it as a Bearer token.\nPrefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","params"],"properties":{"auth":{"type":"object","required":["userToken"],"properties":{"userToken":{"type":"string","description":"secureFlows USER token"}}},"body":{"type":"string"},"query":{"type":"object","properties":{}},"params":{"type":"object","required":["sessionId"],"properties":{"sessionId":{"type":"integer","maximum":9007199254740991,"minimum":-9007199254740991}}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false},"title":"Revoke a session owned by the current user"},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: body. Change to number/boolean/array where that's what you accept.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: true, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":391,"tokensAfter":395},{"name":"post_sessions_set_key","fixed":{"name":"post_sessions_set_key","description":"Sets a key in the encrypted session payload and returns the updated decrypted payload. If the JSON body is `{ \"value\": <x> }`, the server unwraps it and stores `<x>` directly.\n\nSource: POST /api/v1/sessions/set/{key}\nRequires `auth.sessionToken` and forwards it as a Bearer token.\nPrefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["connection","params","body"],"properties":{"auth":{"type":"object","required":["sessionToken"],"properties":{"sessionToken":{"type":"string","description":"secureFlows session token"}}},"body":{"anyOf":[{"type":"object","required":["value"],"properties":{"value":{}}},{"type":"string"},{"type":"number"},{"type":"integer","maximum":9007199254740991,"minimum":-9007199254740991},{"type":"boolean"},{"type":"array","items":{}},{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}},{}],"description":"JSON body can be either `{ \"value\": <x> }` (preferred) or a raw JSON value.\n"},"query":{"type":"object","properties":{}},"params":{"type":"object","required":["key"],"properties":{"key":{"type":"string","description":"Payload key to set"}}},"connection":{"type":"object","required":["host"],"properties":{"host":{"type":"string","format":"uri","description":"secureFlows base URL, for example https://api.example.com"},"appId":{"type":"string","description":"Optional secureFlows app id used as a default for hosted login tools"},"workspaceName":{"type":"string","description":"Optional workspace name used as a default for tools that need it"}}}}},"annotations":{"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true},"title":"Set a value inside the session payload"},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: false, idempotentHint: true (inferred from the name).","verify":true}],"tokensBefore":480,"tokensAfter":480},{"name":"secureflows_lint_integration","fixed":{"name":"secureflows_lint_integration","description":"Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at\nscaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set.\n\nTwo kinds of findings:\n  • scope \"file\"    — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout,\n    client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), r","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["files"],"properties":{"files":{"type":"object","description":"Map of relative file path -> full file source to scan, e.g. { \"src/lib/secureflows.js\": \"...\" }","propertyNames":{"type":"string"},"additionalProperties":{"type":"string"}}}},"annotations":{"readOnlyHint":true},"title":"Static-scan generated code for secureFlows anti-patterns"},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":250,"tokensAfter":250}],"toolsChanged":16,"tokensSaved":0,"todo":[{"tool":"auth_session_callback","params":["auth","body","query","params","connection"]},{"tool":"delete_sessions_delete_key","params":["auth","body","query","params","connection"]},{"tool":"get_auth_logout","params":["auth","body","query","params","connection"]},{"tool":"get_docs_search","params":["auth","body","query","params","connection"]},{"tool":"get_sessions","params":["auth","body","query","params","connection"]},{"tool":"get_sessions_get_key","params":["auth","body","query","params","connection"]},{"tool":"get_sessions_identity","params":["auth","body","query","params","connection"]},{"tool":"get_sessions_my","params":["auth","body","query","params","connection"]},{"tool":"post_auth_logout","params":["auth","body","query","params","connection"]},{"tool":"post_sessions","params":["auth","body","query","params","connection"]},{"tool":"post_sessions_get_or_create","params":["auth","body","query","params","connection"]},{"tool":"post_sessions_renew_session_token","params":["auth","body","query","params","connection"]},{"tool":"post_sessions_revoke","params":["auth","body","query","params","connection"]},{"tool":"post_sessions_revoke_session_id","params":["auth","body","query","params","connection"]},{"tool":"post_sessions_set_key","params":["auth","query","params","connection"]}],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}