Our Compliance Checker has now been updated to include a compliance check on the EU AI Act! Learn more.

FlowZap MCP Server Documentation

πŸ€– This documentation is optimized for LLM and AI Agent consumption

Version 2.2.0 | Last Updated: November 2026 | advisory process-quality audit on flowzap_create_playground, flowzap_apply_change and POST /api/playground/create + flowzap_fix deterministic repair tool + remote Streamable HTTP transport (listed in the official MCP registry), Mind Map view + 4 mindmap tools (validate, approve, template, create_playground), compliance checker, 13 tools total

Overview

The FlowZap MCP (Model Context Protocol) Server enables AI agents to create, validate, and share professional Workflow, Sequence, Architecture and Mind Map diagrams using FlowZap Codeβ€”a domain-specific language designed for machine-readable diagram generation.

Tip: Use it with the SKILL md file for optimal results!

What is FlowZap?

PurposeConvert text-based code into visual workflow diagrams
Optimized ForAI-first generation, agentic workflows (n8n, Make.com, Zapier)
Unique FeatureQuad-view rendering - same code renders as workflow, sequence, architecture, AND mind map diagrams
SharingInstant shareable URLs without authentication

Security Guarantees

The FlowZap MCP Server implements enterprise-grade security measures to protect users:

Network Security

ProtectionImplementation
SSRF PreventionOnly connects to flowzap.xyz and www.flowzap.xyz via HTTPS
URL ValidationAll returned URLs are verified to originate from FlowZap domains
Request Timeout30-second timeout prevents hanging connections

Input Validation

LimitValuePurpose
Max Code Length50,000 characters (MCP tools) β€” 20,000 on POST /api/playground/createPrevents memory exhaustion
Max Input Length100,000 charactersProtects against payload attacks
Null Byte RemovalAutomaticPrevents injection attacks
Control Character SanitizationAutomaticRemoves non-printable characters

Rate Limiting

ParameterValue
Max Requests30 per minute
Window Duration60 seconds
BehaviorReturns retry-after time when exceeded

Data Privacy

  • No Account Required - Public endpoints, no key, no login
  • No User Data Stored - Playground sessions are ephemeral (60-minute TTL, non-guessable cryptographic tokens)
  • No Cookies - Sessions are addressed by their URL token. Usage is counted per IP for rate limiting and aggregated in the public stats file; no profile is built and nothing is sold
  • Logs to stderr only - Security events never exposed to MCP clients

Available Tools

13 tools: process and diagram tools (1 to 9), then the four Mind Map tools (10 to 13). Tools 3 and 8 also return the advisory process-quality block described at the end of this section.

1. flowzap_get_syntax

Purpose: Retrieve complete FlowZap Code syntax documentation.

When to Use: Before generating any FlowZap Code, call this tool to learn the correct syntax.

Input Schema:

{
  "type": "object",
  "properties": {}
}

Output: Complete syntax guide including global constraints, shape types, node syntax, edge syntax, loop syntax, and common mistakes to avoid.

2. flowzap_validate

Purpose: Validate FlowZap Code syntax before creating a diagram.

When to Use: Always validate code before calling flowzap_create_playground. This prevents errors and provides actionable feedback.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "FlowZap Code to validate"
    }
  },
  "required": ["code"]
}

Success Output:

βœ… FlowZap Code is valid!

Stats:
- Lanes: 2
- Nodes: 5
- Edges: 4

Failure Output:

❌ Validation failed:
- Line 3: Unknown shape "oval". Valid shapes: circle, rectangle, diamond, taskbox
- Line 5: Edge missing handle syntax. Use: n1.handle(right) -> n2.handle(left)

3. flowzap_create_playground

Purpose: Create a shareable playground URL with the diagram.

When to Use: After validation passes, create a playground to give users an interactive diagram they can view and edit.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "FlowZap Code to load in the playground"
    },
    "view": {
      "type": "string",
      "enum": ["workflow", "sequence", "architecture", "mindmap"],
      "description": "Initial view mode. Default: workflow"
    },
    "lng": {
      "type": "string",
      "enum": ["en", "fr", "zh"],
      "description": "Response language. Default: en"
    }
  },
  "required": ["code"]
}

Output:

βœ… Workflow diagram created:
https://flowzap.xyz/playground/3f6c1d9e-5b2a-4c77-9f1d-2a8b6c0d4e11?view=workflow

πŸ’‘ Review this flow for GDPR, SOC2 or PIPL compliance by calling
flowzap_compliance_check with the same code. 10 free reviews per rolling 30-day period.

⚠️ Process quality (advisory β€” the diagram renders; these are process defects):
1. These steps have no incoming edge: they start the flow as if nothing led to them: n5. …
Fix the steps above and call the tool again with the corrected code.

View Modes:

ViewBest For
workflowStep-by-step process flows (default)
sequenceMessage exchanges between participants
architectureSystem-level overview showing lanes as systems
mindmapConceptual tree (central idea, branches) β€” use the four flowzap_mindmap_* tools; not audited as a process

Important Notes:

  • Automatically validates code before creating playground
  • Returns validation errors if code is invalid
  • Playground URLs expire after 60 minutes
  • No authentication required to view
  • Use view="architecture" for system-level overview of multi-lane diagrams
  • Appends an advisory process-quality block when the code has flow defects (see Process quality audit below). The diagram is always created
  • view="mindmap" is accepted, but prefer flowzap_mindmap_create_playground, which validates mind-map readiness first

4. flowzap_compliance_check

Purpose: Run automated SOC2, GDPR, PIPL, and EU AI Act compliance analysis on a FlowZap Code data-flow diagram.

When to Use: When the user asks for a privacy, security, or regulatory review of a data-flow diagram. Backed by Deepseek LLM.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": { "type": "string", "maxLength": 50000 },
    "lng": { "type": "string", "enum": ["en", "fr", "zh"], "default": "en" }
  },
  "required": ["code"]
}

Output: Markdown audit report covering SOC2 CC-series controls, GDPR articles, PIPL chapters, and EU AI Act obligations (AI risk classification, human oversight, and technical documentation) with risks, recommendations, and a link to the manual checker at flowzap.xyz/soc2-gdpr-pipl-compliance-checker.

Rate Limits (strict, Deepseek LLM cost protection):

  • 10 free compliance reviews per rolling 30-day period per IP or per mcpIdentity
  • 3 calls per hour burst limit per IP
  • Global 5-minute circuit breaker on repeated upstream failures
  • Only successful calls count toward the monthly quota

5. flowzap_fix

Purpose: Deterministic repair pass for FlowZap Code rejected by the validator: non-sequential node numbering, inferred edge handles, node/edge label syntax, missing lane display labels, emoji and non-printable characters.

When to Use: When flowzap_validate (or POST /api/validate) rejects code with one of these mechanical errors. The tool returns the corrected code plus the list of applied corrections; errors it cannot repair are reported as-is and content is never invented.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": { "type": "string", "maxLength": 50000 },
    "lng": { "type": "string", "enum": ["en", "fr", "zh"], "default": "en" }
  },
  "required": ["code"]
}

Output: The repaired FlowZap Code, the applied corrections with counts, and any remaining unfixable errors with their validator messages. Backed by the public POST /api/fix endpoint (120 requests/minute per IP (1200/minute for clients sending X-MCP-Client: flowzap-mcp), no auth).

6. flowzap_export_graph

Purpose: Parse FlowZap Code into a structured JSON graph (lanes, nodes, edges).

When to Use: When another tool or pipeline needs the diagram as data rather than as an image: storing a graph, computing metrics, feeding a downstream generator.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "FlowZap Code to parse"
    }
  },
  "required": [
    "code"
  ]
}

Output: A JSON object with lanes, nodes (id, shape, label, lane) and edges (source, target, label). Deterministic, local parsing only.

7. flowzap_diff

Purpose: Compare two versions of FlowZap Code and return a structured diff.

When to Use: When iterating on a diagram and the user asks what changed, or before applying a patch so the change can be reviewed.

Input Schema:

{
  "type": "object",
  "properties": {
    "oldCode": {
      "type": "string",
      "description": "Original FlowZap Code"
    },
    "newCode": {
      "type": "string",
      "description": "Updated FlowZap Code"
    }
  },
  "required": [
    "oldCode",
    "newCode"
  ]
}

Output: A structured list of added, removed and modified nodes and edges between oldCode and newCode.

8. flowzap_apply_change

Purpose: Apply structured patch operations (insert, update, remove nodes or edges) to FlowZap Code and return a playground URL for the patched diagram.

When to Use: When you want to fix or extend an existing diagram without regenerating it: one bad label, one missing step, one missing edge.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "Current FlowZap Code"
    },
    "operations": {
      "type": "array",
      "description": "Array of patch operations",
      "items": {
        "type": "object"
      }
    }
  },
  "required": [
    "code",
    "operations"
  ]
}

Output: The operations actually applied (or the skipped ones and why), the URL of the patched diagram, followed by the advisory process-quality block. A removeNode leaves a gap in the numbering: the code is renumbered automatically before the playground is created. If the patch is still invalid, no URL is returned and the errors are listed.

Operations: camelCase, five allowed names. insertNode takes a laneId, a newNode (shape + label + properties) and an optional afterNodeId; updateNode takes a nodeId and updates; insertEdge and removeEdge take a newEdge built from node IDs (from, to) and optional handles. An edge to another lane automatically receives the lane prefix.

{ "op": "insertNode", "laneId": "sales", "afterNodeId": "n2", "newNode": { "shape": "rectangle", "label": "Review order", "properties": { "owner": "Alice" } } }
{ "op": "updateNode", "nodeId": "n3", "updates": { "label": "Review order" } }
{ "op": "removeNode", "nodeId": "n4" }
{ "op": "insertEdge", "newEdge": { "from": "n2", "to": "n3", "label": "Submit", "fromHandle": "right", "toHandle": "left" } }
{ "op": "removeEdge", "newEdge": { "from": "n2", "to": "n3" } }

Advisory quality block: the reply also carries the process-quality audit of the patched diagram (same block as flowzap_create_playground). The diagram is created even when defects are reported.

9. flowzap_artifact_to_diagram

Purpose: Turn a real artifact (HTTP logs, an OpenAPI spec, a code snippet) into a FlowZap diagram.

When to Use: When the source of truth is not prose but machine output: a request log, an API contract, a route list.

Input Schema:

{
  "type": "object",
  "properties": {
    "artifactType": {
      "type": "string",
      "enum": [
        "http_logs",
        "openapi",
        "code"
      ]
    },
    "content": {
      "type": "string",
      "description": "Raw artifact content"
    },
    "view": {
      "type": "string",
      "enum": [
        "workflow",
        "sequence",
        "architecture"
      ],
      "description": "Preferred view mode"
    }
  },
  "required": [
    "artifactType",
    "content"
  ]
}

Output: Over the hosted HTTP transport the tool returns a parsing playbook for the requested artifact type: the agent then writes the FlowZap Code itself. The npm build parses the artifact directly and returns FlowZap Code plus a playground URL, with the advisory quality block.

10. flowzap_mindmap_validate

Purpose: Validate FlowZap Code syntax for Mind Map diagrams and report whether the code is mind-map-ready.

When to Use: Before flowzap_mindmap_approve and flowzap_mindmap_create_playground, to catch what the renderer will refuse.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "FlowZap Code to validate for mind map readiness"
    }
  },
  "required": [
    "code"
  ]
}

Output: Validation errors and warnings, plus mind-map readiness checks: no diamonds, no taskboxes, at least one circle for the root, at least one rectangle for branches.

Mind maps are not processes. The process-quality audit is not applied to ?view=mindmap renderings: a mind map has no start or end circle and no flow between lanes, so those rules would fire on every call. Use the four mindmap tools below instead.

11. flowzap_mindmap_approve

Purpose: Decide whether valid FlowZap Code is suitable for Mind Map rendering.

When to Use: When you already have valid code and want a structured go/no-go before showing a mind map to a user.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "FlowZap Code to inspect for mind map readiness"
    }
  },
  "required": [
    "code"
  ]
}

Output: A structured verdict: blocking errors (diamonds, taskboxes), advisory warnings (several circles: only the first becomes the root; large or deep diagrams) and info (edge directions, ignored by the renderer). Local parsing only, no API call.

12. flowzap_mindmap_template

Purpose: Generate a ready-to-extend FlowZap Code skeleton for a Mind Map.

When to Use: When bootstrapping a mind map from a topic instead of writing the tree by hand.

Input Schema:

{
  "type": "object",
  "properties": {
    "topic": {
      "type": "string",
      "description": "Central topic label for the mind map root (default: 'Central Topic')"
    },
    "branches": {
      "type": "number",
      "description": "Number of main branches from the root (default: 3, max: 8)"
    },
    "depth": {
      "type": "number",
      "description": "Depth of sub-branches per main branch (default: 2, max: 4)"
    }
  }
}

Output: FlowZap Code with a central circle root, the requested number of rectangle branches and sub-branches, ready to edit. branches defaults to 3 (max 8), depth to 2 (max 4).

13. flowzap_mindmap_create_playground

Purpose: Create a shareable playground URL that opens directly in Mind Map view.

When to Use: After flowzap_mindmap_validate and flowzap_mindmap_approve both pass.

Input Schema:

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "FlowZap Code to load in a mind map playground"
    }
  },
  "required": [
    "code"
  ]
}

Output: The same reply as flowzap_create_playground with ?view=mindmap appended to the URL.

Process quality audit (advisory)

flowzap_create_playground and flowzap_apply_change also audit the process shape of the code they receive. The audit is advisory: the diagram is created and the URL returned even when defects are found. When something is wrong, the reply ends with:

⚠️ Process quality (advisory β€” the diagram renders; these are process defects):
1. <defect message naming the offending nodes>
Fix the steps above and call the tool again with the corrected code.

The HTTP API exposes the same audit as a quality field (with defects and a pre-rendered warning) on POST /api/playground/create. Mind map views are exempt: a mind map has no start or end circle and no flow between lanes, so process rules would fire on every call.

CodeDefect
orphan-nodeA rectangle or diamond with no incoming edge β€” it reads as a second beginning
multiple-start-nodesMore than one circle with no incoming edge β€” a process starts exactly once
dead-end-nodeA rectangle or diamond with no outgoing edge β€” only a circle may end the flow
no-terminal-circleNo closing circle reached by the flow (endings may be several, one per outcome)
unanswered-handoffA lane receives work and never hands it back or onward
unreachable-nodeA wired node that no start node can reach
no-cross-lane-edgeSeveral lanes, not one edge between them
lane-isolatedA lane never connected to another lane
no-start-nodeNothing to enter the flow by (e.g. a closed loop with no entry)

These codes are not validation errors: the validator below is about syntax, this audit is about whether the result reads as a process.

Validation Rules Reference

The validator performs comprehensive validation checks across multiple categories. Understanding these helps generate valid code on the first attempt.

Error Codes (Block Diagram Creation)

CodeDescriptionFix
CONTAINS_EMOJIEmoji characters detectedUse UTF-8 plain text only, no emojis
NESTED_LANEA lane is declared inside another laneFlatten the lane structure
UNMATCHED_BRACEClosing brace without a matching opening braceCheck brace balance
UNCLOSED_BRACELane block never closedAdd the missing closing brace
MISPLACED_COMMENTComment on its own line or in the wrong placePut # Display Name on the lane opening line only
COMMENT_OUTSIDE_LANEComment outside any laneMove it onto a lane opening line or delete it
DUPLICATE_NODE_IDSame node ID used twiceNode IDs are globally unique across lanes
INVALID_SHAPEUnknown shapeUse: circle, rectangle, diamond, taskbox
MISSING_LABELNode without a label (taskbox excepted)Add label:"Text"
WRONG_LABEL_SYNTAXNode label uses = instead of :Use label:"Text"
NODE_OUTSIDE_LANENode declared outside any laneWrap it in a lane block
INVALID_EDGE_SYNTAXMalformed edgeUse n1.handle(right) β†’ n2.handle(left)
INVALID_DIRECTIONUnknown handle directionUse: left, right, top, bottom
WRONG_EDGE_LABEL_SYNTAXEdge label uses : instead of =Use [label="Text"]
EDGE_OUTSIDE_LANEEdge declared outside its source laneMove the edge inside the source lane block
INVALID_LOOP_SYNTAXMalformed loopUse loop [condition] n1 n2
LOOP_OUTSIDE_LANELoop declared outside a laneMove the loop inside a lane
WRONG_DSL_FORMATMermaid or PlantUML detectedUse FlowZap Code only
UNDEFINED_NODEEdge or loop references a node that was never declaredDeclare the node, or fix the reference
UNDEFINED_LANE_REFCross-lane reference to an undeclared laneCheck the lane name spelling
NO_CROSS_LANE_EDGESSeveral lanes and not one edge between themWire at least one lane-prefixed edge, e.g. n3.handle(bottom) β†’ stripe.n6.handle(top)
NON_SEQUENTIAL_NUMBERINGNumbering does not start at n1, or has a gapUse n1, n2, n3… sequentially across the whole diagram
EMPTY_DIAGRAMNo nodes at allAdd at least one node

Warning Codes (Best Practice Violations)

CodeDescriptionRecommendation
NON_PRINTABLE_CHARSControl characters in the codeSend plain text only
DUPLICATE_LANEThe same lane is declared twiceMerge into a single block
MISSING_LANE_LABELLane without a # Display NameAdd the display label on the opening line
NON_STANDARD_NODE_IDID that is not n1, n2, n3…Use the standard numbering
UNKNOWN_ATTRIBUTEAttribute outside label, owner, description, systemRemove it or use a supported attribute
LABEL_TOO_LONGLabel over the readable lengthKeep labels short
TASKBOX_MISSING_PROPSTaskbox without owner or descriptionAdd owner and description
EDGE_HANDLES_INFERREDHandle directions were guessedWrite both handles explicitly
LOOP_TOO_FEW_NODESLoop with a single nodeReference at least 2 nodes
UNKNOWN_SYNTAXA line the parser does not recogniseCheck the syntax reference β€” the line is ignored
INTERNAL_LANE_NODENode not connected to any edgeWire it, or accept that it renders as an isolated box
UNREACHABLE_NODENode with outgoing edges but no incoming edgeFeed it from a previous step β€” the process-quality audit reports the same defect as orphan-node
CHRONOLOGICAL_ORDER_WARNINGA cross-lane request overlaps another pending requestOrder the edges as request β†’ response β†’ next request

FlowZap Code Syntax Quick Reference

Global Constraints

βœ“ UTF-8 plain text only (no emojis)
βœ“ Node IDs: n1, n2, n3... (globally unique, sequential, no gaps)
βœ“ Shapes: circle, rectangle, diamond, taskbox
βœ“ Attributes: label, owner, description, system
βœ“ Comments: Only "# Display Label" on the same line as the lane opening brace
βœ“ Sequence view: alternate cross-lane request and response edges in real chronological order
βœ— No Mermaid, PlantUML, or other DSL syntax

Basic Structure

laneName { # Lane Display Name
  n1: circle label:"Start"
  n2: rectangle label:"Process"
  n1.handle(right) -> n2.handle(left)
}

Shape Types

ShapePurposeExample
circleStart/End eventsn1: circle label:"Start"
rectangleTasks/Activitiesn2: rectangle label:"Process Order"
diamondDecision gatewaysn3: diamond label:"Valid?"
taskboxAssigned tasksn4: taskbox owner:"Alice" description:"Deploy"

Edge Syntax

# Basic edge
n1.handle(right) -> n2.handle(left)

# Edge with label
n2.handle(bottom) -> n3.handle(top) [label="Yes"]

# Cross-lane edge (prefix with lane name)
n3.handle(right) -> fulfillment.n4.handle(left) [label="Send"]

Handle Directions

DirectionPosition
leftLeft side of node
rightRight side of node
topTop of node
bottomBottom of node

Loop Syntax

loop [retry up to 3 times] n1 n2 n3
  • Must be inside a lane block
  • Cannot be nested
  • Should reference at least 2 nodes

Complete Example

sales { # Sales Team
  n1: circle label:"Order Received"
  n2: rectangle label:"Validate Order"
  n5: rectangle label:"Receive decision"
  n1.handle(right) -> n2.handle(left)
  n2.handle(bottom) -> fulfillment.n3.handle(top) [label="Submit"]
}

fulfillment { # Fulfillment
  n3: rectangle label:"Review Order"
  n4: rectangle label:"Return decision"
  n3.handle(right) -> n4.handle(left)
  n4.handle(top) -> sales.n5.handle(bottom) [label="Approved"]
}

Recommended Workflow for AI Agents

  1. Step 1: Learn Syntax
    {"name": "flowzap_get_syntax", "arguments": {}}}
  2. Step 2: Generate Code
    Based on user request, generate FlowZap Code following the syntax rules.
  3. Step 3: Validate
    {"name": "flowzap_validate", "arguments": {"code": "..."}}
  4. Step 4: Fix Errors (if any)
    Parse the error codes; for mechanical defects (numbering, handles, label syntax, missing lane labels, emoji) call flowzap_fix and use its output instead of rewriting by hand.
  5. Step 5: Create Playground
    {"name": "flowzap_create_playground", "arguments": {"code": "..."}}
  6. Step 6: Read the advisory quality block
    If the playground reply reports process defects (orphan-node, multiple-start-nodes, dead-end-node…), correct the code and call the tool again before presenting it.
  7. Step 7: Present to User
    Share the playground URL with the user.

Common Mistakes to Avoid

MistakeIncorrectCorrect
Lane comment on separate linelaneName {
# Label
laneName { # Label
Abbreviated shapesn1: rectn1: rectangle
Missing handlesn1 -> n2n1.handle(right) -> n2.handle(left)
Wrong node attribute syntaxlabel="Text"label:"Text"
Wrong edge label syntax[label:"Text"][label="Text"]
Emojis in labelslabel:"Start πŸš€"label:"Start"
Unknown attributespriority:"high"(remove - not supported)
Non-sequential IDsn1, n3, n5n1, n2, n3
Undefined lane refsundefined.n5Use actual lane name
Second request before responseA -> B, then A -> C, then B -> AA -> B, then B -> A, then next request

API Endpoints (Direct Access)

For agents that prefer direct HTTP calls instead of MCP:

POST /api/validate

URL: https://flowzap.xyz/api/validate

Rate Limit: 120 requests/minute per IP (1200/minute for clients sending X-MCP-Client: flowzap-mcp)

Request:

{
  "code": "sales { # Sales Team n1: circle label:\"Order received\" n2: rectangle label:\"Validate order\" n1.handle(right) -> n2.handle(left) }"
}

Response (invalid code):

{
  "success": true,
  "valid": false,
  "errors": [
    { "line": 2, "code": "INVALID_EDGE_SYNTAX", "severity": "error",
      "message": "Invalid edge syntax. Expected: source.handle(direction) -> target.handle(direction)" }
  ],
  "warnings": [
    { "line": 1, "code": "MISSING_LANE_LABEL", "severity": "warning",
      "message": "Lane \"sales\" is missing a display label. Add \"# Display Name\" after the opening brace." }
  ]
}

Response (valid code):

{
  "success": true,
  "valid": true,
  "errors": [],
  "warnings": [],
  "stats": { "lanes": 2, "nodes": 5, "edges": 4, "loops": 0 },
  "attribution": "Powered by FlowZap.xyz"
}

Every error and warning carries a stable code, a severity and the line to look at (line 0 = document-level rule).

POST /api/playground/create

URL: https://flowzap.xyz/api/playground/create

Rate Limit: 5 requests/minute, 50/day per IP

Request:

{
  "code": "sales { # Sales Team n1: circle label:\"Order received\" n2: rectangle label:\"Validate order\" n1.handle(right) -> n2.handle(left) }",
  "view": "workflow"
}

Response:

{
  "success": true,
  "url": "https://flowzap.xyz/playground/3f6c1d9e-5b2a-4c77-9f1d-2a8b6c0d4e11?view=workflow",
  "tokenExpiresAt": "2026-11-01T17:48:11.656Z",
  "quality": {
    "defects": [
      { "code": "orphan-node", "nodes": ["n5"],
        "message": "These steps have no incoming edge: they start the flow as if nothing led to them: n5. …" }
    ],
    "warning": "\n\n⚠️ Process quality (advisory) …"
  }
}

quality is always returned for workflow, sequence and architecture views β€” with defects: [] and an empty warning when the shape is clean β€” and is absent for view: "mindmap", which is not audited as a process. The response is advisory: the session exists and the URL is valid whatever the audit says. Sessions expire after 60 minutes.

Installation

The FlowZap MCP Server works with any tool that supports the Model Context Protocol (MCP). Here is the complete list of compatible tools:

All Compatible Coding Tools

ToolHow to Configure
Claude DesktopAdd to claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Claude CodeRun: claude mcp add --transport stdio flowzap -- npx -y flowzap-mcp
Or add to .mcp.json in your project root.
CursorOpen Settings β†’ Features β†’ MCP Servers β†’ Add Server. Use the same JSON config.
Windsurf IDEAdd to ~/.codeium/windsurf/mcp_config.json
OpenAI CodexAdd to ~/.codex/config.toml:
[mcp_servers.flowzap]
command = "npx"
args = ["-y", "flowzap-mcp"]
Or run: codex mcp add flowzap -- npx -y flowzap-mcp
Warp TerminalSettings β†’ MCP Servers β†’ Click "+ Add" β†’ Paste the JSON config.
Zed EditorAdd to settings.json:
{"context_servers": {"flowzap": {"command": "npx", "args": ["-y", "flowzap-mcp"]}}}
Cline (VS Code)Open Cline sidebar β†’ MCP Servers icon β†’ Edit cline_mcp_settings.json
Roo Code (VS Code)Add to .roo/mcp.json in project or global settings.
Continue.devCreate .continue/mcpServers/flowzap.yaml with:
name: FlowZap
mcpServers:
- name: flowzap
command: npx
args: ["-y", "flowzap-mcp"]
Sourcegraph CodyAdd to VS Code settings.json via openctx.providers configuration.

Windows Users: If tools don't appear, use the absolute path: "command": "C:\\Program Files\\nodejs\\npx.cmd". Find your npx path with: where.exe npx

JSON Configuration

All tools use the same JSON configuration format:

{
  "mcpServers": {
    "flowzap": {
      "command": "npx",
      "args": ["-y", "flowzap-mcp"]
    }
  }
}

Windows Users: If tools don't appear, use the absolute path: "command": "C:\\Program Files\\nodejs\\npx.cmd". Find your npx path with: where.exe npx

Support & Resources

Install as Agent Skill (40+ agents)

npx skills add flowzap-xyz/flowzap-mcp

Compatible with: Claude Code, Cursor, Windsurf, Codex, Gemini CLI, GitHub Copilot, Cline, Roo Code, Augment, OpenCode, and more.

Version History

VersionDateChanges
2.2.0Nov 2026Advisory process-quality audit: flowzap_create_playground, flowzap_apply_change and POST /api/playground/create return a quality block (defects plus a rendered warning) listing process defects such as a step with no incoming edge or more than one start circle. Non-blocking; mind map views are exempt. 13 tools total
2.1.0Sep 2026New flowzap_fix tool (deterministic repair via POST /api/fix) + remote Streamable HTTP transport listed in the official MCP registry β€” hosted agents (Replit, Lovable.dev, ChatGPT connectors, Claude web) no longer need npx β€” 13 tools total
2.0.0Aug 2026Mind Map view (?view=mindmap) + 4 mindmap tools (validate, approve, template, create_playground) β€” 12 tools total
1.4.3May 2026Strengthened tool descriptions so all MCP clients (not only Claude Code via SKILL.md) auto-invoke flowzap_compliance_check alongside flowzap_create_playground on compliance requests; result page now matches the manual checker layout
1.4.2May 2026Shareable ephemeral compliance result URLs (60-min TTL, noindex) with rendered audit page; SKILL.md required two-line response format
1.4.1May 2026Compliance check returns resultUrl in addition to inline Markdown report
1.4.0May 2026New flowzap_compliance_check tool (SOC2/GDPR/PIPL, Deepseek-backed) with strict 3-layer rate limits; cross-sell hint added to flowzap_create_playground; 8 tools total
1.3.6Apr 2026Stricter validation (numbering gaps, ping-pong sequence enforcement, same-line lane labels), playground endpoint alignment, updated docs
1.3.5Feb 2026Security fixes: MCP SDK ReDoS, hono JWT/XSS, ajv ReDoS, qs DoS vulnerabilities
1.3.3Feb 2026All 7 tools wired, Architecture view mode
1.3.0Feb 2026Added Architecture view mode, triple-view rendering
1.2.0Jan 2026Added new validation rules, comprehensive test coverage
1.1.0Dec 2025Security hardening, rate limiting
1.0.0Nov 2025Initial release

This documentation is optimized for LLM consumption. For human-readable guides, visit flowzap.xyz/flowzap-code